7

I have written a nifty little web app (in Java/GWT/JS) and have been experimenting with the idea of making it available through Facebook as a Facebook App as well.

After spending some time reading Facebook's developer docs, it seems like I can just create a Facebook App to point at any URL I want and use that as the app/canvas. It accomplishes this via iframes.

So, my tentative plan is to just point it towards my (existing) web app so that I don't have to totally re-write it.

But then that got me thinking: Facebook must regulate what sorts of things can be done through a Facebook App, vs. what an app can't do.

For instance, I can't imagine I can point a Facebook App to point at a URL for a web app that accepts e-commerce payments (that would by-pass Facebook altogether and not allow them to take a cut from the ecom transaction!). Also, I can't imagine that Facebook allows developers to point their Facebook Apps to just any old URL without some sort of a scan, otherwise that would open Facebook up to the horrors of every security threat knownst to humanity.

I know for a fact that when you write an iOS native app and put it up on the Apple App Store, that Apple actually scans your source code for violations of their EULA.

So my question: does Facebook do the same? If so, what are their terms & conditions for what a Facebook app can/can't do? Suprisingly, I can't find this anywhere!! Thanks in advance!

Improve this question
4
  • 4
    Side note, but still important: Apple does not scan your code. They scan the binaries you produced for accessing undocumented APIs and they test your app black-box style. I'm assuming if FB does anything like this, they'd do it similarly
    – K.Steff
    Jul 5, 2012 at 1:27
  • Thanks for the correction @K.Steff (+1) - you are absolutely correct its the binaries scanned not the source.
    – herpylderp
    Jul 5, 2012 at 11:30
  • I have been reading Facebook's Platform Policies (there are many) and will come back with a summary of them (general guidelines for Facebook developers) within 1 week.
    – herpylderp
    Jul 6, 2012 at 17:26
  • "I know for a fact that when you write an iOS native app and put it up on the Apple App Store, that Apple actually scans your source code for violations of their EULA." - Actually Apple doesn't do this, they do have ways to figure out what calls you are making, otherwise if they did scan your code the russian malware that was approved wouldn't have been approved.
    – Ramhound
    Jul 10, 2012 at 12:51

1 Answer 1

Reset to default
0

You're looking for the Facebook Platform Policies.

They do have a lot of rules, but most of them are related to protecting the Facebook® brand, protecting user data, and preventing spam/scams (they also have standard third-party hosting EULA terms, like no apps about gambling, porn, drugs, alcohol, and the like). Basically, if you are not using/abusing the Facebook brand in any way or trying to steal data or do anything shady, and your app is family-friendly, it's probably okay (but of course, never assume this—read the full policy!).

They have a subsection entitled "Enforcement" where they say that they can remove your app for any reason. They use both automated and manual testing for compliance, but don't divulge many details, so it's impossible to tell how extensive their automated checks are; they certainly don't make a claim to your source code, but probably do some sort of automated scan of your public-facing html/javascript. The full text of this sub-section is reproduced here:

We can take enforcement action against you and any or all of your applications if we determine in our sole judgment that you or your application violates Facebook Platform Terms and Policies. Enforcement action is both automated and manual, and can include disabling your application, restricting you and your application's access to Platform functionality, terminating our agreements with you, or any other action as we in our sole discretion deem appropriate.

Communication with developers takes place via an email sent from the facebook.com or facebookmail.com domain to the contact email address registered to the application. To stay in touch, please ensure that your email address is current and that you do not filter out any such messages.

Regarding your question about payments, they have an entire sub-policy covering just payments—the Facebook Developer Payments Terms. The gist of it is that yes, they want to use only their proprietary payments platform (called "Facebook Payments" and often using a virtual currency called "Facebook Credits"), and they take a 30% cut. But if your app is going to implement a payments system, don't make any assumptions—read the full policy!

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.