|
| 1 | +# Vercel ToS / Compliance Review |
| 2 | + |
| 3 | +**Scope:** Whether the `vercel-templates-discovery` project can publicly index and redistribute metadata from `https://vercel.com/templates`. |
| 4 | + |
| 5 | +**Review date:** 2026-07-07 |
| 6 | +**Documents reviewed:** |
| 7 | +- Vercel Terms of Service (saved locally as `Terms of Service.html`, source `https://vercel.com/legal/terms`) |
| 8 | +- Vercel robots.txt (`https://vercel.com/robots.txt`) |
| 9 | + |
| 10 | +## robots.txt |
| 11 | + |
| 12 | +```text |
| 13 | +User-Agent: * |
| 14 | +Content-Signal: search=yes, ai-input=yes, ai-train=no |
| 15 | +
|
| 16 | +Allow: /api/og/* |
| 17 | +Allow: /api/docs-og* |
| 18 | +Allow: /api/product-og* |
| 19 | +Allow: /api/dynamic-og* |
| 20 | +Allow: /api/model-og* |
| 21 | +Allow: /api/www/avatar/* |
| 22 | +
|
| 23 | +Disallow: |
| 24 | +Disallow: /api/ |
| 25 | +Disallow: /oauth |
| 26 | +Disallow: /confirm |
| 27 | +Disallow: /notifications |
| 28 | +Disallow: /old-browser.html |
| 29 | +Disallow: /preauthorize |
| 30 | +Disallow: /signup?* |
| 31 | +Disallow: /invites/ |
| 32 | +
|
| 33 | +Sitemap: https://vercel.com/sitemap.xml |
| 34 | +``` |
| 35 | + |
| 36 | +`/templates` is **not** listed in `Disallow`. The empty `Disallow:` directive (without a path) does not block anything; the explicit disallowed paths do not include the templates gallery. |
| 37 | + |
| 38 | +## Relevant Terms of Service clauses |
| 39 | + |
| 40 | +### Section 2 — Temporary Use License |
| 41 | +Grants a personal, non-exclusive, non-transferable, limited license to use the Services for internal business or personal purposes. This is primarily about account holders using Vercel's platform, not about browsing public marketing pages. |
| 42 | + |
| 43 | +### Section 3 — Your Content |
| 44 | +Covers content users upload/post to Vercel. Does not apply to publicly visible template listings we read without an account. |
| 45 | + |
| 46 | +### Section 7 — Acceptable Use |
| 47 | +Requires compliance with the [Acceptable Use Policy](https://vercel.com/legal/acceptable-use-policy). Notably, it does not prohibit automated access to public pages per se. |
| 48 | + |
| 49 | +### Section 8 — Etiquette |
| 50 | +Vercel may monitor use and prohibit activity it believes violates terms. This gives Vercel broad discretion but does not create an explicit scraping ban. |
| 51 | + |
| 52 | +### Section 11 — Usage Restrictions |
| 53 | +The most relevant section. Prohibits: |
| 54 | +- (iii) unauthorized access to Services or related systems/networks |
| 55 | +- (vi) violation of applicable laws or infringement of third-party rights |
| 56 | + |
| 57 | +Key question: Is automated, public, read-only access to the marketing/templates gallery "unauthorized access"? The terms do not explicitly define it, and the pages are published without authentication. robots.txt does not block it. This is a **gray area** rather than a clear violation. |
| 58 | + |
| 59 | +### Section 14 — Representations |
| 60 | +Users must not infringe third-party IP, privacy, or publicity rights. Template metadata (title, description, GitHub URL, install command) is generally factual and publicly displayed, but the README text and page copy may contain copyrightable content. |
| 61 | + |
| 62 | +### Section 15 — Indemnification |
| 63 | +Users indemnify Vercel for breaches, infringement claims, or misuse of Services. |
| 64 | + |
| 65 | +## Risk assessment |
| 66 | + |
| 67 | +| Risk | Level | Notes | |
| 68 | +|------|-------|-------| |
| 69 | +| Breach of ToS for scraping public pages | **Low to medium** | No explicit ban; robots.txt allows; pages are public and unauthenticated. | |
| 70 | +| Copyright in template descriptions/READMEs | **Medium** | Vercel or template authors may own copyright in descriptions and README text. We should not publish full READMEs verbatim. | |
| 71 | +| Trademark use of "Vercel" / template names | **Low** | Nominative use to identify the service is generally acceptable; avoid implying official affiliation. | |
| 72 | +| Rate-limiting / abuse | **Low** | Current implementation uses delays, concurrency limits, and a realistic User-Agent. | |
| 73 | +| Vercel changing terms or robots.txt | **Medium** | Any future change could require re-evaluation. | |
| 74 | + |
| 75 | +## Mitigations already in place |
| 76 | + |
| 77 | +- Public pages only; no login or API credentials used. |
| 78 | +- `robots.txt` is respected (`/templates` is allowed). |
| 79 | +- Rate limiting: delays between category requests, limited concurrency. |
| 80 | +- Realistic browser User-Agent. |
| 81 | +- No mutation of Vercel systems; read-only indexing. |
| 82 | +- Metadata is stored locally; the published `catalog.json` is a user-generated export. |
| 83 | + |
| 84 | +## Recommended mitigations before v1.0.0 |
| 85 | + |
| 86 | +1. **Disclaim official affiliation.** README and documentation should state clearly: "This is an unofficial community tool and is not affiliated with or endorsed by Vercel." |
| 87 | +2. **Limit redistribution of verbatim content.** Do not publish full READMEs or long excerpts from Vercel template detail pages in `catalog.json` or releases. Keep published data to metadata only (title, slug, framework, GitHub URL, install command, short description). |
| 88 | +3. **Respect future robots.txt changes.** Add a nightly check that aborts indexing if `/templates` becomes disallowed. |
| 89 | +4. **Document fair-use intent.** Explain that the tool helps users discover Vercel templates and always links back to the original Vercel pages and GitHub repositories. |
| 90 | +5. **Consider contacting Vercel.** For a definitive green light, ask Vercel via their support or open-source team whether a read-only community index of the templates gallery is acceptable. This is the only way to eliminate legal uncertainty completely. |
| 91 | + |
| 92 | +## Conclusion |
| 93 | + |
| 94 | +A public v1.0.0 release appears **defensible** under current Vercel terms and robots.txt, provided the project remains read-only, respects rate limits, does not claim affiliation with Vercel, and avoids publishing substantial verbatim copyrighted content. The remaining legal risk is moderate and can be further reduced by adding the recommended mitigations and, ideally, obtaining explicit permission from Vercel. |
| 95 | + |
| 96 | +**Decision:** Proceed to v1.0.0 after implementing the mitigations above, with a note that this is an ongoing legal risk to monitor. |
0 commit comments