Reference

The on-device denylist

A hard-coded list of Android package names smartordercapture refuses to automate. Enforced three times: at workflow save, at marketplace publish, and on-device before any UI action.

Some categories of automation we will not enable, regardless of plan tier, because they violate the host platform's Terms of Service, harm third parties, or both. The list below is shipped compile-time inside the Android app so the gate works even when the device has no network connectivity.

Note

The denylist is open source — you can inspect it in the APK or read the source at packages/shared/src/denylist.ts. We add to it as we learn about new misuse categories.

How enforcement works

Three layers, in order of when they catch a violation:

API, at workflows.create / workflows.update. The server walks the workflow, collects every targeted package, and rejects the request if any appear in the list. The denylisted package names are returned in the error so the builder can highlight the offending node.
Marketplace review worker. Any template submitted to the marketplace is re-scanned by a worker job before going public. Templates that hit the denylist are unpublished and the author is notified.
On-device, in the Kotlin interpreter. Just before dispatching any UI action that targets a package, the interpreter checks the compiled-in list. If a workflow somehow slipped past the server (older client, network race, anything), the device refuses to run it. The run records a failed outcome with a clear error message.

What gets a workflow into the denylist gate

A node hits the gate when it has a package-name reference:

trigger.appOpened.packageName
trigger.appClosed.packageName
trigger.notificationReceived.packageName
action.openApp.packageName
action.tapByText.inPackage
action.startMusic.packageName

The current list

Categorized for readability. The on-device check is a flat set membership test against 17 package ids.

Gig delivery driver apps

Automating offer acceptance violates these platforms' ToS, exposes drivers to account deactivation, and takes work from other drivers.

com.dd.doordash
com.doordash.driverapp
com.ubercab.driver
com.ubercab
com.walmart.androidsparkdriver
com.amazon.rabbit
com.instacart.shopper
com.instacart.client
me.lyft.android
com.lyft.android.driver

Ticket purchase platforms

Automated buying is prohibited by these platforms and, in many U.S. jurisdictions, by the federal BOTS Act of 2016.

com.ticketmaster.mobile.android.na
com.stubhub
com.seatgeek.android

Ad-network SDKs

Workflows targeting these SDKs are typically attempting to simulate views, clicks, or installs for ad fraud.

com.google.android.gms.ads
com.facebook.ads
com.applovin.sdk
com.unity3d.ads

What about packages that aren't on the list?

Everything else is fair game from our enforcement's perspective. That doesn't mean you should automate anything you can — read your favorite app's Terms of Service before building workflows against it. Some apps prohibit automation in any form, others only at scale, others not at all. We can't adjudicate every case for you, but we hard-block the categories where we know it's wrong.

Reporting an addition

If you think a package should be on the list, email abuse@smartordercapture.com with the package name and the reasoning. Additions ship in the next Android release.

Full policy text: Acceptable Use Policy.