> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aropay.aro.media/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy terms

> Accept the data-privacy terms before your first transaction, check acceptance through the API, and handle new versions.

Before an account can move value, a person must accept the AroPay data-privacy
terms: what data the platform collects, who it is shared with, and what the
confidential rail does and doesn't hide. Read them at
[aropay.aro.media/terms](https://aropay.aro.media/terms); no sign-in needed.

## What requires acceptance

Until the account has accepted the current version, these endpoints return
`403 terms_not_accepted`:

| Endpoints | Covers |
| - | - |
| `POST /fund`, `/mint`, `/transfer`, `/redeem` | [Money movement](https://docs.aropay.aro.media/concepts/transactions.md) |
| `POST /transfer/letter`, `/transfer/letter/{id}/mail`, `/transfer/letter/claim` | [Aro Mail](https://docs.aropay.aro.media/concepts/aro-mail.md) create, mail, and claim |

The check is tied to the **account**, so it applies to API keys and sessions
alike, and it runs before the body is validated. Everything else works without
acceptance: reads, wallets, API keys, your profile, and voiding a letter
(which refunds you).

```json theme={"system"}
{
  "ok": false,
  "error": {
    "code": "terms_not_accepted",
    "message": "Accept the AroPay Sandbox data privacy terms before making transactions. Sign in to the dashboard to review and accept them.",
    "details": { "version": "1", "url": "/terms" }
  }
}
```

## Accepting

Sign in to the dashboard and accept under **Settings**, or from the prompt the
dashboard shows on your first transaction. Acceptance is
[session-only](https://docs.aropay.aro.media/security/authentication.md#session-only-endpoints): an API key
cannot accept on your behalf, so for a key-only integration, sign in once and
accept before its first run. Sandbox and production accounts are separate;
accept in each environment you use.

> [!NOTE]
>
> The platform records the version you accepted, a hash of the exact text you
> were shown, the time, and the IP address and browser user agent you accepted
> from, as the record of your consent.

## Checking status

`GET /me/terms` accepts either credential:

```bash theme={"system"}
curl -s "$BASE/me/terms" -H "Authorization: Bearer $KEY"
```

```json theme={"system"}
{
  "ok": true,
  "data": {
    "terms": {
      "current": {
        "version": "1",
        "effectiveDate": "2026-10-28",
        "contentHash": "9f2c…",
        "url": "/terms",
        "document": { "version": "1", "title": "AroPay Sandbox Data Privacy Terms", "…": "…" }
      },
      "accepted": null,
      "required": true
    }
  }
}
```

`required: true` means the endpoints above will refuse. Once accepted,
`accepted` carries `{ version, acceptedAt }` and `required` is `false`.
`document` holds the full text (title, key points, sections) if you want to
render it yourself.

## When the terms change

A new version comes with a new `version` and `effectiveDate`, and every
account must accept it before its next transaction; until then the gated
endpoints return `403 terms_not_accepted` again. Treat that code as needing a
person, not a retry: alert someone to sign in and accept.

`POST /me/terms` takes the `version` and `contentHash` from `GET /me/terms`,
so a page still showing an older text can't accept it. A stale pair returns
`409 terms_version_mismatch`; fetch the terms again and accept the current
version.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.