FreeTier.fyi Protection Strategy

This document outlines the balanced approach FreeTier.fyi takes to protect the service while maintaining a developer-friendly, educational mission. Built by a developer, for developers.

Legal Framework

✅ What We Can Legally Protect

• Compilation methodology: Our AI-powered extraction and curation process
• Database schema: Structured organization and data relationships
• Search algorithms: Custom filtering and comparison logic
• UI/UX design: User interface and experience innovations
• Update systems: Automated data validation and refresh processes
• Educational presentation: How we organize and present the information

✅ Legal Position

• Database rights: Substantial investment in systematic arrangement
• Copyright protection: Original compilation and presentation work
• Trade secrets: Proprietary AI extraction algorithms
• Terms of Service: Clear prohibited uses and legal remedies

Technical Protection Layers

1. Origin-Based Access Control

// APIs only accessible from authorized domains
const ALLOWED_ORIGINS = [
  'https://freetier.fyi',
  'https://www.freetier.fyi',
  'https://freetier-fyi.vercel.app'
];

2. Reasonable Rate Limiting

• Web traffic: 30 requests/minute per IP (allows normal browsing)
• API access: 15 requests/minute per IP (supports legitimate dev tools)
• Progressive delays: Only for obviously abusive patterns
• IP tracking: Basic rate limit tracking to prevent server overload

3. Smart Bot Detection

const BLOCKED_AGENTS = [
  'scrapy', 'spider', 'crawler'
  // Allows curl, postman, wget - common dev tools are welcome!
];

4. Sensible Request Limits

• Suspicious patterns: Block obvious bulk extraction attempts ('dump', 'export', 'backup')
• Parameter limits: Maximum 15 parameters per request (generous for complex queries)
• Query length: 200 character limit (supports detailed searches)
• Response size: Maximum 20 services per API response (reasonable for most use cases)

5. Data Obfuscation

• Paginated responses: Force pagination, prevent bulk downloads
• Obscured totals: Don't reveal exact dataset size (cap at 50)
• Limited metadata: Minimal API schema exposure

6. Honeypot Endpoints

• /api/bulk - Catches scraping attempts, logs violators
• Misleading endpoints that look like bulk access but trigger monitoring

7. Security Headers & CSP

X-Frame-Options: DENY
X-Content-Type-Options: nosniff  
Content-Security-Policy: Restrictive policy
X-Robots-Tag: noindex (for APIs)

Monitoring & Detection

Real-time Monitoring

• All API requests logged with IP, user agent, patterns
• Suspicious activity triggers automatic blocking
• Honeypot access attempts logged for analysis
• Rate limit violations tracked per IP

Alert Triggers

• 50+ suspicious requests per minute
• 20+ blocked requests per minute
• Honeypot endpoint access
• Pattern matching on scraper signatures

Enforcement Strategy

Immediate Technical Response

1. IP blocking for rate limit violations
2. Origin blocking for unauthorized domains
3. Progressive delays for suspicious patterns
4. CAPTCHA challenges for bot-like behavior

Legal Response Escalation

1. Documented violation logging for evidence
2. Cease and desist notices for systematic copying
3. DMCA takedowns for replicated services
4. Legal action for commercial IP theft

Why This Protection Strategy Works

1. Legally Sound Foundation

• ✅ Educational use doctrine: Clear fair use for individual developers
• ✅ Compilation copyright: Protects our systematic arrangement
• ✅ Database rights: EU-style protection for substantial investment
• ✅ Terms of Service: Clear prohibited uses with legal remedies

2. Technical Barriers to Copying

• Origin restrictions: Can't access APIs from other domains
• Rate limits: Makes bulk extraction extremely slow and detectable
• Data pagination: Forces hundreds of requests for full dataset
• Pattern detection: Automatic blocking of systematic access

3. Economic Deterrent

• Time cost: Technical barriers make copying extremely time-intensive
• Detection risk: High probability of getting caught and blocked
• Legal risk: Clear terms and IP protection make violation risky
• Maintenance burden: Copying static data misses our AI update system

4. Legitimate Use Friendly

• ✅ Individual developers: Easy access for legitimate research
• ✅ Educational use: Clear support for learning and comparison
• ✅ Verification: Encourages checking original sources
• ✅ Attribution: Gives credit where due

What This Achieves

For Legitimate Users

• Fast, easy access for individual service research
• No barriers to educational and personal use
• Clear guidance on verification and attribution
• Helpful tools for developer decision-making

Against Bad Actors

• Systematic copying: Technically difficult and legally risky
• Commercial replication: Clear IP violations with legal consequences
• Bulk extraction: Blocked by multiple technical layers
• API abuse: Detected and automatically prevented

Result: Optimal Protection Balance

This strategy creates a high-friction environment for copying while maintaining zero friction for legitimate use. The combination of legal clarity, technical barriers, and monitoring makes systematic copying both difficult and legally risky, while preserving the educational value that makes FreeTier.fyi valuable to the developer community.

The approach is legally defensible because:

1. We're transparent about using public data
2. We clearly articulate our value-add and IP
3. We focus on protecting compilation work, not underlying facts
4. We maintain educational fair use for individual developers
5. We implement reasonable technical measures proportional to our IP value