---
# System prepended metadata

title: Submit to Slack App Directory

---

# Submit to Slack App Directory 


This is a breakdown of all of the requirements for submitting our app to Slack's app directory, divided into two groups:  **Engineering** and **non-engineering** tasks.

These requirements come directly from Slack's site: https://app.slack.com/app-settings/T1GGHE34Y/A013PAJ65J5/submission

## Engineering Tasks

### Review your permission scopes

- [x] If I’m submitting a new app to the App Directory or resubmitting an app that’s already listed, I confirm it uses granular permissions.
- [x] The scopes requested are the minimum necessary for the service to function. My app does not request broad access to message data or other sensitive information, circumvent Slack’s administrative or privacy controls, nor use the following scopes: read, post, client, search:read.
- [x] Please add a detailed reason why you’re requesting each OAuth scope.
  - `users_list` 
    - https://api.slack.com/methods/users.list
    - `users:read`
    - Ability to associate our customers' Zestful users with their Slack counterparts
  - `post_direct_message`
    - https://api.slack.com/methods/chat.postMessage
    - `chat:write`
    - Ability to send our customers’ users private bonus messages from their admins, and the ability to post Kudos given and completed Goals in our customers’ chosen Slack channel
  - `post_to_channel`
    - https://api.slack.com/methods/chat.postMessage
    - `chat:write`
    - `chat:write.public`
    - Ability to post Kudos given and completed Goals in our customers’ chosen Slack channel, and for our Slack app to gain the ability to post in all public channels
  - `post_ephemeral_message`
    - https://api.slack.com/methods/chat.postEphemeral
    - `chat:write`
    - Ability to display help information and Zestful offerings upon our customers' request
  - `lookup_by_email`
    - https://api.slack.com/methods/users.lookupByEmail
    - `users:read.email`
    -  Ability to map a Slack user to their Zestful user account when their Zestful vs. Slack email address differs
  - `conversations_list`
    - https://api.slack.com/methods/conversations.list
    - `channels:read`  
    - Ability for our customers' admins to choose a public channel to post Kudos and completed Goals in 
    - ~groups:read~
  - `views_open` 
    - https://api.slack.com/methods/views.open
    - none
  - `views_update`
    - https://api.slack.com/methods/views.update
    - none
  - `commands`
    - Ability for our customers' to give Kudos to their teammates and complete Goals
- [x] My app configuration lists all of the requested scopes in every step of the OAuth flow, and I have provided detailed reasons for how each scope is used.

### Review your user experience

- [x] My app provides a high quality experience in Slack, suitable for the workplace.
- [x] Messages from my app use clear, consistent formatting. (Read about building with blocks. You can also use our Message Builder to see a preview of your messages or find templates for your app.)
- [x] My app never contacts any user using any information obtained from Slack without explicit and separate consent from that user to do so.
- [x] My app only sends direct messages or uses @channel or @here notifications when appropriate.
- [x] My app does not send messages to the #general channel by default or to a user’s Slackbot direct message.
- [x] If my app uses a slash command, there’s a way for a user to ask for help or send feedback. For example, the slash command should respond to "/mycommand help" with information about using the app.
- [x] If using the App Home "Messages" tab, my bot responds to users’ direct messages. It also uses the app_home_opened event to send a welcome message the first time any user opens this view.
- [x] If using the App Home "Home" tab, any content displayed there is helpful and appropriate for the user viewing it.
- [x] My app only requests domain events that are needed to function.
- [x] I’ve installed my app on a new workspace to fully test the installation, onboarding, and functionality of the app before submitting it to the Slack App Directory.
- [x] My app is ready to support a growing number of users once it’s listed in the App Directory and is not currently in private beta.
- [x] My app does not facilitate financial transactions in Slack.
- [x] I will revoke all API tokens for my app when it’s no longer maintained and communicate deprecation plans to users and the App Directory team.
- [x] My app uses TLS 1.2 or higher for any redirect URIs, web pages, or endpoints.
  - verified this by running this command after being logged in
  - `curl -vI https://app.zestful.com/kudos`
  - https://devcenter.heroku.com/articles/ssl#verify-ssl-is-setup-correctly
- [x] My app complies with Slack’s brand guidelines.

### Review your installation links

- [x] My app owns the domain names for its privacy policy, support, and landing page URLs.
- [x] If connecting Slack with private customer data, my app’s OAuth flow uses a state parameter.
  - https://api.slack.com/authentication/oauth-v2#asking
  - not sure if i need to add this?
- [x] If included, the direct install URL I’ve provided responds with a 302 redirect back to Slack’s authorization URL.

### Review and agree to our policies  

- [x] My app meets Slack’s guidelines and API Terms of Service.
- [x] I agree to follow Slack’s App Developer Policy and App Directory Agreement.
- [x] We provide users with a mechanism to request to delete, access, and transfer an individual’s data
- [x] Personal data that is collected and processed is not held or further used unless for reasons that are clearly stated and agreed to in advance to support data privacy.
- [x] Personal data is collected for specified, explicit, and legitimate purposes and kept for no longer than necessary for the purposes of processing.
- [x] My app follows our security guidelines.

### Help Admins by Adding Security & Compliance

#### Privacy and data governance 

- [ ] Data retention policy
Ex: ExampleCorp will retain Customer Data in accordance with …
- [ ] Data archival/removal policy
Ex: ExampleCorp will remove Customer Data in accordance with …
- [ ] Data storage policy
Ex: ExampleCorp will store Customer Data in accordance with …
- [ ] Data center location(s)(optional)
Select data center location(s)
- [ ] How do you host your data?(optional)
Ex: Cloud hosted, on premise …
A general description of how your data is hosted.
- [ ] Data host company(optional)
Ex: AWS, Azure, Steve’s Server Emporium …
Enter the name of the company that hosts your data.
- [ ] Do you have sub-processors?
Yes
No

#### Certifications and compliance 

- [ ] SOC attestation URL(optional)
https://example.com/soc-cert
- [ ] COPPA compliance URL(optional)
https://example.com/coppa
- [ ] ISO/IEC-27001 certification URL(optional)
https://example.com/iso-iec-27001-cert
- [ ] ISO/IEC-27017 attestation URL(optional)
https://example.com/iso-iec-27017-cert
- [ ] ISO/IEC-27018 attestation URL(optional)
https://example.com/iso-iec-27018-cert
- [ ] FedRAMP ATO URL(optional)
https://example.com/fedramp-cert
- [ ] CSA Star Level certification URL(optional)
https://example.com/csa-star-level-cert
- [ ] Are you HIPAA compliant?
Yes
No
- [ ] Privacy shield notice URL(optional)
https://example.com/privacy-shield
- [ ] GDPR commitment URL(optional)
https://example.com/gdpr
- [ ] What is your procedure for handling requests for data deletion?
Ex: When someone requests for ExampleCorp to delete personal data, we …

#### Security

- [ ] Date of latest pen test(optional)
Select date
- [ ] Does your service support SSO?
- [ ] Does your service support SAML?
- [ ] Do you have a dedicated security team?
- [ ] Do you have a vulnerability disclosure program?
- [ ] Do you have a bug bounty program?
- [ ] Are any third party auths/connections required for your app to function?
- [ ] How can users contact you with security issues?
security@example.com
Required
- [ ] What third party services does your app use?(optional)
Ex: Libraries, payment processors …



## Non-Engineering Tasks

### Review your user experience

- [X] Messages from my app are free of typos and grammatical errors.

### Prepare your app directory listing

- [x] Provide all digital marketing materials and copy.  Examples:
  -  https://zestful-staging.slack.com/apps/A0PHW22DR-bonusly
  -  https://zestful-staging.slack.com/apps/A0144HB2RH6-awardco
  -  https://zestful-staging.slack.com/apps/A0J4UNFLN-heytaco
- [X] Please [add at least 1 category to your app](https://api.slack.com/apps/A013PAJ65J5/general#categories_section) to help users discover it.
    - `HR & Team Culture`
    - `Social & Fun`
    - `Communication`
- [X] My app doesn’t infringe on any trademark, copyright, or other intellectual property rights.
- [X] My app doesn’t have the same name as another app currently listed in the App Directory.
- [X] My app does not use “Slack” in its name or domain name other than to note itself as a third-party integration. (For example, "My Service for Slack" is okay, but "My Slack Service" is not.)
- [X] My app has a high quality, distinctive icon that doesn’t resemble Slackbot or the Slack icon.
- [X] My app has a short description of how it works and what it does (10 words or fewer is ideal).
    - `Zestful is the best way to reward your team by staying connected.` 
- [X] My app has a clear, detailed, and truthful long description of what it does.
    ```
    Zestful is the easiest way to improve company culture, boost morale, and bring your teams closer together no matter where they are. Through rewarding and appreciating each other, team members can engage through the Zestful platform by:

    - Celebrating Goal accomplishments
    - Giving Kudos to each other
    - Celebrating Birthdays and Work Anniversaries
    - Competing in Challenges
    - Earning individual and team Prizes

    All Zestful activity can be shared to a public Slack channel for ultimate celebration.

    ```
- [X] If included, the Youtube link I’ve provided links to a video that clearly explains how to use my app in Slack.
    - Don't have 
- [x] If included, I’ve provided high-quality images that clearly explain how to use my app.
- [X] My app fully supports the languages I have selected.
- [X] I’ve provided accurate pricing information for my app. (If your app is associated with a paid service that’s required for the app to function, please choose one of the paid options.)
    - Standard: $3 per person per month
    - w/ Zestful Reward card: $5 per person per month
    - Pricing link might be helpful?: https://zestful.com/pricing

### Review your installation links

- [X] My landing page contains a detailed summary of what my app does and how it integrates with Slack. (Please see our [landing page guidelines](https://api.slack.com/start/distributing/guidelines#landing) for more information).
    ```
    Zestful is the easiest way to improve company culture, boost morale, and bring your teams closer together no matter where they are. Through rewarding and appreciating each other, team members can engage through the Zestful platform by:
    
    :clap: Celebrating Goal accomplishments
    :heart: Giving Kudos to each other
    :birthday: Celebrating Birthdays and Work Anniversaries
    :first_place_medal: Competing in Challenges
    :gift: Earning individual and team Prizes

    **Zestful in Slack**
    The Zestful Slack app allows you to be notified of activity posted by your teammates, via a specific Slack channel. You can also conduct several Slack commands, such as:
    
    :clap: Accomplish Goals
    :heart: Give Kudos to a teammate
    :first_place_medal: Review current and past Challenges
    
    **Not a Zestful customer yet?**
    Sign up for a free trial at www.zestful.com to get started! 
    ```
- [X] My landing page contains clear instructions for configuring and using my app (e.g., which parts of my app trigger messages in Slack, or which comments a bot responds to).
    ```
    **Commands:**
    
    `/zestful` to see the main Zestful menu of options
    `/zestful-kudos` to give Kudos to a team member
    `/zestful-goals` to accomplish an available Goal
    `/zestful-challenges-current` to see any current Challenge progress
    `/zestful-challenges-past` to see any past Challenge results
    `/zestful-help` to display a help menu of options

    ```
- [X] My app’s landing page clearly displays the “Add To Slack” button for users to install my app, or it has detailed instructions for accessing the Slack button if it’s behind a login page.
    - If we need to add this to the detail, we can: 
    ```
    :lemon: [Learn more about Zestful for Slack](https://intercom.help/zestful/en/articles/4147000-slack-integration)
    ```
- [X] My landing page includes a link to an accessible privacy policy that clearly explains how my app will collect, manage, and store third-party data. (If the privacy policy isn’t available in English, you will need to send us a human-translated English version by email.)
    - https://zestful.com/privacy-policy

### Prepare your customer support

- [X] My app links to a page with clear instructions for contacting our team if someone encounters a problem or needs help.
- [X] Users are not required to create a new account of any kind to contact my team for support.
- [X] I agree to keep my app updated and my support channel active.

### Review and agree to our policies  

- [X] If requested by the customer, I am able to demonstrate compliance with all applicable privacy regulations and laws.
- [X] I agree to allow Slack to conduct a security review of my app by terms laid out in both the [Slack App Directory Agreement](https://api.slack.com/slack-app-directory-agreement) and the [Security Review Guide](https://api.slack.com/security-review).
- [X] If provided, the security and compliance information I have included is accurate and truthful.

### Help us review your app

#### Test account details for your service
- [X] If an account or paid plan is required to access your app, please provide test account details for us. Providing an account with some test data will help us test more quickly. If an account isn’t necessary, you may enter N/A.
    - www.zestful.com
    - username/email: slacktest@zestful.com
    - password: slowJ@ckal14

#### Other Notes
- [X] If you’re submitting changes to your app, please briefly describe them. If there’s anything else we should know, please point it out! Otherwise, you may enter N/A
    - N/A

### Help Admins by Adding Security & Compliance

#### General
- [X] Company / developer name
    - Zestful, inc.
- [X] Company headquarters location
    - United States
- [X] Terms of service URL
    - https://zestful.com/terms-of-service










