Terms of service

1.The agreement

These terms are between Playxoft ([Playxoft legal entity name and company registration number], of [Playxoft registered address]) and you. By creating an account, signing in, or using the CLI, the API or this website against our hosted service, you accept them. If you do not accept them, do not use the service.

If you accept them on behalf of a company, you are telling us you have the authority to bind it, and “you” means that company from then on.

Two documents sit alongside these terms and are part of the deal: the privacy policy, and what xecret can and cannot see. Read the second one before you store a real credential — it is the document that says we can technically decrypt what you store.

2.Eligibility

You must be at least 16 and able to enter into a contract. You must not be barred from using the service by the sanctions or export-control laws that apply to either of us, and you must not be using it from a jurisdiction we are prohibited from serving.

One person, one account. Accounts are not shared: a colleague gets their own account and a role. That is not bureaucracy — a shared login makes every row of the audit log attribute an action to the wrong person, which is the one thing the log exists to prevent.

3.Your account, and keeping it secure

You are responsible for what happens under your account, and for everything any credential you created can reach.

• Your sign-in. WorkOS verifies it on our behalf, so if your email account, your Google account or your company’s single sign-on account is compromised, your xecret account is too. Turn on two-factor authentication wherever you sign in from.
• Your PIN. It gates reveals and destructive actions on a session that is already signed in. We store only a hash of it and cannot recover it; a reset link goes to the address on the account. Choosing a guessable PIN, or writing it on the laptop, is not a failure of the service.
• Your tokens. CLI tokens and service tokens act as you within their scope. Scope them narrowly, give them an expiry, and revoke them the moment a laptop is lost or a CI system is retired. Revocation is immediate and is never softened by the CLI’s offline cache.
• Your members. Removing somebody who has left is your job, and so is reviewing who holds production access. The tools are there; the decision is yours.

Tell us as soon as you believe an account or a token has been compromised. The audit log is what tells you what it reached; rotating the underlying credential at its source is what actually ends the exposure. Revoking a token does not un-leak a value it has already read.

4.Acceptable use

Do not:

• use the service unlawfully, or to store credentials you are not entitled to hold;
• attack it — no probing for vulnerabilities outside the disclosure process, no denial of service, no attempt to reach another organisation’s data;
• work around a rate limit or a plan limit, or automate the creation of accounts;
• resell the hosted service or run it as a service for third parties under our name — running the software yourself is governed by the AGPL, and section 10 says what that means;
• upload malware, or use the service to distribute it;
• misrepresent who you are, or use somebody else’s account.

Security research is welcome through the process in SECURITY.md. Testing against your own organisation, in a way that does not degrade the service for anybody else, is not a breach of this section.

We may investigate suspected abuse and take reasonable steps to stop it, including suspending an account. Where we can tell you what happened and why, we will.

5.Your content, and your own compliance

Your secrets, your names, your structure and your audit history are yours. We claim no ownership of them. You grant us only the licence we need to run the service: to store, transmit, encrypt, decrypt on your instruction, back up, and display that content to the people you have authorised.

What you store is your decision, and so is whether you are permitted to store it. If personal data ends up inside a secret value, you are its controller and we process it on your instructions. If you are subject to a regime with specific requirements — PCI DSS, HIPAA, a sector regulator, a customer contract — decide whether this service meets them before you store anything under it. We hold no certification and publish no attestation, and we would rather write that sentence than let you assume otherwise.

Read the trust model first. xecret uses server-side envelope encryption and can technically decrypt your values. If your obligations require a provider that cannot, this is not that product, and we would rather tell you here than after you have migrated.

6.Pre-alpha: availability and change

xecret is pre-alpha software. That is not a disclaimer bolted onto a finished product; it is the current state of it.

• No SLA. There is no uptime commitment on any plan today, and there will never be one on the free tier. An Enterprise agreement may add one in writing.
• Breaking changes. APIs, CLI flags, data shapes and the dashboard will change, sometimes without a deprecation period. We announce what we can in the repository.
• Maintenance and migration. We may migrate data between regions or schema versions, and take the service down to do it.
• Features may be removed, including ones you have come to rely on.
• Keep your own copy of anything you cannot rebuild. xecret pull exists; use it before a change you could not undo.

Design for this service being unavailable. The CLI’s offline cache exists for exactly that reason, and a deploy pipeline whose only path to a credential is a live API call to a pre-alpha service is a pipeline with a single point of failure you chose.

7.Plans, prices and billing

While xecret is in pre-alpha no card is collected and nothing is charged. The limits of each plan below apply from the publication of this version, and the prices are what they will be at 1.0.

• Free — $0, forever. 1 organisation, 5 projects, 3 members, 3 environments per project, 250 secrets in each, 10 service tokens, 2 CLI devices per member, no webhooks, 7 days of audit history, community support on GitHub.
• Pro — $8 per member per month, or $5 per member per month billed yearly. 3 organisations, 25 projects, 10 environments per project, 1,000 secrets in each, unlimited members, 50 service tokens, 5 CLI devices per member, 3 webhooks, 30 days of audit history, 200,000 secret fetches a month, email support.
• Team — $19 per member per month, or $12 per member per month billed yearly. Everything in Pro, plus 10 organisations, 100 projects, 25 environments per project, 5,000 secrets in each, 250 service tokens, 10 CLI devices per member, 25 webhooks, 180 days of audit history, 1,000,000 secret fetches a month, roles and per-environment access, and priority support with a one-business-day response target.
• Enterprise — custom. Everything in Team, without the organisation, project, environment, secret, token, device or webhook ceilings, plus a year of audit history, invoiced billing, a self-hosting support contract, a named contact, and a contractual SLA. SAML single sign-on is included at this tier.
• Add-ons, charged per connection. SAML single sign-on is $199 per connection per month from Team, and is included with Enterprise. It is billed per identity-provider connection rather than per member. Directory sync (SCIM) is included with Enterprise and is not sold below it. Neither is built yet — nothing is charged for either until it is.
• Self-hosted — free, always. The whole server under AGPL-3.0 on your own infrastructure, with no feature held back. Support is the community, or an Enterprise contract.

Team is billed from a minimum of 3 members and Enterprise from 10, whatever the number of people actually in the organisation. Below the minimum you are billed for it; you are never prevented from running with fewer. Free and Pro have no minimum.

When billing starts, we will tell you before it applies to your organisation and you will have to enter a card yourself. Nothing moves from free to charged silently. Paid plans are then billed in advance, per member, for whichever term you choose — monthly, or yearly at the lower per-member rate. A yearly term is paid up front and does not pro-rate if you leave part-way through it. Prices exclude VAT and sales tax, which we add where we are required to charge it.

Cancelling stops the next renewal, and the organisation returns to Free at the end of the period you have paid for. The limits above apply from the publication of this version. Once an organisation is at one, the next project, environment, secret, service token, CLI device, webhook or member past it is refused, and the refusal names the plan that would allow it. Reaching a limit, or a plan lapsing, deletes none of the organisation’s projects, environments, secrets or tokens: they stay readable and editable, and only adding more is refused. A lower plan does stop three things. On a plan that allows no webhooks, existing webhook endpoints are kept but paused — they send nothing, and cannot be edited, switched back on or tested until the plan allows them again, though switching one off or deleting it is never refused. On a plan without new-address read alerts, the alerts stop: new addresses reading an environment are not recorded and no alert or digest is sent until the plan includes them again. And any other feature the plan does not include, such as personal overrides or secret templates, keeps working as it was set but cannot be changed or added to, though what was set can always be removed. The current numbers are on the pricing page, and if they ever disagree with this section, this section is the one you agreed to.

Refunds: nothing has been charged during pre-alpha, so there is nothing to refund. Once billing is live, your statutory rights apply in full; beyond those, we do not refund part-months.

8.Suspension, termination, and what happens to your data

You can stop at any time: delete the organisation, or delete your account from Settings. The privacy policy describes exactly what deletion does, what survives it, and why the audit trail is the part that survives.

We may suspend or terminate an account that breaches these terms, that is being used to attack the service or another user, or where the law requires it. Except where the abuse is serious or continuing, or where the law forbids it, we will tell you first and give you a chance to put it right.

If we discontinue the service, or terminate your access to it, you get at least 30 days to export what you have. Export is xecret pull and the HTTP API, and both work on the free tier. We will still provide an export on request after a termination for abuse, unless the law prevents us.

The clauses meant to outlive this agreement do: intellectual property, disclaimers, limitation of liability, indemnity, and governing law.

9.Intellectual property and licences

The server is licensed under the GNU Affero General Public License v3.0. The CLI is MIT. Those licences are what govern the software, they are in the repository, and nothing on this page narrows a right either of them grants you.

These terms govern the hosted service we operate — the account, the availability, the support and the price. They are not a software licence.

The xecret name, the Playxoft name and our logos are ours. An open-source licence covers code, not trade marks: fork the software freely, and do not present the fork as xecret.

Feedback: if you send us a suggestion, we may use it without owing you anything for it. Do not send anything confidential in a public issue.

10.Self-hosting

Running your own instance is governed by the AGPL-3.0, not by these terms. You do not need our permission, we make no promises about your deployment, and we receive nothing from it — no telemetry, no phone-home, no licence check.

The AGPL’s network clause applies to you in turn: if you offer a modified version to users over a network, they are entitled to the source of your modifications. The self-hosting guide walks through the deployment and is blunt about the one irreversible risk — lose the root key and every secret is permanently unrecoverable, and there is no support ticket that fixes it.

11.Third-party services

The hosted service depends on Cloudflare, a managed PostgreSQL provider, WorkOS for identity, and an email provider. Their terms govern their part, and an outage at any of them is an outage here. The privacy policy names each of them and says what it processes.

Anything you connect xecret to — your CI system, your cloud provider, your own applications — is between you and them. We are not responsible for what a third party does with a secret you gave it access to.

12.No warranty

The service is provided “as is” and “as available”, with no warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, title, or non-infringement. We do not warrant that the service will be uninterrupted, that it will be error-free, or that it will preserve any particular data. The AGPL and the MIT licence disclaim warranties for the software itself in the same way.

Where a jurisdiction does not allow a warranty to be excluded, the exclusion applies to the maximum extent that jurisdiction allows. Nothing here excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be excluded.

13.Limitation of liability

To the maximum extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost goodwill, or the cost of substitute services, however caused.

Our total liability for all claims relating to the service in any twelve-month period is capped at the greater of the fees you paid us for the service in that period and US$100. During pre-alpha you pay us nothing, so that cap is US$100.

That is a real number, printed here rather than buried, because it is the number that should decide what you store. You are responsible for keeping your own copy of anything you cannot afford to lose, and for rotating a credential you believe has been exposed. Section 6 is not a formality.

14.Indemnity

You will indemnify Playxoft against claims, losses and reasonable legal costs arising from your content, from your use of the service in breach of these terms or of the law, or from your infringement of somebody else’s rights.

We will tell you promptly about any such claim, let you control its defence, and cooperate with you at your expense. You will not settle in a way that admits fault on our part, or that imposes an obligation on us, without our written agreement.

15.Changes to these terms

We may change these terms. The date at the top of the page changes with them, and the history is the git history of the repository this page lives in — you can see what it said before without taking our word for it.

For a material change we will give notice by email to organisation owners and in the product before it takes effect, 30 days ahead where we reasonably can. Continuing to use the service after a change takes effect is acceptance of it. If you do not accept a change, delete your account: before the change takes effect, where we gave notice of it; or, where a change took effect on publication without notice, before you use the service again.

This version is a change made without that notice, and it takes effect on publication. The version before it said, of an organisation whose plan lapsed: “we will tell you what exceeds the Free limits and give you a reasonable window to bring the organisation under them or export it”. This version provides neither of those for the limits under Plans, prices and billing: we do not tell you in advance what exceeds a limit, and there is no window before a limit applies — each applies from the publication of this version. What a limit does, and does not do, to what an organisation already holds is set out in that section.

16.Governing law and disputes

These terms are governed by the law of the jurisdiction in which Playxoft is established, without regard to its conflict-of-laws rules: [governing law jurisdiction — Playxoft’s place of establishment].

Disputes go to the courts of that jurisdiction: [courts of the governing law jurisdiction]. If you are a consumer, nothing here deprives you of the protection of the mandatory law of the country you live in, or of your right to bring proceedings there.

Before filing anything, tell us what the problem is. Most disputes about a pre-alpha developer tool are a misunderstanding that one honest message resolves faster than either of us could file a claim.

The company details these clauses depend on are marked above because they are not settled yet. A governing-law clause naming the wrong court is worse than one that visibly has not been completed, so we left the gaps visible.

17.Contact, and the small print

Reach us through the repository — open an issue on GitHub — until [Playxoft contact email address] is published. To report a vulnerability, follow SECURITY.md rather than opening a public issue.

• Entire agreement. These terms, the privacy policy, and any written order between us are the whole agreement about the hosted service, and they replace anything said before it.
• Severability. If a clause turns out to be unenforceable, the rest of the agreement stands.
• No waiver. Not enforcing something once does not give up the right to enforce it later.
• Assignment. You may not assign these terms without our consent. We may assign them to a successor of the business, and will tell you if we do.
• No agency. Nothing here creates a partnership, an agency, or an employment relationship.
• Force majeure. Neither party is liable for a failure caused by something genuinely outside its control.

These are pre-alpha terms, written by the people building the product and reviewed by a lawyer before general availability rather than before you read them. They are not legal advice, to you or to anybody else.