GitStache Terms of Service

Status notice. These Terms were drafted from GitStache's internal governance, licensing, and architecture records and describe the actual product. They have not yet been reviewed by qualified counsel. See § 18 for the counsel-review status and the on-page caveat we recommend carrying until that review completes.

1. Agreement to these Terms

These Terms of Service ("Terms") are a binding agreement between you ("you", "your", or "Customer") and Idiom Studios ("Idiom Studios", "we", "us", "our"), the operator of the GitStache platform at gitstache.dev (the "Service"). By creating an account, accessing, or using the Service, you agree to these Terms and to our Privacy Policy (docs/legal/privacy-policy.md), which is incorporated by reference. If you do not agree, do not use the Service.

If you use the Service on behalf of an organization, you represent that you are authorized to bind that organization, and "you" includes that organization.

2. Eligibility

You must be at least 16 years old in the EU/EEA (or the applicable digital-consent age in your country) and at least 13 years old in the United States to use the Service, and you must not be barred from using it under applicable law or subject to sanctions that would prohibit our providing it to you. The Service is not directed to children below these ages.

3. The Service

GitStache is a git forge: a platform for hosting source-code repositories, reviewing changes (including stacked, review-first change workflows), triaging work, running continuous integration (CI), and isolating build execution. The Service is offered as:

• a hosted offering at gitstache.dev (operated by us), and
• self-hostable software you can run on your own infrastructure under the license terms in § 7.

The Service is under active development. Features may be added, changed, or removed; our governance pledge (see GOVERNANCE.md) constrains how we change the terms and feature availability that matter most (see § 7.4).

4. Accounts and security

• You are responsible for maintaining the security of your account and credentials and for all activity under your account.
• You must provide accurate account information and keep it current.
• You may sign in through supported methods, including email login and third-party providers such as Google, GitHub, GitLab, and LinkedIn (via our identity provider). You may link multiple sign-in methods to one account; linking a new method requires a verified authorization path (see the Privacy Policy § 2.2).
• Two-factor authentication is available and is required for accounts with write access to private repositories, and may be enforced more strictly by an organization.
• Notify us promptly (§ 19) of any unauthorized use of your account.

5. Acceptable use

You agree not to use the Service to:

• violate any law or infringe others' rights (including intellectual-property, privacy, and publicity rights);
• upload or distribute malware, or use the Service to attack, probe, or gain unauthorized access to any system (yours, ours, or a third party's);
• abuse CI/compute resources, including using CI for cryptocurrency mining, denial-of-service, or other workloads unrelated to building and testing your software;
• attempt to break, bypass, or degrade the Service's isolation, tenancy, rate-limiting, quota, entitlement, or security controls;
• harass, threaten, or harm others, or upload unlawful or abusive content;
• misrepresent your identity or affiliation, or use the Service to send spam;
• resell or provide the hosted Service to third parties except as expressly permitted.

We may investigate suspected violations and may suspend or terminate access for conduct we reasonably believe violates these Terms or harms the Service, other users, or third parties (see § 13). Because we treat all CI jobs as potentially hostile and isolate them accordingly, abusive CI usage is a specific and enforceable violation.

6. Your content and ownership

You own your content. As between you and us, you retain all rights in the source code, commits, pull requests, issues, comments, configuration, and other content you upload or create on the Service ("Your Content"). These Terms do not transfer ownership of Your Content to us.

License you grant us to operate the Service. You grant Idiom Studios a worldwide, non-exclusive, royalty-free license to host, store, copy, transmit, display, and process Your Content solely to the extent necessary to provide, secure, back up, and support the Service for you (including copying repository content to CI executors to run the builds you trigger, and to sub-processors listed in the Privacy Policy). This license exists only to run the Service; it ends when Your Content is deleted, except for residual copies in backups pending rotation (Privacy Policy § 9). We do not use Your Content to train advertising models or to build cross-customer profiles, and any AI processing of Your Content is strictly opt-in.

Public content. If you make a repository or other content public, you additionally allow other users to view and, where you enable it (for example, via an open-source license you apply or by accepting contributions), fork and interact with that content through the Service's normal features. Making content public does not change its underlying license; you are responsible for applying whatever license you intend.

Your responsibilities for Your Content. You are responsible for Your Content, including:

• having the rights necessary to upload and share it;
• the personal data contained in Your Content (for example, names and emails in commit headers, or personal data in comments and files). We do not inspect, validate, or redact personal data in Your Content. You are the controller of that personal data and must have a lawful basis for it and handle data-subject requests about it (Privacy Policy § 2.5, § 7);
• ensuring Your Content does not violate § 5.

7. Open source, licensing, and tiers

GitStache is a commercial open-core product. This section states the licensing model accurately; it is load-bearing and we do not overstate it.

7.1 The AGPL-3.0 core, permanently open

The GitStache server core (the forge, CI orchestration, API, and the four choke-point differentiators: reviewable change shape / stacked review, the triage inbox, zero-trust / runner-trust CI, and service isolation) is licensed under the GNU Affero General Public License, version 3.0 (AGPL-3.0). This is a permanent commitment: we will not relicense the core away from an OSI-approved open-source license. Your rights in the AGPL-3.0 core are governed by the AGPL-3.0 license text itself, not by these Terms; nothing here limits the rights that license grants you (including running, studying, modifying, and redistributing the core, subject to AGPL-3.0's terms, notably its network-use / § 13 source-availability obligations if you run a modified version as a network service).

7.2 Permissively licensed client software

The GitStache client libraries, SDKs, and command-line interface (CLI) are licensed permissively under MIT or Apache-2.0, so integrators and downstream tooling can embed them without copyleft obligations.

7.3 Free, Premium, and Ultimate tiers

The Service is offered in tiers. The Free tier includes the forge, basic authentication (email/password and OIDC login), and the four choke-point differentiators, free forever in both the hosted and self-hosted deployments, with unlimited public repositories and public collaborators and a cap of 5 private-repository collaborators per organization.

Paid tiers add net-new features on top of the free core, gated in both the hosted service and self-hosted deployments:

• Premium: $12 per active user per month, adding organization-wide governance and merge policy, advanced roles, per-organization SSO (on the hosted service), larger CI allowances with metered overage, custom domains, larger storage/LFS, and priority support.
• Ultimate: $40 per active user per month, adding SCIM/directory sync, long-retention/immutable audit logs, compliance export, customer-managed encryption keys, and dedicated runner pools. A sales-led "Enterprise" arrangement is a variant of Ultimate adding SLA-backed support and negotiated capacity; it is not a separate tier.

Annual billing carries a 20% discount. An active user is an organization member who performs at least one forge operation in the billing month; invited-but-inactive members are not counted. Prices, allowances, and feature placement may change prospectively subject to § 7.4 and § 16; the current details live in docs/pricing.md and the pricing page.

Anti-claw-back pledge. A feature that is in the Free tier stays in the Free tier; the paid ladder is only ever net-new features added on top, never a withdrawal of something that was free. The four choke-point differentiators are structurally un-gateable in both deployments and can never be moved behind a paywall.

7.4 Self-hosted paid features and license keys

If you self-host and want paid (Premium/Ultimate) features, you obtain a per-seat license key from us that unlocks exactly the same features the hosted service gates. Self-hosted license terms:

• The key is validated offline. Your appliance verifies the signed license locally against a key embedded in the software; it does not phone home. This is designed for air-gapped and sovereignty deployments.
• Development and testing exception. Paid features may be used free of charge for development and testing; only production use requires a paid license.
• Read-only on expiry, never a lockout of your data. When a self-hosted license expires, the instance enters a read-only state for paid write/admin operations. Your data is never deleted, hidden, or encrypted away, and remains readable. You can delete the expired license key at any time to revert the instance to the fully functional Free tier (the forge, basic auth, and the four differentiators are always recoverable this way). Renewing the license restores paid functionality.
• License compliance. The license unlocks paid features for the seats and term you purchased. Circumventing the license gate to use paid features in production without a valid license (for example, by patching the software to bypass the check) is a breach of these Terms and of the applicable commercial license, even though the source is available. The mechanism is a license-compliance instrument, not a technical anti-piracy guarantee, and we rely on your good-faith compliance.

7.5 The Enterprise-Edition boundary

Paid Enterprise-Edition (EE) features are source-available but proprietary: published and readable, but not usable in production without a paid license. EE runs as a separate process across a wire/IPC boundary from the AGPL-3.0 core and is never statically linked into the core binary. This boundary exists both for engineering hygiene and to keep the licensing of the core and the paid features distinct; it does not affect your rights in the AGPL-3.0 core (§ 7.1).

7.6 Contributions

If you contribute to GitStache, your contribution is governed by the project's inbound contribution terms (a Contributor License Agreement is planned; see GOVERNANCE.md § 1.4). Until those terms are published and you accept them, do not submit contributions expecting any particular license treatment beyond the repository's stated inbound terms.

8. Trademarks

"GitStache", the GitStache name, and the GitStache logo (the mustache mark) are trademarks of Idiom Studios. These marks are not yet registered; we assert common-law rights in them and this section does not claim any trademark registration.

The AGPL-3.0 license covers the code, not the name and marks. You may use the GitStache name to refer to the project accurately, to identify an unmodified official release you run, for community resources clearly not affiliated with us, and for accurate comparative/nominative reference. You may not use the name or marks in ways that imply official affiliation or endorsement you do not have, to name a competing product or service, to represent a modified version as the official product (if you run a modified version as a service, you must rename it), or in any false or misleading way. If you fork the core, you must use a distinct name. The full policy is in GOVERNANCE.md Part 2. Permission questions: § 19.

9. Payment and billing

Paid billing is not active on the hosted service as of the effective date (BILLING_ENABLED is off); we are not charging for the hosted Service today. This § 9 governs billing if and when we enable it. We will not begin charging you without your having selected and agreed to a paid plan.

When billing is enabled:

• Payment processor. Payments are processed by Stripe; by purchasing a paid plan you also agree to Stripe's terms. We do not store your full card details (Privacy Policy § 2.4).
• Charges. Paid plans are billed per active user per month, monthly or annually, at the prices in effect (§ 7.3). CI usage above your plan's included allowance is billed as metered overage at published per-compute-minute rates; the Free tier has no overage (it hard-caps at its allowance).
• Taxes. Prices are exclusive of taxes; you are responsible for applicable taxes.
• Renewal and cancellation. Subscriptions renew automatically for successive terms until cancelled. You may cancel at any time; cancellation takes effect at the end of the current billing term, and you retain paid access until then.
• Refunds. Refund terms are not yet finalized as of the effective date above; contact us (§ 19) with billing questions before purchasing a paid plan.
• Price changes. We may change prices prospectively; material changes affecting existing paying customers are subject to the advance-notice commitment in GOVERNANCE.md (currently a minimum notice window; see § 16).

10. Free tier and beta features

Free-tier and any beta/experimental features are provided as is, may change or be discontinued, and may carry usage limits (including the 5-private-collaborator cap and CI allowance in § 7.3). We may enforce reasonable quotas and rate limits to protect the Service.

11. Disclaimers of warranty

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE AND ALL SOFTWARE (INCLUDING THE SELF-HOSTED SOFTWARE) ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the Service will be uninterrupted, error-free, or secure, or that data will never be lost.

Self-hosted software. Consistent with the AGPL-3.0 and the permissive client licenses, the software you self-host is provided without warranty; you run it at your own risk and are responsible for your deployment, backups, and security. GitStache does not hold a SOC 2, ISO 27001, or other third-party security certification, and nothing in these Terms or our materials should be read as claiming one.

Some jurisdictions do not allow the exclusion of certain warranties, so parts of this section may not apply to you.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• Idiom Studios will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill, arising out of or relating to the Service or these Terms, even if advised of the possibility.
• Idiom Studios's total aggregate liability for all claims relating to the Service or these Terms will not exceed the greater of (a) the amounts you paid us for the Service in the 12 months before the event giving rise to the claim, or (b) US $100. For the free Service, our aggregate liability is limited to US $100.

These limits apply to the fullest extent permitted by law and reflect the allocation of risk for a service offered at these price points (including free). Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you.

13. Indemnification

You will defend, indemnify, and hold harmless Idiom Studios from third-party claims, damages, liabilities, and reasonable costs (including reasonable legal fees) arising from (a) Your Content, (b) your use of the Service in violation of these Terms or applicable law, or (c) your violation of a third party's rights. We will notify you of the claim, let you control the defense (with our reasonable cooperation), and not settle in a way that imposes obligations on us without our consent. This section is subject to any mandatory consumer-protection limits in your jurisdiction.

14. Suspension and termination

• By you. You may stop using the Service and delete your account at any time.
• By us. We may suspend or terminate your access if you materially breach these Terms (including § 5 acceptable use or § 7.4 license compliance), if required by law, or to protect the Service, other users, or third parties from harm. Where practical and lawful, we will give notice and an opportunity to cure.
• Effect of termination. On termination, your right to use the hosted Service ends. We will make Your Content available for export for a reasonable period where feasible, then delete it per the retention schedule (Privacy Policy § 9), subject to legal-retention exceptions. Your rights in the AGPL-3.0 core and permissively licensed clients under their respective licenses survive termination of these Terms.
• Survival. Sections that by their nature should survive (including 6 ownership, 7 licensing, 8 trademarks, 11–13, and 15–17) survive termination.

15. Governing law and disputes

These Terms are governed by the law of the jurisdiction in which Idiom Studios is established, without regard to conflict-of-laws rules, and disputes are subject to the exclusive jurisdiction of the courts of that place, subject to any mandatory consumer-protection rights that apply where you live.

16. Changes to these Terms

We may update these Terms as the Service and the law evolve. For material changes we will update the "Last updated" date and provide reasonable notice on gitstache.dev. Certain changes are additionally constrained by our governance pledge (GOVERNANCE.md), which commits us to advance public notice before changes such as altering the open-core license, reducing the free-tier feature set or CI allowance, or materially disadvantaging existing paying customers. Continued use after a change takes effect constitutes acceptance; if you do not agree to a change, stop using the Service before it takes effect.

17. General

• Entire agreement. These Terms, the Privacy Policy, any applicable order form or Data Processing Agreement (docs/DPA.md), and the license texts referenced here are the entire agreement between you and us regarding the Service, and supersede prior agreements on that subject. For enterprise customers, a signed agreement or DPA prevails where it conflicts.
• Severability. If any provision is unenforceable, the rest remains in effect.
• No waiver. Our failure to enforce a provision is not a waiver.
• Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets (Privacy Policy § 4.4).
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.
• Relationship. These Terms do not create any partnership, agency, or employment relationship.

18. Counsel-review status

These Terms were drafted by an AI agent from GitStache's internal governance, licensing, and architecture records and are accurate to the product as built, but they have not yet been reviewed by qualified counsel. They should be reviewed by a licensed attorney before they are relied upon or presented to users as final, with particular attention to the open items noted in HTML comments throughout this source file (legal entity and jurisdiction, refund posture, arbitration/class-action, tax handling, inbound-contribution terms). Consistent with our standing posture, that counsel review runs in parallel and does not block the product; until it completes, we recommend carrying a short visible caveat on the published page (for example: "These Terms are current and accurate to how GitStache works; a formal legal review is in progress.").

19. Contact

• General / legal notices: getgitstache@gmail.com
• Trademark permission requests: getgitstache@gmail.com

This document is maintained at docs/legal/terms-of-service.md and mirrored into the public terms page on gitstache.dev.