Contextpipe — Terms of Service

Draft · Pending IP lawyer review.

⚠ Draft notice (read this first). This document is a founder-drafted Terms of Service. It has not yet been reviewed by an attorney and is not legal advice. A licensed IP attorney will review and approve a finalized version before Contextpipe’s public launch. The launch version will supersede this draft and the “Last updated” date will change accordingly. If you are reading this before launch and intend to rely on any clause, please email legal@contextpipe.dev and we will share the lawyer-approved version once it lands.

0. About this document

These Terms govern your use of Contextpipe, a macOS menu-bar daemon and supporting hosted services that pipe live IDE / terminal / browser context into AI coding tools (Cursor, Claude Code, Codex CLI, Windsurf, Zed) via the Model Context Protocol (MCP).

This document is the single authoritative source for the commercial terms of the product. It pairs with two adjacent public documents:

• Privacy Policy — what data we touch and what we don’t.
• Security Model — the three (and only three) data-egress paths.

If anything here conflicts with a marketing page, blog post, or pricing card, these Terms control. If anything here conflicts with the Security Model doc on a technical-fact question (e.g. “does the daemon upload context in Free mode?”), the Security Model controls.

Status: Pre-launch draft · Effective: Upon launch.

1. Definitions

In these Terms:

• “Contextpipe”, “the Software”, “the Service”, “we”, “us”, “our” — refers to the Contextpipe project, its LDC.app macOS binary and ldc CLI, the AGPL-licensed daemon source code, the MIT-licensed SDK and MCP schema, and the proprietary hosted Pro sync service operated at *.contextpipe.dev.
• “You”, “User”, “Customer” — any individual or legal entity that downloads, installs, runs, or pays for any tier of Contextpipe.
• “Daemon” — the local macOS background process (LDC.app / ldc) that runs on your Mac and exposes context via MCP.
• “MCP” — the Model Context Protocol, the public standard Contextpipe uses to expose context to AI coding clients.
• “BYOK” — Bring-Your-Own-Key. Your IDE makes LLM calls directly to your chosen provider (OpenAI, Anthropic, Ollama, Mistral, etc.) using your API key; Contextpipe never proxies or sees these calls.
• “E2EE sync” — End-to-end encrypted cross-device sync. Encryption happens on your device using a key stored only in your Apple Keychain. Our sync server only ever stores opaque ciphertext blobs.
• “Open” tier — Free, perpetual, AGPL daemon + MIT SDK only. Single-device. No hosted services. Defined by SSOT v1.3.1 §11.
• “Pilot” tier — Paid subscription, $9/month or $72/year. Includes all four Pro features (E2EE sync, advanced redaction packs, Discord/email direct support, priority compatibility updates). Defined by SSOT v1.3.1 §12.
• “Forever” tier — One-time payment of $99 (or $59 during the Founding 100 window). Perpetual local Pro license plus 12 months of hosted E2EE sync. Sync after month 13 is an optional $3/month add-on. Defined by SSOT v1.3.1 §12.5.
• “Founding 100” — A promotional cohort: the first 100 customers within the 7 days following launch may purchase Forever at $59 instead of $99, with additional perks listed in §3 below. Defined by SSOT v1.3.1 §12.5.
• “Mac activation” — A single macOS device with a single Apple silicon or Intel system serial, on which the daemon has been authenticated against a license key.

2. License grants

2.1 Daemon source code — AGPL-3.0

The Contextpipe daemon, including all source code published under the contextpipe/contextpipe GitHub repository under directories Sources/LDCDaemon, Sources/LDCApp, Sources/ldc, and the daemon-side portion of Sources/ContextpipeCore, is licensed under the GNU Affero General Public License version 3.0 (AGPL-3.0).

A full copy of AGPL-3.0 is available at https://www.gnu.org/licenses/agpl-3.0.txt and is also included in the repository as LICENSE.

You may use, modify, and redistribute the daemon source under the terms of AGPL-3.0, including its §13 “Remote Network Interaction” provision.

2.2 SDK, MCP schema, and examples — MIT

The Contextpipe SDK (Sources/ContextpipeSDK), the MCP wire-protocol schema definitions (files within the repository marked with the SPDX-License-Identifier: MIT header, including the wire-protocol portion of Sources/LDCHTTPMCP), and all example code under examples/ are licensed under the MIT License.

This means third-party developers may write plugins, alternative clients, or compatible servers against the protocol without triggering AGPL obligations.

2.3 Pro features — proprietary commercial license

The features bundled into the Pilot and Forever tiers — specifically (a) E2EE cross-device sync client-side integration, (b) advanced redaction rule packs, (c) Discord/email direct support tooling, and (d) priority compatibility update channel infrastructure — are distributed as closed-source binary additions under a proprietary commercial license granted to you upon purchase.

The Pro feature license is:

• Personal and non-transferable. It is granted to the purchasing individual (or legal entity, where applicable) and may not be sold, sublicensed, assigned, or otherwise transferred to a third party.
• Bound to a maximum of 2 Mac activations for the Forever tier and 3 Mac activations for the Pilot tier.
• Conditional on these Terms. Material breach of these Terms (e.g. §4 acceptable-use violations) is grounds for revocation.

2.4 No conflict between AGPL daemon and proprietary Pro features

The hosted Pro sync server is a separate proprietary service that speaks the public, MIT-licensed protocol schema. The sync server does not reuse, embed, or modify AGPL daemon code. Therefore AGPL §13 (network-server source-disclosure) does not extend to our sync server. This position is documented in detail in the project’s internal architecture memo and will be filed with the IP attorney review (per SSOT v1.3.1 §7).

3. Subscription, Lifetime, and Founding terms

This section locks in the eight commercial boundaries that govern paid usage. The wording in the Lifetime $99 precise scope row is locked verbatim by SSOT v1.3.1 §12.5 and cannot be modified without an SSOT bump.

3.1 Renewal and price-change policy

• Pilot subscriptions auto-renew monthly or yearly via Lemon Squeezy. You may cancel at any time from the Lemon Squeezy customer portal (link will be active at launch); cancellation takes effect at the end of the current billing period, with no proration.
• Forever and Founding 100 are one-time payments; no renewal.
• Price changes apply only to new purchases. Existing Pilot subscribers keep their original monthly rate for as long as their subscription remains continuously active. Existing Forever holders keep their $3/month sync add-on rate locked for the lifetime of their license, even if we raise sync pricing for new customers.

4. Acceptable use and restrictions

4.1 Restrictions specific to Pro features

You may not:

• Reverse engineer, decompile, or disassemble the closed-source Pro feature binaries except to the extent expressly permitted by applicable law. (AGPL-3.0 does not constrain Pro feature reverse-engineering on its own, but this proprietary license clause does.)
• Distribute or sublicense the Pro feature binaries to third parties, including by uploading them to public archives, mirrors, or torrents.
• Use Contextpipe to operate a commercial multi-tenant hosted service (“SaaS”) that exposes Contextpipe’s context-piping or sync functionality to end users you do not own a license for. (Note: This SaaS restriction sits in addition to the network-service-related obligations of AGPL-3.0 §13 for the daemon source itself.)

4.2 Restrictions on the hosted sync service

You may not:

• Attempt to abuse rate limits on the Pro sync server (uploading blobs faster than the published per-account rate, opening connections in patterns intended to bypass throttling, etc.).
• Attempt to denial-of-service the sync server or any Contextpipe-controlled infrastructure (updates.contextpipe.dev, sync.contextpipe.dev, the marketing site, etc.).
• Probe, scan, or attack the security of the sync infrastructure outside the scope of a coordinated disclosure to security@contextpipe.dev. See Security Model § Reporting security issues.

4.3 Your responsibilities

You are solely responsible for:

• Your LLM provider’s terms. When you use BYOK with OpenAI / Anthropic / Mistral / Ollama / etc., you are bound by those providers’ terms and acceptable-use policies. Contextpipe does not assume those obligations on your behalf.
• Your Apple Developer / macOS license obligations. If you use Contextpipe in a context that requires compliance with the Apple Developer Program License Agreement or the macOS Software License Agreement (e.g. shipping Apps that include Contextpipe-derived code), you remain responsible for that compliance.
• The content that flows through Contextpipe. Contextpipe is a context pipe; we do not moderate, filter, or take editorial responsibility for the content (code, terminal output, browser pages, etc.) that you choose to feed into your LLM via Contextpipe.
• Your machine and account security. Your macOS Keychain, your Apple ID, your BYOK API keys, and your Contextpipe account password are your responsibility. If your Keychain is compromised, Pro sync E2EE can no longer protect blobs encrypted on that device.

4.4 Revocation

We may revoke a paid license, refuse to renew, and/or refund and terminate access in cases of material breach of these Terms (e.g. account sharing, redistribution of Pro binaries, abuse of the sync server). We will give written notice and a 14-day cure period for non-egregious violations.

5. Data handling and privacy

The technical specifics of how Contextpipe handles your data are documented in the Security Model (single source of truth for data-egress paths). This section summarizes the contractual commitments.

• Open mode and Pilot/Forever with sync off — The daemon does not upload your context to any Contextpipe-controlled server. See Security Model § Path 2.
• BYOK — Your IDE makes LLM calls directly to your chosen provider, using your API key, from your machine. We never see your prompts, your responses, or your API key. See Security Model § Path 1.
• Pro E2EE sync (opt-in, default off) — When you enable sync, opaque ciphertext blobs are uploaded to our Cloudflare R2 + Workers infrastructure. Encryption keys never leave your devices. We could be compelled to produce blobs but cannot decrypt them. See Security Model § Path 3 and Security Model § What we’d do if we got a subpoena.
• Local TTL — The daemon stores context events on your Mac in a SQLite + FTS5 index with a 14-day time-to-live, after which events are purged. You can run ldc nuke at any time to clear all local data immediately.
• Internal audit log retention — The sync server’s operational logs (timestamps, blob sizes, IPs, device IDs) are retained for 30 days for abuse and incident response, then deleted. We do not log blob contents (we cannot — see above).

For the formal privacy notice (cookies, analytics, GDPR/CCPA-style data subject rights), see the Privacy Policy.

6. Commercial compliance, taxes, and refunds

6.1 Merchant of Record (MoR)

All paid transactions are processed by Lemon Squeezy acting as the Merchant of Record. Lemon Squeezy is responsible for:

• EU VAT MOSS (collection, registration, and quarterly filing).
• UK VAT, US sales tax (economic-nexus tracking and remittance across applicable states), and the equivalent indirect-tax obligations in other supported jurisdictions.
• PCI-DSS compliance for the payment flow (SAQ A).
• Chargeback and dispute handling on the payment side.

The legal counterparty on your invoice will be Lemon Squeezy (the MoR), not Contextpipe. Contextpipe is the product seller; Lemon Squeezy is the MoR.

Contextpipe is a pre-launch indie project; the legal entity, registered office, and governing jurisdiction will be disclosed in the launch version of these terms. Until then, please direct legal correspondence to legal@contextpipe.dev.

6.2 Refunds

• Self-serve, 30 days, no-questions-asked. Use the Lemon Squeezy customer portal (link active at launch) or email refunds@contextpipe.dev.
• After 30 days, refunds are discretionary. We will refund pro-rata if we materially fail to deliver promised features.
• Founding 100 refunds are also subject to the 30-day window; refunding a Founding 100 purchase does not preserve your slot in the cohort if you re-purchase later.

6.3 Price change notice

We will give at least 30 days’ notice before any price change. Existing customers are grandfathered per §3.1.

6.4 Future MoR migration

We reserve the right to migrate the Merchant of Record to a different provider (currently planned: Polar in Year 2, direct Stripe in Year 2+). Any such migration will be transparent to you; your existing license, billing rate, and refund window are preserved.

7. Limitation of liability and warranty disclaimer

7.1 “AS IS” warranty disclaimer

The Software is provided “AS IS” and “AS AVAILABLE”, without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, or that the Software will be uninterrupted, secure, or error-free.

This disclaimer aligns with the warranty disclaimer in AGPL-3.0 § 15–16 for the daemon source and applies independently to the proprietary Pro feature binaries.

7.2 Specific items we are not liable for

Without limiting §7.1, we are not liable for:

• BYOK LLM provider charges. Costs incurred on your OpenAI / Anthropic / Mistral / Ollama / other provider account are your responsibility, including unexpected costs from context that Contextpipe feeds into those providers.
• End-user data loss on your Mac caused by hardware failure, OS bugs, third-party software conflicts, or your own actions (including running ldc nuke).
• Context leakage caused by user-configured redaction packs that fail to mask a sensitive token, or by sensitive content the user voluntarily includes in a workspace Contextpipe is configured to read.
• Third-party MCP client behavior. Once Contextpipe hands context to Cursor / Claude Code / Codex / Windsurf / Zed via MCP, the downstream client’s handling of that context is governed by its own terms.

7.3 Hosted sync uptime

We do not offer a contractual uptime SLA for the Pro sync service. We aim for best-effort high availability. In the event of a continuous outage exceeding 24 hours, affected Pilot subscribers will receive a pro-rata service credit on request, and affected Forever subscribers in their 12-month included-sync window will receive an equivalent extension to that window.

7.4 Cap on monetary liability

To the maximum extent permitted by applicable law, our aggregate liability to you for any claim arising out of or relating to these Terms or the Software is capped at the greater of (a) the fees you paid us in the 12 months preceding the event giving rise to the claim, or (b) US $99.

Note: § 7.3 SLA terms and § 7.4 liability cap will be reviewed every 90 days as the product matures.

8. Governing law, dispute resolution, and class-action waiver

Pending IP lawyer review. § 8 specifics (governing law, dispute resolution forum, class-action waiver, and forum selection) will be finalized in the launch version, once founder jurisdiction (place of residence, primary tax residency, and legal entity domicile) is confirmed and reviewed by counsel. No jurisdiction-specific clauses are binding in this draft.

Until § 8 is finalized:

• Any dispute will be handled in good-faith negotiation directly with legal@contextpipe.dev.
• Either party retains all statutory rights under applicable consumer-protection law in their place of residence.
• Nothing in this draft purports to waive any non-excludable consumer right.

The launch version will be published openly on this page and announced at least 30 days before it takes effect.

9. Contact

Postal mailing address will be disclosed in the launch version along with the registered legal entity. For now, email is the canonical channel for all legal correspondence.

Changelog

• Pre-launch draft — Founder-authored. Pending IP lawyer review.
• Launch version — Coming Soon. Lawyer-approved version will supersede this draft; § 0 disclaimer block will be replaced with Approved by IP lawyer review.

This document is maintained as part of the Contextpipe SSOT workflow. Any change here must be reflected in D-SSOT-单一权威表.md §1–§7 and vice versa. The locked-verbatim row in § 3 (Lifetime $99 precise scope) cannot be modified without an SSOT bump.