Terms of Service

Version 5 · Last updated April 30, 2026

1. Scope and Acceptance

These Terms of Service ("Terms") govern your use of the hosted Relocat service operated by Relocat ("we", "us", "our"). Our contact details are published at https://relocat.org/imprint/. The Service includes the mobile application, desktop application, and web interfaces (together, the "Service").

These Terms apply only to the hosted Service. Relocat is open-source software published under the GNU Affero General Public License v3 (AGPLv3). If you run your own instance of Relocat from the source code, your use is governed by the AGPLv3 and whatever terms the operator of that instance publishes — not by these Terms.

You accept these Terms when you tap "Agree and continue" on the entry screen, or when you otherwise use the Service. If you do not agree, do not use the Service.

2. Eligibility

You must be at least 18 years old to use the Service. By using the Service, you confirm you meet this requirement.

The Service is currently in invitation-only beta. Access requires an invitation code issued by us or by an existing user acting within their allotted invites. We may revoke invitations at any time.

3. Your Account and Credentials

Your Service account is protected by several credentials that you alone hold:

• A personal PIN used to unlock the app on your device.
• An optional backup file that allows you to restore your account on a new device.
• Device keys generated on each of your devices.

You are solely responsible for keeping these safe. Because of how the Service is built (see Section 4), we cannot recover any of them on your behalf. If you lose all of them, your encrypted data becomes permanently inaccessible. We strongly recommend keeping a backup file in a separate secure location.

In addition, your account is linked to the email address you register with, to which we send one-time verification codes during registration and in some recovery flows. Losing access to that mailbox does not by itself make your encrypted data inaccessible, but it can prevent email-based recovery flows.

You may not share your account with another person or allow another person to use your credentials. Each user must register their own account.

4. Zero-Knowledge Architecture

The Service is a zero-knowledge service. This is a cryptographic design choice with specific consequences for what we can and cannot do:

What we cannot do:

• We cannot read the contents of your files, their names, or any metadata you store in your vault. Your device encrypts this information with keys that never leave your device.
• We cannot help you decrypt your content if you lose your PIN, backup file, and all linked devices. This is not a support policy — it is a mathematical fact resulting from the cryptographic architecture.
• We cannot modify your content without producing a detectable integrity failure on your device.
• We lack the technical ability to disclose decrypted contents in response to any request — legal, governmental, or otherwise. We will cooperate with lawful requests to the extent our systems permit, which is limited to the categories of data described below.

What we can see and process:

• Your email address (for one-time verification codes).
• Your device's public keys and a unique device identifier.
• The existence and size of encrypted blobs you upload.
• Request timestamps, IP address, and user-agent strings, used for security and abuse prevention and retained as described in the Privacy Policy.
• The existence of sharing relationships — which pseudonymous account IDs are linked to which shared items — needed to route shares. We do not see what is shared, when shares are accessed, or who is involved beyond those pseudonymous identifiers.
• If you enable the optional AI-assistant features: the assistant activity log and signed consent receipts described in the Privacy Policy (metadata only — never file contents).

This cryptographic design is intentional. It limits what we can do for you and it limits what we can be held responsible for. We describe this explicitly so you can make an informed decision before using the Service.

5. Acceptable Use

You agree not to use the Service to:

• Store, share, or distribute content that violates applicable law, including but not limited to material that depicts child sexual abuse, incites violence, infringes third-party rights, or is otherwise unlawful.
• Attack, probe, or attempt to circumvent the security of the Service, its infrastructure, or other users' accounts.
• Share your account credentials with another person or create accounts programmatically.
• Send unsolicited messages, spam invitations, or otherwise abuse the invitation system or sharing features.
• Use the Service in a way that imposes an unreasonable load on our infrastructure or disrupts service for other users.

We may suspend or terminate your account without prior notice if we reasonably believe you have violated this Section, are using the Service unlawfully, or are placing other users or our infrastructure at risk. Because of zero-knowledge encryption, enforcement is limited to behaviors we can observe — we cannot inspect your vault contents.

6. Beta Status

The Service is currently offered in beta form. This means:

• Features may be added, modified, or removed without notice.
• Data formats, including encryption formats and backup formats, may change between versions. Some changes may require you to re-import or re-create content.
• Despite our best efforts, bugs may cause data to become unreadable, corrupted, or lost.
• The Service may be unavailable for extended periods, including without notice.
• We may discontinue the Service in whole or in part with at least 30 days advance notice to registered users. During the notice period you may export your data using the Service's export tooling.

You must keep independent backups of any content you cannot afford to lose. The Service is not a replacement for your own backup strategy during the beta period.

You acknowledge these beta risks when you tap "Agree and continue" on the entry screen, which displays the beta notice alongside these Terms.

7. Optional AI and Sharing Features

The Service includes optional features that, when you enable them, disclose limited operational metadata on your instruction:

• AI-assistant integration (MCP). You may connect an AI assistant of your choice. Read access is limited to the standing scope you grant; actions that change data or disclose anything beyond that scope require your explicit, per-action approval in the app. Approvals produce signed consent receipts you can verify, and assistant activity is recorded in your activity log. The assistant receives only the metadata categories you approved — never file contents, file names, or safe contents. You can revoke an assistant's access at any time; revocation stops all further access.
• Guest links and sharing. When you share content, you decide what is shared and with whom. Sharing relationships are visible to us only as pseudonymous routing records (Section 4).

Consent receipts and the activity log are retained as described in the Privacy Policy (13 months), so that both you and we can audit what was authorised. The AI provider you connect acts on your instruction and under your agreement with it — connecting one is your choice, and the Service works fully without it.

8. Your Content

You own whatever content you upload or create in the Service. Encryption does not transfer ownership — it protects confidentiality.

You grant us a non-exclusive, worldwide, royalty-free licence to store and transmit your encrypted blobs, solely to the extent technically necessary to operate the Service. This licence exists only because moving bits from your device to a server and back is technically impossible without it. It does not permit us to read, analyse, or use your content for any other purpose. It terminates when you delete the content or close your account.

You confirm that you have the right to upload any content you store in the Service, and that doing so does not violate applicable law or the rights of any third party. You remain responsible for your content.

9. Our Intellectual Property

The Relocat source code is published under the GNU Affero General Public License v3 (AGPLv3). You may study, modify, distribute, and self-host it under the terms of that licence. How to obtain the source code of the version currently deployed is described on our Source code page. Self-hosting and redistribution of the source are governed by the AGPLv3; use of this hosted Service is governed by these Terms; and a separate commercial licence is available for organisations that cannot comply with the AGPLv3's terms — see the Source code page for details.

The "relocat" wordmark and associated logos are our trademarks, to the extent recognised under applicable law. You may not use them to identify a service you operate unless you have obtained written permission from us or unless the use is a nominative fair use (e.g. "compatible with Relocat").

10. Service Availability

The Service is provided on a best-effort basis. We do not guarantee any specific uptime, performance, or availability. We may perform scheduled maintenance, investigate abuse, or respond to security incidents in ways that interrupt the Service, and we will try to give reasonable notice where doing so is possible.

We may also suspend or restrict the Service temporarily to comply with applicable law or to protect users, our infrastructure, or third parties from harm.

11. Disclaimer of Warranties

The Service is provided "AS IS" and "AS AVAILABLE" without warranty of any kind, express or implied, to the fullest extent permitted by applicable law. Without limiting the foregoing, we do not warrant that:

• the Service will meet your requirements;
• the Service will be uninterrupted, timely, secure, or free of errors;
• defects in the Service will be corrected;
• the results obtained from the Service will be accurate or reliable;
• any content stored in the Service will remain accessible or recoverable.

This Section does not limit any warranty that cannot be excluded under applicable mandatory consumer-protection law in your jurisdiction.

12. Limitation of Liability

The Service is provided free of charge. Our liability to you is limited accordingly.

We are liable to you only for damages caused by:

1. Intent (Vorsatz) or gross negligence (grobe Fahrlässigkeit) on our part;
2. Breach of an essential contractual obligation (Kardinalpflicht) — that is, a duty whose performance is required for the Service to function as agreed and on whose performance you may reasonably rely; in such cases our liability is limited to damages that were foreseeable and typical at the time the contract was concluded;
3. Injury to life, body, or health, or liability arising under the German Product Liability Act (Produkthaftungsgesetz), or liability arising from a guarantee we have expressly given — for which our liability is not limited and remains as provided by statute;
4. Breach of data-protection duties to the extent that liability is required by the GDPR or the German Federal Data Protection Act — for which statutory liability applies.

Except in the cases listed in points (3) and (4) above, our total aggregate liability arising out of or in connection with these Terms or the Service is capped at 100 EUR per user per calendar year.

We are not liable for:

• damages resulting from your loss of credentials (PIN, backup file, device keys) — see Section 3, this is a cryptographic consequence of the zero-knowledge architecture and cannot be caused by ordinary negligence on our part;
• damages resulting from content that you uploaded in violation of applicable law or Section 5;
• indirect, incidental, or consequential damages, including loss of profits, loss of business opportunity, or loss of third-party data — to the extent permitted by applicable law.

Nothing in this Section limits any liability that, under applicable mandatory law, cannot be limited or excluded.

13. Indemnification

You agree to indemnify and hold us harmless from any third-party claim, loss, liability, damage, or expense (including reasonable legal fees) arising from content you uploaded that violates applicable law or infringes a third party's rights.

This Section applies only to claims arising from your own unlawful content. It does not apply to claims arising from your other use of the Service, from our gross negligence or intent, or to any claim for which indemnification would be unenforceable under applicable law.

14. Changes to These Terms

We may update these Terms to reflect changes in the Service, in our practices, or in applicable law. We will notify registered users by email of any material change at least 14 days before it takes effect. Continued use of the Service after the change becomes effective constitutes acceptance of the updated Terms. If you do not agree, you may close your account before the change takes effect.

15. Termination

By you. You may close your account at any time from within the Service. On account closure, we delete your personal data within 30 days, as described in the Privacy Policy.

By us. We may suspend or terminate your account without notice if we reasonably believe you have violated Section 5, are using the Service unlawfully, or are placing other users or our infrastructure at risk. In all other cases we will give you at least 14 days notice of termination where practical, and a reasonable opportunity to export your data before deletion.

Suspension. During suspension, your encrypted data remains stored for up to 30 days to allow investigation and appeal. If we terminate the account after that period, we delete the data per the timeline above. You may contact privacy@relocat.org to appeal a suspension.

16. Force Majeure

We are not liable for delay or failure to perform caused by events beyond our reasonable control, including natural disasters, network outages, failures of upstream providers (including the cloud storage processor named in the Privacy Policy), cyber-attacks, or legal orders. This Section does not limit liability that cannot be limited under applicable law.

17. Reporting Illegal Content

If you believe content on the Service violates Section 5 or your rights, contact privacy@relocat.org. Because the Service is zero-knowledge we cannot inspect content, but we can act on the account or sharing relationship where appropriate under applicable law, including the EU Digital Services Act.

18. Severability, Governing Law, Language, Privacy, and Contact

Severability. If any provision of these Terms is held invalid or unenforceable, the remaining provisions continue in full effect, and the invalid provision is replaced by one that most closely approximates the original intent within the limits of the law.

Governing law and forum. The operating entity for the Service is in the process of being established. The governing law and competent forum will be fixed upon incorporation and announced in accordance with Section 14 (Changes to These Terms). Nothing in these Terms deprives you, as a consumer resident in the European Union, of the protection of mandatory provisions of the law of your country of residence, or of your right under EU Regulation 1215/2012 (Brussels I-bis) to bring proceedings in the courts of your country of residence.

Language. These Terms are published in English.

Privacy. The Privacy Policy is incorporated by reference into these Terms.

Contact. For questions about these Terms, write to privacy@relocat.org.

19. Document Status

Version 5 — working text prepared for legal review (July 2026). This document has been drafted by Relocat and has not yet been reviewed by qualified legal counsel. Until marked otherwise at the top of this page, these Terms may contain clauses that are unenforceable or incomplete under applicable law. A counsel-reviewed version will replace this text before any public (non-invitation) release of the Service.

Change log

• Version 5 (July 2026): Corrected Section 3 — the registration email address is required, not an optional recovery credential, and losing mailbox access does not by itself cause data loss; the Section 12 credential-loss carve-out aligned accordingly; log-retention wording in Section 4 aligned with the Privacy Policy (removed an inaccurate IP-truncation claim).
• Version 4 (July 2026): Added Section 7 (optional AI and sharing features); governing-law clause reworded pending incorporation (the previous text named an invalid "European Union" governing law); source-code availability now described on the /agpl/ page; beta-acknowledgement wording aligned with the actual onboarding flow; acceptable-use clause rests on "applicable law".
• Version 3 (April 2026): German-law audit fixes.
• Version 2 (April 2026): First full draft.