Acceptable use policy

Contents

• 1. Scope
• 2. Prohibited content
• 3. Prohibited conduct
• 4. Credentials and secrets
• 5. AI agents
• 6. Resource limits and fair use
• 7. Security research
• 8. How we handle violations
• 9. Reporting abuse
• 10. Changes to this policy
• 11. Contact

1. Scope

This acceptable use policy sets out the rules for using the services of Tovio, LLC ("Tovio," "we," "us," or "our"). It expands on Section 4 (Acceptable use) of our Terms of service. In this policy, "you" means anyone who uses the services, including any organization you act for and any AI agent you authorize.

This policy applies to:

• TOVIO Cloud: our hosted commercial service, including the hosted Forge (forge.tovio.dev), the web dashboard (app.tovio.dev), and the Cloud API.
• Our websites: tovio.dev and docs.tovio.dev.
• Client software used with TOVIO Cloud: the TOVIO CLI, desktop app, IDE extensions, MCP server, SDKs, and any other software, whether ours or not, when it connects to TOVIO Cloud.

Our client software is open source under the Apache License 2.0. This policy does not restrict what that license lets you do with the software on your own machines or on servers you run yourself. It applies when you use our hosted service or our websites.

2. Prohibited content

You may not store, publish, or distribute through TOVIO Cloud any content that:

• Is illegal to possess or distribute where you are, or in the United States.
• Sexually exploits or endangers children.
• Infringes someone else's copyright, trademark, patent, trade secret, or other intellectual property rights, including source code you do not have the right to copy or share.
• Is malware, ransomware, a phishing kit, or other code or material intended to damage, disrupt, or gain unauthorized access to systems, data, or accounts, when it is hosted or distributed to deliver an attack rather than to develop or study defenses.
• Discloses another person's personal data, credentials, or confidential information without a lawful right to do so.
• Threatens, harasses, or incites violence against any person or group.

These rules apply to everything you put into the service: files and history, commit messages, AI session transcripts, proposals, review messages, and any other text you publish through it.

3. Prohibited conduct

When using TOVIO Cloud or our websites, you may not:

• Break the law: Use the service to violate any applicable law, including intellectual property, privacy, export control, and consumer protection laws.
• Harass or impersonate: Harass, threaten, or intimidate any person, or impersonate a person or organization in a way that misleads others.
• Send spam: Use the service to send unsolicited bulk messages, or create accounts, repositories, organization invitations, or proposals in bulk for promotion or deception.
• Access what is not yours: Access, or attempt to access, accounts, repositories, policy-protected content, keys, or data that you are not authorized to access.
• Probe or scan our systems: Probe, scan, or test the vulnerability of TOVIO Cloud or our networks without our express written permission. See Security research.
• Interfere with the service: Overload, disrupt, or degrade TOVIO Cloud or our websites, or interfere with anyone else's use of them, including by sending traffic intended to exhaust capacity or data crafted to make the service fail.
• Evade limits and controls: Get around plan limits, quotas, request size limits, rate limits, authentication, permission policies, or capability token scopes. This includes spreading requests across several accounts, tokens, or network addresses to stay under per-source limits, and using another account to continue activity for which an account was suspended.
• Run abusive automation: Operate scripts, bots, crawlers, or agents that generate excessive traffic, ignore a refusal and keep retrying, or retry before the time given in a Retry-After response header.
• Falsify provenance: Forge or tamper with signatures, commit provenance, or audit records to mislead others about who or what made a change.

4. Credentials and secrets

TOVIO Cloud uses sessions, personal access tokens, device keys, passkeys, and agent capability tokens to decide who can do what. You may not:

• Use a credential, key, or token that was not issued to you or to an agent you are authorized to run.
• Sell, lend, or publish your credentials or tokens, or share them so that others can get around plan limits or access controls.
• Use TOVIO Cloud to collect, store, or distribute credentials or secrets that belong to others without authorization, including leaked or stolen secrets.

You are responsible for keeping your own credentials secure. You can revoke personal access tokens, individual sessions, all of your other sessions, and device bindings from your account. Revoking a token or session is not subject to the stricter limit on creating access tokens; it counts only toward the general limits that apply to every request. If you suspect a credential has been compromised, revoke it and tell us as described in Reporting abuse.

5. AI agents

TOVIO is built for AI coding agents as well as people. As Section 3 of our Terms of service explains, you are strictly liable for the actions of any AI agent you authorize to act on your behalf. In addition:

• Agents follow this policy: You may not authorize, instruct, or allow an agent to do anything this policy prohibits, or anything malicious, destructive, or illegal, on TOVIO Cloud or on any third-party system it reaches through the service.
• Respect capability scopes: An agent may act only within the paths, lanes, operations, and expiry of its capability token. Do not try to widen a token's authority by any means other than issuing a new token with the authority you intend, and do not use an agent to reach content its token does not cover.
• Grant only what is needed: By default an agent token cannot read policy-protected paths, holds no secret clearance, cannot modify policy, obliterate history, create or force tags, or issue sub-tokens, is limited to lanes under agent/<name>/**, and must expire. Wider authority is a separate, audited step. Give an agent wider authority only when the task requires it.
• Revoke agents you no longer use: The identity that issued a token can revoke it, and revoking a token also invalidates every token delegated from it. Revoking an agent removes its registration from the repository's roster, after which the tokens it delegated no longer verify. A client working offline may not learn of a revocation until it syncs, so a token's expiry is its final limit. Keep expiries short.
• Transcripts: By default, the tovio CLI captures the AI session transcript that produced a commit and syncs it with the repository. You can turn this off with the provenance.observed_capture = off setting or the --no-session flag. The client refuses to store a transcript in which it detects a credential, but detection cannot catch everything. You are responsible for what your transcripts contain, including any personal data or third-party confidential information.

6. Resource limits and fair use

TOVIO Cloud enforces limits to keep the service available for everyone. The values below describe the service as it runs today. We may change them, and they are not a service commitment.

Plan limits and quotas

Each plan's included repositories, storage, agent sessions, CI minutes, and history period, and the overage rates for paid plans, are published on our Pricing page. The service currently enforces them as follows:

• Private repositories: A Free account can have one private repository. A request to create another is refused with HTTP 402 and error code TVO-FORGE-026. Public repositories are unlimited on every plan.
• Free storage: When a Free account uses more than its 5 GB of storage, further object uploads to its repositories are refused with error code TVO-FORGE-026.
• Paid plan usage: Once paid plans are available, storage, agent sessions, and hosted CI minutes above a paid plan's included allowance will be billed as overage at the published rates. Production checkout is not open yet and hosted CI is not running yet, so no overage is billed today.
• Repository ceiling: Every account is limited to 1,000 repositories as an operational safety ceiling.
• Agents: No plan limits how many agents can run at the same time.
• History period: A plan's history period governs how long unreachable or recoverable history is kept. It does not limit your live repository content.

Request size limits

The hosted Forge refuses a request body larger than the limit for its route with HTTP 413 and error code TVO-FORGE-027. The limit applies to the bytes actually sent, not only to the declared length.

Rate limits

The hosted Forge limits how many requests can be made in a short window. A request over a limit is refused with HTTP 429 and error code TVO-FORGE-024, and the response carries a Retry-After header saying how long to wait. Your software must wait at least that long before trying again. We tune these limits and do not publish fixed values for them.

Our network provider also limits how often a single network address can request sign-in, multi-factor, and step-up challenges from the hosted Forge, and how quickly a single address can load the dashboard and the repository browsing pages on tovio.dev. Going over these limits can lead to a temporary block or a browser challenge.

Fair use

Limits are safeguards, not permission. Use that stays within every rate limit can still violate this policy, for example if it is intended to disrupt the service, is spread across sources to avoid limits, or serves a purpose this policy prohibits.

7. Security research

We welcome good-faith security research. Research that follows our published disclosure policy is not a violation of this policy. That disclosure policy is in the SECURITY.md file of the TOVIO source repository and on our documentation site under Security, and our Security page summarizes it.

• Test only what you control: Test the open-source client software and TOVIO instances you run yourself. Do not test infrastructure, repositories, or Forge instances you do not own or do not have explicit permission to test.
• TOVIO Cloud needs written permission: Probing, scanning, or testing the vulnerability of TOVIO Cloud itself requires our express written permission, as Section 4 of the Terms of service states.
• Do no harm: Avoid privacy violations, destroying data, and degrading the service for others. Do not access, keep, or share other people's data.
• Report privately: Send vulnerability reports to security@tovio.dev, and give us reasonable time to fix an issue before you disclose it publicly. Do not report vulnerabilities in public issue trackers or forums.

8. How we handle violations

We may take one or more of the following actions when you breach the Terms of service, including the acceptable use rules in Section 4 of those terms that this policy describes in more detail, depending on the nature of the breach. We may also act where the law requires us to.

• Automatic refusals: The service refuses requests that go over request size limits, rate limits, or plan quotas, as described in Resource limits and fair use. These refusals happen automatically.
• Suspending an account: Suspending an account immediately revokes all of its sign-in sessions. While an account is suspended, sign-in, device authentication, and Cloud API requests for it are refused. A suspended account can be reactivated.
• Closing an account: Closing an account ends its access and revokes its sessions. A closed account cannot be reactivated.

Our enforcement controls act on accounts. Enforcement suspensions, reactivations, and closures are carried out through restricted administrative controls, and each change is recorded in a signed audit log. You can also close your own account, as the Terms of service describe. Audit entries include the network address a request came from.

A suspension or closure may take effect without advance notice. If you believe we suspended or closed your account in error, contact legal@tovio.dev. The dispute resolution process in Section 9 of the Terms of service applies, starting with informal resolution.

Closing an account does not by itself delete your personal data. To have it deleted, email privacy@tovio.dev. We complete deletion requests within 30 days, subject to legal holds and to records we must keep for billing, tax, security, or legal obligations, as described in our Privacy policy. Before an account is closed, you can retrieve your repositories with the TOVIO client software.

9. Reporting abuse

If you see something on TOVIO Cloud that violates this policy, tell us by email. We do not have a web form for abuse reports.

• Abuse and policy violations: Email legal@tovio.dev. This includes claims that content on TOVIO Cloud infringes your intellectual property rights.
• Security vulnerabilities: Email security@tovio.dev. We do not yet publish an encryption key for this address, so send only what we need to understand the issue.
• Personal data concerns: Email privacy@tovio.dev.

To help us act on a report, include what you observed, where it is (for example, the account handle, repository name, or web address), when you saw it, and any supporting evidence. Do not send live credentials, and do not include more of anyone's personal data than the report needs.

10. Changes to this policy

We may update this policy as the service and the law change. When we do, we will change the date at the top of this page. If we make material changes, we will notify you in the way Section 11 of the Terms of service describes for changes to those terms. Continued use of the service after a change takes effect means you accept the updated policy.

11. Contact

• Abuse reports and legal questions: legal@tovio.dev
• Security vulnerabilities: security@tovio.dev
• Privacy and data protection: privacy@tovio.dev
• Mailing address: Tovio, LLC, 1300 South Boulevard STE 35425, Charlotte, NC 28203, United States