# Beta terms

**ckrets is in beta (0.9).** These are the terms for using it during the beta. They are short on purpose, and they will
change before 1.0; every change is announced, with its date, in [the changelog](/changelog.md).

## What you get

- An API, its documentation and the pages at ckrets.ai for handing a secret to a named recipient, with signed receipts.
- **No uptime commitment and no service-level agreement during the beta.** We aim for the service to be available and
  correct, and we publish what we keep and for how long (below), but the beta comes as it is.
- Limits, prices and features may change during the beta, with notice in the changelog. A breaking change to the API
  contract gets a new date in the `Ckrets-Version` header; a request without that header keeps the original contract.

## What you must not do

- Use ckrets for malware staging, for moving data you are not entitled to move, or for anything unlawful where you or
  the recipient are.
- Send **payment card data** (card numbers, security codes) as an ordinary secret. The general API is not a
  cardholder-data environment. If a value looks like a card number we store it, tell you so in a response header, and
  may contact you about the PCI tier when it opens.
- Send **protected health information** (HIPAA). The health tier, which needs a business associate agreement, is
  planned and not available in the beta.
- Use the request page (`/q/`) to ask anyone for credentials they would not knowingly give you, or to impersonate
  someone else. Requests carry a fixed notice that ckrets did not make them; misuse is frozen on report.
- Try to break other people's secrets, overload the service, or get around its limits.

We may freeze a token, a request or a key that breaks these terms, and we may stop serving an account that keeps
breaking them. Report abuse with `POST /v1/report` (see [limits](/limits.md), "Prohibited uses and reports").

## Your secrets

- You keep every right in what you send. We use it only to deliver it to the recipient you named.
- We cannot read a value your client encrypted (`client_encrypted`). Other values are encrypted at rest and removed at
  the last reveal, a revoke or expiry, as set out in [What we keep](/limits.md).
- Keys are yours to keep safe. In the beta a lost key cannot be recovered: mint another.

## Liability

During the beta, ckrets is provided "as is", without warranties. To the extent the law allows, we are not liable for
indirect or consequential loss, or for loss caused by a lost key, a recipient you named, or a value you chose to reveal
on your own systems.

## Privacy

What we collect, why, and for how long: [Privacy](/docs/privacy).

These beta terms are a plain-language draft and have not been reviewed by a lawyer; a reviewed version replaces them
before 1.0.