Terms of Service

Effective from 12 October 2026. These Terms are a contract between you and Mandos s.r.o.; please read them together with the Privacy Policy and the Refund Policy.

1. Parties and scope

1.1 These Terms of Service ("Terms") govern the use of the Cockpit software and services ("Cockpit" or the "Service") provided by Mandos s.r.o., a limited liability company with its registered office at Žebětínská 883/24a, Kohoutovice, 623 00 Brno, Czech Republic, Company ID (IČO) 04901258, VAT ID CZ04901258, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 92514 (the "Provider", "we", "us"). Contact: support@cockpitai.dev. CockpitAI is the trade name used by Mandos s.r.o. for the Cockpit service.

1.2 The Service consists of:

the Cockpit desktop application for Windows, macOS and Linux, which the user installs on their own computer and which connects to the user's own hosts over SSH, a local shell or WSL2 to run AI coding agents (such as Claude Code, Codex CLI, Antigravity CLI) that the user has obtained and licensed separately;
the cockpit account and backend operated by us: sign-in, synchronisation of the user's configuration between their devices, the end-to-end encrypted secret vault, and the token manager ("broker") that stores the user's own AI provider credentials and refreshes them for the user's hosts;
Cockpit Web: access to the user's hosts and sessions from a browser or a phone through a relay operated by us, web push notifications, webhooks and automation for standalone agents, and project sharing with other cockpit users;
AWS workers: virtual machines that we start in our own cloud account as a further host of the user, paid from a prepaid wallet (Section 7).

1.3 Cockpit does not sell AI model usage. Agents run with the user's own subscriptions, API keys or local models. The user's contractual relationship for AI models is with the respective AI provider, not with us (Section 10).

1.4 Paddle is our merchant of record. Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries about payments and handles returns (Section 10.2). Paddle's terms apply to the payment; these Terms govern the use of the Service.

1.5 Beta notice. Cockpit is under active development. Features may change, be added or be removed, and the Service is provided on a best-effort basis without a guaranteed service level (Section 14). The beta status does not limit the statutory rights of consumers (Section 16.1). During the current invite-only pilot, an account can be created only with an invitation, which we grant at our discretion; the application and these Terms apply in full to invited users.

1.6 By creating a cockpit account or using the Service you agree to these Terms. If you do not agree, do not use the Service.

2. Definitions

Account – the personal cockpit account of one natural person, created by signing in with a Google account.
Free and Pro – the two tiers of the Service (Section 4).
Host – a computer (your own machine, a server, a VPS, a NAS, a WSL2 distribution or, later, an AWS worker) on which Cockpit runs agents on your behalf.
AI provider – a third party whose models or agent tools you use through Cockpit (for example Anthropic, OpenAI, Google) under your own agreement with them.
AI account – your subscription, API key or local endpoint of an AI provider registered in the token manager.
Project – a working directory on a host with its sessions, chats and settings, as managed in Cockpit.
Owner – the user who shares one of their projects with other users. Member – a user invited to a shared project, in the role viewer or collaborator. Guest – a member whose own tier is not a paid Pro (Free, or Pro trial).
Wallet – the prepaid balance for AWS workers (Section 7).
Consumer – a natural person who uses the Service outside their trade, business or profession. Business user – any other user.
Pricing page – https://cockpitai.dev/pricing, which shows the current prices.

3. Account – one person

3.1 One person per account. A cockpit account is personal. It may be used by one natural person only and must not be shared with, lent to or operated by several people. Cockpit is a service for individuals; the only intended way to work together is project sharing (Section 8).

3.2 Sign-in with Google. You create and access your account by signing in with a Google account (Section 10.1). We receive your e-mail address, name, profile picture and Google subject identifier. You are responsible for the security of your Google account and for all activity under your cockpit account.

3.3 Account required. The desktop application requires a signed-in cockpit account. There is no "no-account" mode. During an outage of our backend, a signed-in desktop continues to work from a locally cached, signed session and entitlement for a limited time (up to 45 days, Section 14.3); local functions on your hosts are never switched off by an outage.

3.4 Age. You must be at least 18 years old to create an account.

3.5 Business users. If you use the Service for a company, you confirm that you are authorised to bind it. A business user may enter their company details and VAT ID in the payment portal; invoices are issued by Paddle (Section 10.2).

3.6 Devices. You may sign in on any number of desktops and browsers. We register each device (name, platform, last seen) so that you can review and sign out devices in the application and so that we can revoke a lost device.

3.7 Your hosts, agents and credentials are yours. You connect your own hosts and register your own AI accounts. We do not supply hosts (except AWS workers), model tokens or agent licences, and you are responsible for complying with the terms of every AI provider, host provider and software licence you use through Cockpit.

4. Tiers: Free and Pro

4.1 Free includes the desktop application with all local functions (hosts over SSH, local shell and WSL2, host preparation, tmux, session browser, chat, terminal, files and editor, MCP, layouts, export, signed updates), the cockpit account with synchronisation on any number of desktops, the end-to-end encrypted vault, the token manager for up to 2 AI accounts, up to 1 host registered with the token manager and up to 10 active projects. Standalone agent definitions with manual and scheduled runs on that host are included. Free users may be members of projects that Pro users share with them (guest mode, Section 8.6). Support consists of bug reports and feature requests sent from the application (desktop and Cockpit Web); we answer as our capacity allows, without a guaranteed response time (Section 14.4).

4.2 What stays free. We commit that the desktop with its local functions, the cockpit account, the Free pool (2 AI accounts, 1 host, 10 projects), an unlimited number of desktops, and signed updates and proxy archives remain available at no charge. Local functions never depend on an entitlement check; the only Free limit enforced locally is the project count.

4.3 Pro includes everything in Free plus: Cockpit Web (browser and mobile access to all your hosts, browser sessions, web push notifications, automation devices), unlimited AI accounts, hosts and projects, webhooks and Jira triggers for standalone agents, project sharing (Section 8) and the wallet for AWS workers (Section 7). Support is the same as in Free (Section 14.4). Pro has no product limits; technical fair-use limits apply (Section 9).

4.4 No Team tier. We do not offer organisation accounts. Several people with their own Pro accounts may register the same host.

4.5 Trial. Every new cockpit account receives Pro for 14 days free of charge, without a payment card, starting at the first sign-in. The trial is granted once per Google account; we keep a hash of the Google subject identifier after account deletion solely to prevent a second trial for the same identity. At the end of the trial the account continues on Free without any loss of data (Section 5.6).

4.6 Founding users and grants. We may grant Pro or raised limits to individual users free of charge for a stated period. A grant is not a subscription, does not renew and does not create a right to the same conditions later.

5. Prices, payment, renewal and cancellation

5.1 Prices. The prices of Pro are those shown on the pricing page and in the checkout at the time of purchase, in the currency of your country as the merchant of record charges them. Prices for consumers include VAT (or the sales tax of your country, where it applies); business users with a valid EU VAT ID are invoiced without VAT under the reverse-charge mechanism, as applied by Paddle as merchant of record.

5.2 Merchant of record. The purchase is made from Paddle, which collects the payment, issues the invoice and remits taxes. We never receive your card data. Your company details and VAT ID can be edited in the payment portal.

5.3 Subscription and automatic renewal. Pro is a monthly or yearly subscription paid in advance. It renews automatically for the same period at the price then shown on the pricing page until you cancel. We remind you by e-mail at least 30 days before an annual renewal. The yearly plan is paid in one payment; no instalments.

5.4 Cancellation. You can cancel at any time in the payment portal (Manage subscription in the application) or by e-mail. Cancellation takes effect at the end of the paid period; until then Pro remains active. No pro-rata refund is made for the unused part of a period, except as required by law or Section 6.

5.5 Failed payment and grace period. If a renewal payment fails, Pro continues for a grace period of 7 days while the payment provider retries (up to 3 attempts); we notify you in the application and by e-mail. If the payment still fails, the account changes to Free ("soft downgrade", Section 5.6).

5.6 Downgrade – nothing is deleted. When Pro ends (trial, cancellation, failed payment), nothing is deleted. Hosts above 1 and AI accounts above 2 are marked inactive and projects above 10 become read-only, in the order of the least recently updated; you can change which ones remain active. Browser sessions and the relay end, webhooks are rejected with "plan required", automation devices become inactive, shared projects are suspended for members and the wallet is frozen (Section 7.6). Inactive items are enforced by our backend (for example the token manager does not deliver credentials to an inactive host); they are not merely hidden. Returning to Pro restores everything.

5.7 Changes of tier. An upgrade takes effect immediately. A change from yearly to monthly takes effect at the end of the current period.

5.8 Price changes. We may change the prices of Pro. A change applies to a running subscription only from its next renewal and only after we have notified you by e-mail at least 30 days before the renewal; you can cancel before the renewal. Changes of localised prices caused by exchange rates or taxes applied by the merchant of record are not price changes by us.

5.9 Invoices. Paddle issues an invoice for every payment; invoices are available in the payment portal.

6. Right of withdrawal (consumers)

6.1 A consumer in the European Union may withdraw from the purchase of Pro or of a wallet top-up within 14 days of the purchase without giving a reason, in accordance with Directive 2011/83/EU and Section 1829 et seq. of the Czech Civil Code.

6.2 Start of the service during the withdrawal period. The Service starts immediately after purchase. We do not ask you to give up your right of withdrawal: if you withdraw within the 14 days, you receive a full refund of the payment, even though you have already used Pro. The same 14 days apply to every consumer and business user as our money-back guarantee for the first payment of a subscription (see the Refund Policy at https://cockpitai.dev/refund-policy).

6.3 How to withdraw. Send a clear statement (e-mail to support@cockpitai.dev is sufficient) with the e-mail address of your account and the transaction identifier. You may use the model withdrawal form in Annex A. The refund is made by the merchant of record using the original payment method within 14 days of your withdrawal.

6.4 Wallet top-ups. An unused top-up is refunded in full if you withdraw within 14 days and nothing has been spent from it. Once any amount has been spent from a top-up, the withdrawal right is lost for that top-up; the remaining balance stays available until it expires (Section 7.4) or is refunded on account deletion (Section 15.5).

6.5 Business users have no statutory right of withdrawal; the money-back guarantee of the Refund Policy applies to them as well.

7. Wallet and AWS workers

7.1 What it is. Pro users may buy prepaid credits in EUR ("wallet"). The wallet pays only for AWS workers – virtual machines that we start in our cloud account as a further host for you – charged for the actual run time per worker type (rounded to minutes), storage per GB-month and network egress per GB above the included amount. Credits are spent on workers at the published prices: the price list per worker type is published and shown in the application before each start, and may change for new starts; a running worker keeps the price at which it was started.

7.2 Not for anything else. Credits never pay for AI model tokens, subscriptions, hosts, accounts, projects, webhooks or support, and are not needed for any other part of Pro.

7.3 Top-ups. Minimum top-up €10, maximum balance €500, one-time purchases through the payment provider; no automatic top-up. Prices of top-ups include VAT for consumers.

7.4 Expiry. Credits expire 12 months after the top-up; the oldest top-up is spent first ("first in, first out"). Credits granted by us (Section 7.10) expire 12 months after they are granted and are spent in the same order with the top-ups. We send an e-mail 30 days before credits expire. Expired credits are forfeited and are not refunded, except where the law provides otherwise.

7.5 Spending cap and automatic stop. You set a monthly spending cap (default €50) and may set a budget per worker. When the cap is reached or the balance is zero, workers are stopped (not deleted); their disks are kept free of charge for 14 days and deleted after two warnings. The balance can never become negative; you will not receive a bill you did not expect. We warn you at 20 % and 5 % of the balance and at 80 % of the cap.

7.6 End of Pro. When Pro ends, the wallet is frozen: workers are stopped at the end of the grace period, the balance remains until it expires and is available again when Pro is restored.

7.7 No cash-out. Credits cannot be exchanged for cash or transferred to another account. Refunds are made only under Section 6.4 (withdrawal) and Section 15.5 (account deletion), pro rata for the unspent balance, through the payment provider. In short: (a) an unused top-up is refunded in full on withdrawal within 14 days of the payment; (b) on deletion of the account the unspent rest of every paid top-up is refunded to the original payment method; (c) credits granted by us (Section 7.10) and expired credits are never refunded. Refunds are always made by the payment provider, never in credits or cash by us.

7.8 Workers are your hosts. A worker is a host under your control, with the responsibilities of Section 12. We may stop a worker that threatens the Service or breaches Section 9.

7.9 Prohibited use of workers. Workers run in our cloud account and use our network addresses. Without limitation of Section 9.2, you must not use a worker for cryptocurrency mining or other proof-of-work computation, for mass or unsolicited sending of e-mail, messages or notifications, for network scanning, for attacks, for hosting content for the public, or for anything forbidden by the acceptable use policy of our cloud provider. We may stop such a worker and freeze the wallet immediately and without prior notice, delete the worker's data after we have kept what we need as evidence, and terminate the account under Section 15.2. Credits spent on prohibited use are not refunded, and we may claim from you costs and damages that exceed your balance (in particular charges and penalties of the cloud provider), to the extent the law allows.

7.10 Credits granted by us. We may add credits to your wallet as a goodwill gesture or compensation (for example after an outage). Such credits are free of charge, valid for 12 months from the grant, cannot be refunded or exchanged for cash, and lapse without compensation when the account is deleted. We may correct credits granted by mistake; a correction never takes the balance below zero.

7.11 Statements and notices. We confirm every credited top-up by e-mail; the receipt (tax document) is issued and sent by the payment provider and is available in its customer portal. Each month in which you used workers, you receive at the beginning of the following month a statement of that month: run time and storage per worker type with the amounts charged, the balance at the end of the month and the next expiry. The same statement and the usage per worker are available in the application at any time. We also e-mail you when the balance falls to 20 % and 5 % of the balance after your last top-up, when 80 % of the monthly cap is used, when workers are stopped for the balance or the cap, and 30 days before credits expire. These e-mails are part of the service and cannot be switched off while the wallet holds a balance.

8.1 Sharing. A Pro owner may invite other cockpit users to one project at a time, in the role viewer or collaborator. The invited person needs their own cockpit account; sharing a project is never sharing an account (Section 3.1). An invitation is bound to the e-mail address the owner enters, is valid for 7 days and can be used once; the owner can cancel it.

8.2 Members' prompts run on the owner's host and through the owner's AI accounts. A collaborator's prompt is executed by an agent running on the owner's host, as the owner's operating-system user, with the owner's subscriptions, API keys or local endpoints. The owner therefore:

is responsible for whether the terms of the AI providers allow this use. Consumer subscriptions of several providers are personal and may prohibit use by several people; a project pinned to an API key, a team plan of the provider or a local endpoint is recommended for collaborators. We warn about this in the Sharing section of the application. Any consequence, including a blocked provider account, is the owner's;
decides what members can see and do, and is the controller of the project's content;
is responsible for the people they invite and for removing them (guests included), and for the use of e-mail addresses they type into an invitation;
acknowledges that an agent acts with the owner's rights on the host, also on a member's prompt, and that Cockpit cannot technically restrict a collaborator more than the owner themselves. Do not use an unattended ("turbo" / bypass permissions) mode in shared projects; use the viewer role for people you do not trust.

8.3 Members. A member agrees that the owner sees their actions in the project (name, e-mail address, time, IP address shortened to the network part), that the Provider keeps an audit of their actions (Privacy Policy), and that their prompts are recorded with a hash of the text and their display name for 30 days so that the owner can attribute activity and estimate consumption. Members must follow these Terms, Section 9 and the owner's instructions; a collaborator may answer tool permission questions for the current run but can never grant a permanent "allow always", which is reserved to the owner.

8.4 Revocation. The owner may remove a member or end sharing at any time; access ends within seconds, open sessions of the member are closed. When the owner loses Pro, is blocked, or deletes their account, sharing is suspended or ends for all members. The Provider may revoke sharing in case of abuse (Section 9.5).

8.5 Limits. At most 3 members per project (members and pending invitations) as fair use. A Pro subscription includes 2 guest seats per owner (across all projects); a member with their own paid Pro does not take a seat. Further guest seats may be offered as a paid item of the owner's subscription at the price shown when it is offered. When seats are exceeded (for example a member loses Pro), the most recently added guests lose access until a seat is free; nothing is deleted.

8.6 Guest mode. A member without Pro uses Cockpit Web only for the projects shared with them: no own hosts, no own relay, no automation. The 14-day trial of a new invited user applies unchanged.

8.7 Nothing of the owner's is shared except the project. Members never see the owner's other projects, hosts, AI accounts, vault, or files outside the project; the Provider enforces this in the backend. Members cannot write files on the owner's host through the web in the first release.

9. Acceptable use and fair use

9.1 Fair use. Cockpit is a service for individuals. Pro has no product limits, but our backend enforces technical per-user limits that protect the Service and other users. At the effective date these include: 1 relay connection per host (64 channels per connection); 10 concurrent browser sessions, 20 live chat subscriptions and 6 terminals per user; API rate limits (currently 120 requests per minute per user, 300 per IP, 10 sign-ins per minute per IP); web attachments 25 MiB per file and 100 files per batch; webhook rate limits and a run time of at most 26 hours per webhook-driven run; token refresh at a fixed rhythm per AI account; sharing limits (Section 8.5; 10 invitations per hour per owner; a member in at most 20 shared projects); history of deleted documents and conflict versions 90 days, notifications 500 entries or 30 days, audit 90 days. Limits may change with the Service; current values are described in the documentation. We can raise a limit for an individual user on request without an additional price list.

9.2 Prohibited use. You must not:

share an account between several people, create multiple accounts to obtain repeated trials or circumvent Free limits, or use project sharing to give others the equivalent of a shared account;
resell, sublicense or provide to third parties access to AI providers through the token manager or through shared projects, or use Cockpit to circumvent limits, pricing or terms of an AI provider;
use the Service to attack, probe, overload or gain unauthorised access to systems, including our backend, hosts you are not authorised to use, or other users' projects;
interfere with the Service, bypass or test the enforcement of tiers and limits (except as agreed with us), reverse engineer our backend, or scrape it;
store or transmit content that is illegal, infringes third-party rights, or contains malware intended for others;
use the Service in breach of export control or sanctions law;
use AWS workers for cryptocurrency mining, network scanning, sending unsolicited mail, hosting content for the public, or any use against the acceptable use policy of our cloud provider (including mass sending of e-mail, messages or notifications; details and consequences in Section 7.9).

9.3 Agents and their output are your responsibility. Agents execute commands and modify files on your hosts according to your prompts and the permissions you grant. You are responsible for reviewing what agents do, for the permissions you grant (including any "allow always"), for the code they produce and execute, and for any damage caused on your hosts or to third parties.

9.4 Lawful use of hosts. You confirm that you are authorised to connect every host you add, to install Cockpit's helper components on it (proxy, hooks, environment file) and to run agents on it.

9.5 Suspension. We may temporarily limit, suspend or (in serious or repeated cases) terminate access to the Service, to sharing or to specific functions if we reasonably believe that you breach these Terms, that your account is compromised, that your use threatens the Service or other users, or if required by law. Where possible we notify you first and give you an opportunity to remedy the breach; we always notify you afterwards with the reason, unless the law forbids it. Local functions on your hosts are not affected by a suspension of the backend.

10. Third-party services

10.1 Google (sign-in). Signing in uses Google OAuth; Google's terms and privacy policy apply to your Google account. You can revoke Cockpit's access at any time at myaccount.google.com, which signs you out of Cockpit.

10.2 Paddle (payments). Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, or the Paddle affiliate named in your checkout and receipt ("Paddle"), acts as merchant of record: it sells the subscription and top-ups to you, processes payment, issues invoices, applies and remits VAT and sales taxes, and handles refunds and chargebacks. Paddle's Checkout Buyer Terms apply to the purchase. We receive the subscription state, transaction identifiers, invoice links, country and amounts, never card data.

10.3 AI providers. Your use of Anthropic, OpenAI, Google or any other AI provider through Cockpit is governed by their terms. Cockpit stores your provider credentials in the token manager encrypted at rest and refreshes them on your behalf, and the proxy on your host routes agent traffic to the provider; we do not read, store or modify the content of your prompts or the providers' responses in the backend (the proxy runs on your host). You are responsible for keeping your use within the providers' terms, including when you share projects (Section 8.2).

10.4 Amazon Web Services. Our backend is hosted by Amazon Web Services in the AWS region eu-central-1 (Frankfurt, Germany); AWS workers run in our AWS account. AWS acts as our processor.

10.5 E-mail. Transactional e-mails (sign-in, invitations, payment and subscription notices, account deletion, data export) are sent through Amazon Simple Email Service or an SMTP provider as our processor.

10.6 Jira, webhooks, MCP servers. Integrations that you configure (Jira triggers, webhooks, MCP servers, local models) connect to services under your own agreements. We are not a party to them.

10.7 We are not responsible for third-party services, their availability, changes or terms, except where the law makes us liable.

11. Open-source components and licences

11.1 Third-party notices. The desktop application and Cockpit Web contain open-source components. The complete list with licence texts is shown in Settings → About → Licenses in the desktop application and at https://cockpitai.dev/legal/notices for Cockpit Web, and is installed with the desktop application (resources/notice/NOTICE.md). Those licences govern the respective components and prevail over these Terms for them.

11.2 LGPL components. The image processing module (sharp) bundles libraries licensed under the GNU Lesser General Public License v3.0 (among them libvips, glib, fribidi, libexif, libheif, librsvg, pango, proxy-libintl) and other open-source licences. In accordance with the LGPL-3.0:

the texts of the LGPL-3.0 and the GPL-3.0 are included in the notices;
these components are linked as separate shared libraries so that you can replace them with a modified version (relinking);
nothing in these Terms prohibits you from modifying those components or from reverse engineering the application for the purpose of debugging such modifications, to the extent the LGPL requires;
the corresponding source code of these libraries is available from the sharp-libvips project at https://github.com/lovell/sharp-libvips (the release named in the notice) and, for three years after we last distributed the application, on request to support@cockpitai.dev.

11.3 Cockpit itself. The Cockpit desktop application, the proxy and the backend are proprietary software of the Provider. We grant you a personal, non-exclusive, non-transferable licence to install and use the desktop application and the host components on your own devices and hosts for the purpose of using the Service, for as long as you have an account.

12. Security and your responsibilities

12.1 Our measures. We protect the Service as described in the Privacy Policy: encryption in transit (TLS), the vault is end-to-end encrypted with a key derived from your passphrase (we cannot read its contents and cannot recover it if you lose the passphrase), AI provider credentials are encrypted at rest with a key kept outside the database and are delivered to your hosts encrypted end to end, operator access requires passkeys and is audited with a tamper-evident hash chain, and signed desktop updates.

12.2 Your responsibilities. You are responsible for: the security of your Google account and devices; your vault passphrase (we cannot reset it); your hosts and what agents may do on them; the credentials you put in the token manager and their rotation; who you invite to projects; and promptly reporting a suspected compromise to security@cockpitai.dev. The desktop and the host proxy run with your user's rights; we have no access to your hosts except through the relay you enable in Cockpit Web, which only your own browser sessions and your members can use.

12.3 Backups. We back up the backend for operational purposes. The content of your hosts (code, files, agent transcripts) lives on your hosts and is not backed up by us; the desktop synchronises your configuration (not your files) between your devices.

13. Content and AI output

13.1 Your content. You retain all rights to your code, files, prompts, agent transcripts, configuration and anything else you process with Cockpit ("Your Content"). We claim no ownership. You grant us only the limited right to store, transmit and process Your Content as needed to provide the Service to you (synchronisation, relay, sharing with the members you choose).

13.2 AI output. Output of AI agents is generated by third-party models. We make no warranty that output is accurate, complete, non-infringing, secure or fit for a purpose. You must review output before relying on it or executing it. Rights to output are determined by the AI provider's terms and applicable law.

13.3 Shared projects. By sharing a project you give the members the access set by their role. A member's prompts in your project are content you have allowed into your project; the owner is the controller of the project's content (Section 8.2).

13.4 Feedback. If you send us suggestions, we may use them without obligation.

14. Availability, maintenance, support

14.1 No service level. The Service is provided "as available" on a best-effort basis. We do not guarantee any availability, response time or error-free operation. This does not limit the statutory rights of consumers regarding the conformity of digital services (Section 16.1).

14.2 Maintenance. We may interrupt the Service for maintenance; where possible we announce planned maintenance in the application in advance.

14.3 Outages. During an outage of our backend, a signed-in desktop keeps working with your hosts from the cached session and entitlement (valid until the end of the paid period plus 14 days, at most 45 days), agents on your hosts keep running with the credentials the host proxy already holds, and Cockpit Web, synchronisation, the token manager and sharing wait for the connection. No offline mode is promised beyond this.

14.4 Support. Support is provided through bug reports and feature requests from the app; we answer as our capacity allows, without a guaranteed response time. This applies to Free and Pro alike.

14.5 Changes of the Service. We may change, add or remove features. If a change materially reduces what a paid Pro subscription includes, we notify you at least 30 days in advance by e-mail and you may cancel before the change takes effect with a pro-rata refund of the unused period. The commitment in Section 4.2 is not reduced by such changes.

15. Termination and account deletion

15.1 By you. You can delete your account at any time in the application (Account → Delete account) or by e-mail. Deletion is a process:

a data export (ZIP) is prepared and a one-time download link is sent to your e-mail address; the export is kept for 7 days;
a 30-day waiting period follows, during which the account is blocked and the e-mail contains a link to cancel the deletion;
an active subscription is cancelled at the end of the paid period, and an unspent wallet balance is refunded pro rata through the payment provider (Section 15.5);
after the waiting period your account, documents, vault, devices, sessions, push subscriptions, AI accounts in the token manager and project memberships (as owner and as member) are deleted and your identity is pseudonymised in records we must keep (Privacy Policy, Section 8).

15.2 By us. We may terminate your account with 30 days' notice by e-mail for any reason, with a pro-rata refund of the unused paid period, and without notice for a serious breach of Section 9, fraud, chargeback abuse, a legal requirement, or if the account has been inactive for 24 months on Free after a prior e-mail warning.

15.3 Legal hold. If a dispute, chargeback, investigation or legal obligation requires it, we may suspend the deletion of specific data ("legal hold") for as long as the reason exists; the export is always made available.

15.4 Effect. On termination the licence in Section 11.3 ends; Cockpit's helper components remain on your hosts until you remove them, and your hosts, files and agent transcripts are not affected.

15.5 Refunds on deletion. An active subscription is not refunded pro rata (it runs out), except under Section 6 and the Refund Policy; the unspent wallet balance is refunded pro rata through the payment provider to the original payment method.

16. Warranty and liability

16.1 Consumers. Nothing in these Terms limits the rights that consumers have under mandatory law, including the rules on conformity of digital content and digital services and the statutory liability for damage caused intentionally or by gross negligence, or for death or personal injury. If the Service is defective (not in conformity with the contract), a consumer may ask us to remedy the defect free of charge; if we do not remedy it within a reasonable time, or the defect is serious, the consumer may claim a reasonable price reduction or withdraw from the contract, under Sections 2389a to 2389u of the Czech Civil Code. Report defects to support@cockpitai.dev.

16.2 Business users. To the extent permitted by law, for business users the Service is provided "as is" and "as available", we exclude implied warranties, and our total liability for all claims arising from the Service in any 12-month period is limited to the amount you paid us for the Service in that period. We are not liable for indirect or consequential damage, lost profit or data, or for damage caused by agents, AI output, third-party services, your hosts or members you invite.

16.3 What we do not control. In all cases, and to the extent the law allows, we are not liable for: actions of AI agents on your hosts and the code they write or execute; content and availability of AI providers and other third-party services; data on your hosts; loss of the vault passphrase; breaches of AI providers' terms caused by project sharing (Section 8.2); and damage caused by your breach of these Terms.

16.4 Indemnity (business users). A business user will indemnify us against third-party claims arising from their use of the Service in breach of these Terms or of the AI providers' terms.

17. Changes to these Terms

17.1 We may change these Terms for good reason, for example new features (such as AWS workers), legal requirements, changes of third-party services, or clarifications. We notify you at least 30 days before a change takes effect, by e-mail and in the application, with a summary of the changes. If you do not agree, you may terminate your account or subscription before the effective date; continued use after it means acceptance. Changes that only benefit you or that are required by law may take effect immediately.

17.2 The current version is always published at https://cockpitai.dev/terms with its effective date; earlier versions are available on request.

18. Governing law, disputes, consumer information

18.1 These Terms are governed by the law of the Czech Republic. For consumers in another EU country this does not deprive them of the protection of mandatory provisions of the law of their country of residence.

18.2 Court. Disputes are decided by the courts of the Czech Republic; for consumers the jurisdiction rules of Regulation (EU) 1215/2012 apply.

18.3 Consumer dispute resolution. A consumer may submit a complaint to the Provider at support@cockpitai.dev. If it is not resolved, the consumer may use out-of-court dispute resolution at the Czech Trade Inspection Authority (Česká obchodní inspekce, Gorazdova 1969/24, 120 00 Praha 2, https://adr.coi.cz) or another authorised body in the consumer's country of residence.

18.4 Supervision. The Provider is subject to supervision by the Czech Trade Inspection Authority (consumer protection), the trade licensing office (živnostenský úřad) of the City of Brno and, for personal data, the Office for Personal Data Protection (ÚOOÚ).

18.5 Language. These Terms are concluded in English. The contract is stored by us electronically and you receive a confirmation of the purchase by e-mail from the merchant of record.

18.6 Miscellaneous. If a provision is invalid, the rest remains in force. You may not assign your account. We may assign these Terms to a successor of the business with notice to you. These Terms, the Privacy Policy and the pricing page are the entire agreement between you and us for the Service; the payment is additionally governed by the terms of the merchant of record.

19. Contact

Mandos s.r.o., Žebětínská 883/24a, Kohoutovice, 623 00 Brno, Czech Republic, Company ID (IČO) 04901258, VAT ID CZ04901258, e-mail support@cockpitai.dev. Privacy requests: privacy@cockpitai.dev (see the Privacy Policy).

Annex A – Model withdrawal form (consumers)

To: Mandos s.r.o., Žebětínská 883/24a, Kohoutovice, 623 00 Brno, Czech Republic, e-mail support@cockpitai.dev

I hereby give notice that I withdraw from my contract for the following service: Cockpit Pro subscription / wallet top-up (delete as appropriate), ordered on (date), transaction identifier (id), account e-mail (e-mail).

Name of consumer: …

Address of consumer: …

Signature (only if sent on paper): …

Date: …