Terms of Service

What Tofu is

Tofu takes the app you or your coding agent wrote and runs it online. Your coding agent sends its code through the Tofu agent connection, or you connect a GitHub repository. Tofu reviews the source, builds it, deploys it, keeps it running, and gives you one dashboard for deployments, logs, domains and environment variables.

Tofu is operated by the Tofu team (“we”, “us”).

The Free plan and the paid plans are open to everyone. Some areas of the dashboard are marked Soon on purpose: they describe what is planned, collect nothing and do nothing until the service behind them is built.

Your account

You sign in with Google or GitHub. When offered, you can also create an account or sign in with an emailed code or with your phone: we text you a one-time code, and entering it signs you in. Accounts linked to Google or GitHub continue to use that provider. Tofu never sets or stores a password for you. Keep your account to yourself and use it for your own apps — you are responsible for what happens through it.

If you sign in with a phone number, we text only the one-time sign-in codes you ask for — no marketing texts — and your mobile provider's message and data rates may apply.

You must be at least 13 to use Tofu, and at least the age at which the law where you live lets you use it without a parent's consent, if that is higher.

Projects belong to the account that created them, and only that account can read or change them.

Connecting a coding agent

You can connect a coding agent to your account. The agent asks for a connection, and you approve it in your browser.

A real Tofu approval happens only at /dashboard/agent?code=, on the same Tofu address you signed in to, and only when a code arrives as XXXX-XXXX-XXXX printed by a coding agent you started yourself — or at /oauth/consent, on that same address, when an app you are connecting to Tofu sends you there and the page names where the sign-in returns. Refuse anything else. Nobody from Tofu, and no other site, needs an approval code, a password, a provider key or a token — and Tofu never asks for one.

This connection can upload your app’s source or import it from a public GitHub repository, download your app’s code into a new folder on your computer when the agent runs there, get the link that opens your app in Tofu’s builder, which you open yourself, run the safety check, deploy it — its build runs any migration step it has — once you have a hosting plan, save and remove your app’s public settings — an address, a feature flag, a key meant to be public — when the agent runs on your computer, but never a hidden value, which you type yourself in Keys & settings, create the app’s managed database, on its own or in the same call as a deploy, which Tofu runs and pays for as part of your plan, read the app’s build and runtime diagnostics, restore a previous deployment, connect, verify, release or withdraw the authorization for a domain you already own, read domain quotes and prepare a dashboard link for you to review a fresh price, agreements and payment when the agent runs on your computer — it cannot place an order or submit payment, read the stored status of domains you bought through Tofu and ask the registrar to send its confirmation email again to the registrant, without seeing your owner details or changing renewal settings, read and add DNS records on a domain you bought through Tofu, and delete one of yours — never its mail (MX) or verification (TXT) records, which stay with you, read your app’s own traffic — the first read for an app that has no counter yet issues its key — and turn that counter on or off, read whether your app is answering its visitors, and turn Tofu’s emails about it on or off, change how your app’s users sign in and how its sign-in email is sent, see who has an account in your app, add a person by email or remove one — which signs them out — choose whether anyone can sign up or only the people you add, and make the app private — only people with a link can open it — or open to everyone again, send a short message to up to ten of your app’s users, from your app’s own email address, get an invite link that lets one person into your private app — you hand the link out yourself, and the first person who opens it gets in for up to 30 days — list the links you made and turn one off again, choose who can open your app — anyone with the link, only people you list by email, or anyone with a code you share, which puts a sign-in page in front of the whole app — add or remove those people, make a new code, sign everyone out, and keep exact paths open for services like webhooks, connect your app to your own Stripe account when the agent runs on your computer — you install Tofu’s app on Stripe’s own page — then create payment links there, pass their payment events to the app or disconnect it, with the money going straight to you and nothing in its reach that moves money out of your account, set up email your app sends from its own address, pause it, give it a new key or remove it, when the agent runs on your computer — Tofu writes the app’s sending key into its settings, and nothing is sent until the app sends email itself, make a private test copy of one of your server apps to try a change on, put the version you tested there on the live app, or remove the copy and its database for good, when the agent runs on your computer — the copy takes test payments only, restore an archived database into a new one Tofu runs and pays for as part of your plan, and hand you a short-lived link to download its archive, keep a database Tofu warned you about from being archived for going unused, list your database’s daily backups and ask a person at Tofu to put it back to one, which loses what was saved after it, see which of your app’s database setup steps are done, choose whether Tofu runs them for an app, and mark one as done so it never runs, when the agent runs on your computer, delete an app — which also deletes its managed database, permanently, and the delete itself keeps no copy (a copy Tofu already holds of a running database, such as the archive it was restored from, is untouched) — or just its database; the source you uploaded is kept until you ask Tofu to erase it, send Tofu’s team a problem report you approved word for word, with your app’s status attached, sign in to Tofu, read the account’s id and email address, report the plan and the account’s GitHub state, and turn automatic updates off.

It cannot buy, renew or transfer a domain, submit a payment, read domain owner details, an environment value or a database password or connection string, change your plan or billing, or import a private repository from GitHub. Those stay with you.

Your code stays yours

You keep the rights to the code, content and data you bring. Tofu stores, builds, deploys and serves them only to run the service you asked for. We do not sell them, and we do not put them in front of advertisers.

You need the rights to everything you upload. Do not use Tofu for malware, phishing pages, fake shops, taking money for things you never deliver, or anything illegal, and do not attack other people's projects. The pre-deploy safety check is a useful review, not a guarantee that an app is safe or correct — publishing is your decision.

Taking payments in your app

Where Tofu offers it, you can connect your own Stripe account to an app, so the app takes payments into that account. You are the seller: each sale is between you and your buyer, under your own agreement with Stripe, and Tofu is not a party to it. Tofu holds no funds — your buyers pay into your Stripe account — and handles no refunds, disputes or taxes. You set what you sell, its price and your refund policy, and you answer for them and for your own taxes. What your app collects from your buyers is yours to answer for too, like everything it collects from the people who use it: say in your app's privacy notice that the details of their payments reach your app through Stripe and Tofu.

You connect by approving Tofu's Stripe app on Stripe's own page. That lets Tofu create in your Stripe account the products, prices and payment links you ask for, deactivate them when you ask, and pass your account's payment events on to the app they belong to. Where Stripe allows it and you approve it on Stripe's page, Tofu can instead give an app a webhook endpoint of its own in your Stripe account, at the app's own address, so Stripe sends the app its payment events directly; Tofu removes that endpoint when the app is disconnected or deleted. Tofu creates or deactivates something in your Stripe account only at your request, or at the request of a coding agent you connected once you have confirmed it, with the amounts, currencies and billing periods you confirm.

Connecting Stripe and trying it with Stripe's test cards come with a paid plan and with its free trial; taking real payments needs a paid plan and does not come with a free trial. Stripe charges its own fees as it would without Tofu, and Tofu takes no fee on your sales.

Tofu's part depends on Stripe continuing to offer Tofu's Stripe app, and Stripe can disable it, for your account or for every account that installed it. If Stripe disables it, or you disconnect, Tofu stops making changes in your Stripe account and stops passing its events on; your Stripe account and your money are not affected. Tofu keeps trying to deliver an event to your app for up to 3 days; one your app has not accepted by then is not delivered, and the payment stays recorded in your Stripe account.

A payment link keeps taking payments for as long as it is active in your Stripe account — also after your plan ends, after your app goes offline and after you disconnect. When you disconnect, Tofu offers to deactivate the payment links it created; any you keep, and any you made yourself, are yours to deactivate in Stripe. A subscription a buyer starts through a payment link that repeats keeps renewing in your Stripe account until it is cancelled there — also after its link is deactivated, your plan ends, your app goes offline or you disconnect — and once you disconnect, your app no longer hears about it.

Do not use an app connected to Stripe through Tofu to sell anything Stripe prohibits. If an app takes payments against these terms, Tofu may stop passing its payment events on, disconnect it from your Stripe account or take it offline.

Plans and what you pay

The Free plan costs nothing and hosts one app at a time. The Starter plan is one subscription per account, at USD 5 per month, and hosts up to 5 apps. The Pro plan is one subscription per account, at USD 20 per month, and hosts unlimited apps, within the fair use rules below. A larger size of the Pro plan, at USD 50 per month, keeps the same name and includes the larger numbers below. The Starter and Pro plans host your pages and the code behind them, and include connecting a domain you own. Where Tofu offers them, the Free plan does too. The paid plans are billed monthly through Stripe. Prices are in US dollars. If tax applies where you are, it is added at checkout. There is no annual billing.

Your $5 stays $5 while you keep it: a subscription's price does not go up while the subscription keeps running. If you subscribed at an earlier price, your subscription keeps that price until it ends.

The Starter plan includes 5 managed databases for your account, and the Pro plan includes 25, or 100 at its larger size. Tofu runs and pays for them as part of the plan.

Where Tofu offers it, the Free plan also includes one managed database for its app, which Tofu runs and pays for. You can add it once the app is live, or with that app's first deployment where the Free plan runs the code behind the app's pages, including after a free trial ends. Tofu does not archive this database for being unused, and keeps it while the app is in your account.

Every plan has the same backups and recovery. Ask us and a person at Tofu puts your database back to one of the last 7 daily copies Tofu keeps; anything saved after that copy is replaced. You can keep a database from your dashboard when Tofu says it may archive one. A database Tofu archives comes back with one click when your plan has room for it. Bringing it back costs nothing extra, and downloading its copy is free.

The Starter and Pro plans' apps can sign people in, with Google or an email address, and so can the Free plan's where Tofu offers it. Only the people who sign in count; anyone who opens your app through a link never does. Each plan sets how many people can sign in to each app: 5 on the Free plan, 10 on the Starter plan and 50 on the Pro plan, 250 at its larger size.

Every plan has limits, shown on the Pricing page and in Plan & billing in your dashboard. Uploads and deployments are capped per plan and enforced by the service. Uploads and deployments are counted each day: 20 of each on the Free plan, 50 of each on the Starter plan, and 200 of each on the Pro plan, or 500 of each at its larger size. The Tofu builder's cloud coding agent is unlimited on the Pro plan, 2 hours a day on the Starter plan and 30 minutes a day on the Free plan. Where the Free plan runs the code behind an app's pages, each request to that app runs for at most 60 seconds; a paid plan allows longer requests. No plan has token limits. The fair use rules below apply.

The Starter plan and the Pro plan can each start with a 7-day free trial, when Tofu offers it. You add a card on Stripe's checkout page, and nothing is charged during the trial. When it ends, the card is charged the monthly price of the plan you are on then, and again each month, unless you cancel before then. You can cancel at any time in Plan & billing: the plan then stays on until the trial ends, and nothing is charged. We email you before the trial ends. Each account gets one free trial: an account that already had a paid plan or a free trial starts a paid plan without one. The trial includes up to 1 GB of stored files per app, in at most 10,000 files; the first payment lifts that limit. The trial does not include taking real payments in your apps or buying a domain through Tofu; both open once its first payment goes through.

Tofu can also offer a free trial without a card. When it does, an account that has never had a paid plan or a free trial can use it free for 7 days, once: it starts when you press Start in your dashboard and ends 7 days later, to the second. The trial includes up to 1 GB of stored files per app, in at most 10,000 files; starting the paid plan lifts that limit. One free trial per account. Starting the paid plan during the trial ends the trial, and billing starts that day.

Card details are entered on Stripe's own checkout page and never reach Tofu. Open Plan & billing in your dashboard to manage or cancel the subscription in Stripe's portal.

Monthly payments are not refunded. Cancel any time and your plan runs to the end of the month you already paid for.

Domains are separate from the plans. Tofu connects a domain you already own, and its registrar's price and terms apply to it. Where the Domains page offers it, you can also buy a domain through Tofu: the domain terms apply to a domain you buy that way, and it is paid for separately from any plan.

Tofu AI and AI credit

Tofu AI lets your apps call an AI model through an OpenAI-compatible address, with a key Tofu gives each app. You pay for what your apps use, per million tokens, at the prices shown on the app's AI page. We may change the prices or the model with notice on that page; credit you already bought is spent at the price in force when a request runs.

Each account gets a one-time free credit of US$3 when it creates its first key. It has no cash value, and we may withdraw it from an account that abuses it.

You can buy AI credit in US$10, US$25 or US$100 amounts. Credit is shared by every app on your account and is deducted as requests are made; a request is refused when the balance cannot cover it. Credit does not expire. Payments for AI credit are not refundable, and credit left on an account when it is deleted is not refunded.

Keep your key secret and use it only from your server. You are responsible for requests made with your key; revoke it on the AI page if it leaks, and it stops working at once.

A model's answer can be wrong or incomplete; check what matters before you rely on it. We may slow, pause or stop the gateway, for example to protect the service or because the model provider is unavailable, and we do not promise it is always on.

Do not use Tofu AI to break the law, to abuse the service or to create or share harmful content, and do not try to get around its limits. Tofu AI is rate limited per app.

If a payment fails or you cancel

We do not delete your work because a payment failed. Your source archive, deployments, connected domains, environment variables and databases stay where they are.

A managed database follows a manual policy: after a payment failure or a cancellation, Tofu keeps the database at its own cost instead of pausing, transferring or deleting it, and follows up with you. Because the follow-up is manual, there is no automatic pause and no automatic deletion, and paying again restores normal paid operation. The database stays yours to leave with — contact us and we will arrange a transfer or another agreed outcome with you.

These rules are for a Starter or Pro plan that has been paid for. They still apply to the managed databases the account has running after it goes back to the Free plan, so the Free plan's rule above does not apply to them. A free trial that ends unpaid, with a card or without one, follows the next section instead.

When a free trial ends

A free trial with a card becomes the paid plan you chose when it ends, unless you cancel before then. If you cancel during the trial, or the first charge fails, there is no grace period: the plan ends with the trial, and the account goes back to the Free plan. Your apps and any managed database are then handled as listed below for a free trial without a card, with the plan you chose at checkout in place of the Pro plan: the plan you chose comes back once its first payment goes through, and those apps and databases come back with it as far as its allowance holds them. If the first charge fails, Tofu cancels the subscription, so the card is not charged for it later.

A free trial without a card ends 7 days after you press Start. Unless you have started the paid Pro plan by then, the account goes back to the Free plan at that moment, with no grace period:

• Apps that need the Pro plan go offline: their addresses are removed, and their code, settings and secrets are kept, so starting the Pro plan brings them back with a redeploy.
• One site made only of finished pages, with no server and no database, may stay online if no other app on the account is on the Free plan.
• A managed database you added during the trial is archived: Tofu copies its data and its stored files to Tofu’s own storage, then deletes the database itself, which also ends your apps’ use of Tofu’s sign-up email and Google sign-in.
• Tofu keeps the archive for 90 days, then deletes it. Until then you can download it, and restore it once you start the Pro plan.
• Your code and your apps’ settings stay available on the Free plan: you can download the code and change the settings.

Automatic updates from GitHub keep working after a trial ends: every plan includes them, so they are not one of the paid plan's features that stop. An app you already have on the Free plan stays a Free app during the trial, unless you put an update online that needs the Pro plan, such as server code or a site Tofu has to build. From then on it is an app that needs the Pro plan, and it goes offline with the others if the trial ends unpaid.

This is not the rule above for a failed payment or a cancellation: a free trial that ends unpaid, with a card or without one, has no grace period, and a managed database you added during the trial is archived and then deleted rather than kept.

Deleting a project

Deleting a project from its settings removes Tofu's records for it, removes the cloud project and takes the app offline. It cannot be undone, and the confirmation dialog says so before you confirm.

Some things stay behind. The source archive you uploaded is kept in Tofu's private storage after the project is gone. A copy of the app's managed database can stay there too: one we made by hand, or the one you brought the database back from. Ask us at hello@trytofu.ai and we will erase them.

Fair use

On the Pro plan, app hosting is unlimited. So is the Tofu builder's cloud coding agent, which writes your app's code for you: there is no daily limit, and each account runs one active session at a time. A session can end after a set length of time, and on the Pro plan you can then start a new one. On the Starter plan, you can use the agent for one session of up to 2 hours a day. On the Free plan, it is one session of up to 30 minutes a day. On both plans, the session's clock starts with your first message and runs until it ends, whether or not the agent is working. Once it ends, more time opens the next day (UTC). No plan has token limits.

Tofu runs on cloud servers. When they are at capacity, we may slow things down, or have a new session wait to start, so that everyone can keep working. We may also cap use far beyond what one person needs, such as a very large number of apps on one account.

The code your app runs on Tofu's servers is there to serve your app's own visitors, on every plan. Do not use it for work that runs all the time and has nothing to do with serving your app's visitors. Do not use it to mine cryptocurrency, or to relay or proxy other people's traffic. Do not use it to send bulk or unsolicited email. If an app does any of these, we may take it offline.

On the Free plan, an app's files may hold at most 200 MB together, as you upload them, and one file at most 100 MB. On the Starter and Pro plans, the limits are 2 GB and 500 MB. Big files that Tofu stores apart from an app's code, such as video or game data, have a daily limit. On the Free plan, each account may upload up to 1 GB of them a day (UTC), and up to 10 GB on the Starter and Pro plans.

An account is for one person. Do not share it with anyone else. For a team, write to us at hello@trytofu.ai.

Unlimited use is for one person building their own apps. If an account is shared, or is used for more than one person's work, we may limit, suspend or close it. Running the cloud coding agent nonstop, for example for 24 hours, counts as more than one person's work.

Ending your use of Tofu

You can stop at any time: cancel the subscription in the billing portal and delete your projects. There is no self-serve "delete my account" button yet, so email us and we will remove your account and tell you exactly what was removed.

We may suspend or end access if an account is used for abuse, illegal content, or attacks on Tofu or on other people's apps, or if it breaks the fair use rules above.

Availability

We work to keep the service and your apps available and your data intact. There is no service-level agreement unless we have agreed one with you in writing. If you need a signed commitment — an SLA, invoicing or custom terms — tell us what you need and we will say what we can offer.

Warranty and liability

To the extent the law allows, Tofu is provided “as is” and “as available”, without any warranty, express or implied, beyond the commitments these terms make. Keep your own copy of anything you cannot afford to lose.

To the extent the law allows, we are not liable for indirect, incidental, special or consequential damages, or for lost profits or lost data, arising from your use of Tofu or from not being able to use it. Our total liability for all claims relating to Tofu is limited to the greater of the amounts you paid to Tofu in the 12 months before the claim and USD 100.

Nothing in these terms limits a liability that cannot be limited by law.

Governing law and disputes

These terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules.

If a dispute comes up, contact us first at hello@trytofu.ai, and you and we will try to resolve it informally for 30 days. If it is not resolved by then, it will be decided by the state or federal courts located in Delaware, and you and we agree to their jurisdiction.

If you use Tofu as a consumer, nothing in these terms takes away the protections that the consumer laws where you live give you and that cannot be waived by agreement.

Changes to Tofu and to these terms

Tofu's features can change. When these terms change, we post the new version here and update the date above. From time to time we email account holders to say the terms have been updated, with a link to the current version; we do not list every change. A change to a price applies to the next billing period, never to one already paid for.

This page is the current terms; the date above is the last change.