Terms of Service

Who provides devboxes

Firat Özcan, a sole proprietor based in Germany, operates devboxes. The Imprint lists the postal address.

These terms cover devboxes.ai, the devboxes CLI and API, and the integrations, together “devboxes” or “the service”. The Privacy Policy describes how we handle your data.

What the service is

devboxes is an agent your company hands work to from its chat and issue tracking tools, the CLI or MCP. The documentation lists the current integrations. devboxes works on each task in an isolated workspace, either on devboxes machines in Germany or on your own machine (a Runner). It runs your checks and proposes the result for you to review as a pull request, an issue, an answer or a report.

Early access

• We provide the service as is and as available. There is no service level agreement and no uptime warranty.
• Features may change, break or be removed.
• We may reset data from early access. Where practicable, we will give reasonable notice first.
• Credits. You buy credits in advance, and tasks use them at the prices on the pricing page. Credits stay valid for 12 months from purchase. On the Free plan, while your credit is below €15, you can top up €10 to €20 at a time. Credit purchases have per-account limits to prevent abuse; we raise them on request. If a charge looks wrong, write to hello@devboxes.ai and we sort it out, refunds included.

Your account

Sign-up is open. The quickstart shows how to create an account.

Keep your sign-in credentials secure. You are responsible for the activity under your account and for the credentials you connect to it.

Organizations

Work in devboxes happens in an Organization. The person who creates an Organization becomes its owner. Each member of an Organization is an owner, an admin or a member:

• Owners invite and remove members and change their roles. An Organization always keeps at least one owner.
• Only owners add credentials: model accounts, repository and tool connections, and secrets.
• Owners and admins choose the models the Organization uses.
• Every member, whatever the role, can hand work to devboxes and follow it.

The Organization’s work uses the credentials its owners add, including the work of agents acting for its members. The Organization is responsible for what its owners connect, and for having the right to connect it.

When an owner removes a member, the member loses access to the Organization. devboxes also revokes the access it issued on their behalf, including the access of Runs they started. The Sessions and results they created stay with the Organization.

Acceptable use

Use devboxes only to hand work to an agent in repositories and tools you are allowed to work with. In particular:

• No illegal content or tasks.
• No abuse of compute, such as mining, spam infrastructure, or workloads unrelated to the tasks the service exists for.
• No attacking, probing or scraping third party systems without their permission.
• Connect only repositories and tools you own or have permission to use, and respect their licenses and the rights of others.
• No malware, and no attempts to break or circumvent the service’s security or limits.

Your repositories and code

You keep all rights to your repositories and to the changes agents produce for you.

You grant us the rights we need to operate the service:

• accessing the repositories you connect
• reading code into agent sessions
• sending Run content to the model provider you connect
• storing session transcripts
• opening pull requests on your behalf
• reading and writing in the tools you connect

We use these rights only to run the service. devboxes doesn’t use your code to train models. Your agreement with your model provider decides whether that provider may train on Run content.

Your Organization’s data

devboxes stores what your Organization’s work produces: Session transcripts and events, the artifacts agents create, and Chat conversations. The Organization controls this data. Its owners and admins can erase a Session or a Chat conversation.

The Privacy Policy describes how long we keep each kind of data, what an erasure deletes, and how to ask us to delete your account or your Organization’s data.

People without a devboxes account

Chat reads the messages in the channels and threads an Organization connects, including messages from people who have no devboxes account. When Chat is first called into an existing thread, it also reads the thread’s earlier messages.

The Organization that connects a channel is responsible for informing the people in it and for having the right to have their messages processed. devboxes uses those messages only for the Organization’s work: to answer in that thread, to do the work asked for there, and, where the Organization’s Chat settings allow it, to record Organization memory.

Your responsibility

You decide what to hand over, and you are responsible for it. That includes having the rights to the repositories, credentials and instructions involved.

Agent output can be wrong. Review the code an agent produces before you merge it, deploy it or otherwise rely on it.

Your model account (bring your own key)

devboxes doesn’t sell, provide or pay for model access. You bring your own: an API key, or a subscription you hold with a model provider such as Anthropic, OpenAI or xAI. This is what we mean by “bring your own key”.

• Who uses it. An owner of your Organization connects the account. It then serves only that Organization’s work, including agents acting for its members: its Chat replies and its Runs. We never use it for devboxes’ own purposes, and never for another Organization or customer.
• How it is used. Agents run on OpenCode, an open-source agent harness, and devboxes runs OpenCode for you with your account. For a Claude subscription, devboxes sends the model requests through Anthropic’s Claude Agent SDK. Each request identifies the software that sends it: OpenCode identifies itself as OpenCode, and the Claude Agent SDK identifies its requests as coming from an agent built on that SDK. devboxes doesn’t change that identification or present your model requests as coming from any other application. For some subscriptions, the sign-in uses the public sign-in client that the provider publishes for its own coding tool.
• Who pays. Your provider bills your usage, or counts it against your plan’s limits, under your agreement with them. We don’t charge for model usage or mark it up.
• Your provider’s terms. Your provider’s terms decide whether your account may be used this way. This matters most for personal subscription plans. Connect an account only if those terms allow it. A provider may limit or suspend an account it considers misused, and we may stop supporting an account type if a provider requires it.
• The credential. We store it encrypted and use it only to run your work. An owner or admin can remove it once no Project or Chat setting selects it and no queued or running work uses it. Removing it stops all further use.

Other services you connect

The terms of the repository hosts, chat tools, issue trackers and other services you connect govern their side.

Warranty and liability

During early access, we provide the service without any warranty as to availability, fitness for a particular purpose, or the correctness of agent output, to the extent permitted by law.

We are liable without limitation for intent and gross negligence, for injury to life, body, or health, and where liability cannot be excluded under mandatory law. For simple negligence we are liable only for the breach of essential contractual obligations (duties whose fulfilment makes the proper execution of the contract possible in the first place), and in that case limited to the damage that was foreseeable and typical at the time. Any further liability is excluded.

Suspension and termination

You can stop using devboxes at any time and ask privacy@devboxes.ai to delete your account and its data.

We may suspend or terminate accounts that abuse the service or breach these terms, and we may discontinue the service. Where practicable, we will give notice and the opportunity to export your data first.

Changes to these terms

We may change these terms as the service changes. We will announce changes in the product or by email before they take effect.

We announce a material change at least [N weeks] before it takes effect. Until then, you can object to it or end your account.

A change that disadvantages you applies to you only once you agree to it. Continuing to use the service does not count as agreement.

Governing law

German law governs these terms. If you are a consumer, the mandatory consumer protections of your country of residence remain unaffected.

If a provision of these terms is invalid, the rest remains in force.

Send questions about these terms to hello@devboxes.ai.