Terms of Service

Effective 1 November 2026. These terms cover the hosted service: the relay at relay.zerobyte.cloud and the console at console.zerobyte.cloud. They are the terms of service within the meaning of Article 8 of the Polish Act on Providing Services by Electronic Means, available free of charge on this page, where you can save or print them. The open-source software is licensed separately under its own licences and is not covered by them.

1. Who we are, and who may use the service

In these terms, "we" means the operator of ZeroByte Cloud, reachable at hello@zerobyte.cloud, and "you" ("the customer") means the business that opens an account. The service is for businesses only, and is not offered to consumers. By opening an account you confirm that you use it for your trade, business or profession, that the person accepting these terms may bind you, and, if you are a natural person running a business, that the contract has a professional character for you within the meaning of Articles 385⁵, 556⁴ and 576⁵ of the Polish Civil Code, because building or running software is part of your business. If any of this is not true, do not use the service.

2. What the service does

The relay stores encrypted envelopes that your apps' devices send to each other, until the receiving device reads and deletes them or the mailbox expires, and optionally wakes devices through Apple's and Google's push services with your own credentials. Envelopes are encrypted on the devices with keys we never receive. We cannot read, scan, filter or recover their content, and nothing in these terms obliges us to.

The relay is a temporary store, not a backup. Data in it is deleted by design: when it is read, when a device prunes or erases it, when a mailbox reaches its limits, or when it has been idle for the app's idle period. Do not rely on it as the only copy of anything.

To use the console you need a current web browser with JavaScript and cookies enabled and an email address, or an Apple or Google account. Your apps need an implementation of Relay Protocol v1, such as one of the ZeroByte SDKs, and HTTPS with TLS 1.2 or later. You must not provide content of an unlawful character through the service.

3. Account and plans

• You are responsible for your account, for everything done with it, and for keeping your sign-in methods and your apps' credentials secure. Tell us at once at security@zerobyte.cloud if you suspect misuse.
• The plans, their allowances and their prices are those on zerobyte.cloud/pricing and in the console when you subscribe. Every plan is paid; without one, your apps cannot store envelopes. On a plan without metered usage, such as Personal, an app that reaches its monthly allowance cannot store new envelopes until the next month.
• Plans are billed monthly in advance through Stripe; on Pro, usage above the included amount is billed in arrears. If you switch plans, Stripe prorates the difference on your next invoice. Prices are final: we do not charge VAT. Where VAT or another tax is due on the service in your country, for example under the reverse charge, you account for it. Fees already paid are not refundable, except where the law requires otherwise.
• If a payment fails and is not settled after Stripe's retries, your plan ends and your apps stop storing envelopes until you subscribe again.
• We may change prices or plans with at least 30 days' notice by email. The change applies from your next billing period; you may cancel before it does.

4. Your apps, your users, your content

You are solely responsible for what your apps send through the service, for your apps themselves, and for your relationship with your users, including your own terms and privacy notice towards them and any consents they require. You are liable for your users and for anyone you let use your apps or your account as for your own acts (Article 474 of the Polish Civil Code). We are a hosting and transport intermediary under Article 6 of the EU Digital Services Act: we do not choose, see, modify or select the content, and we have no general obligation to monitor it.

You must not use the service, or let your apps be used, to store or transmit anything unlawful, including child sexual abuse material and content that incites terrorism; to distribute malware or control infected devices; to send spam or unsolicited push notifications; to attack, overload or probe the service or anyone else; to infringe others' rights; or in breach of sanctions or export controls. You must not try to get around the limits of your plan, resell the service as a relay of your own, or access mailboxes or accounts that are not yours. You confirm that your apps comply with the law that applies to them and to their users.

Because we cannot see content, we act on apps and accounts, not on messages. If we receive a notice under section 9, an order from an authority, or have other credible grounds to believe that these terms or the law are being broken, we may at once suspend or delete the app or mailbox concerned, or the account, without liability to you and without refunding fees for the period of suspension. You will give us, on request and without delay, the information we reasonably need to answer a notice or an authority, and stop the conduct concerned.

5. Your responsibility towards us

If a third party, including one of your users or a public authority, makes a claim against us, or imposes a fine or other sanction on us, that arises from your apps, your content, your users' conduct or your breach of these terms or of the law, you will release us from it and pay us everything we pay or lose because of it: damages, fines to the extent the law allows them to be passed on, settlements agreed with your consent (which you will not unreasonably refuse), and reasonable costs, including lawyers' fees. We will tell you of the claim promptly, and you may take over its defence at your cost if the law allows it.

For each breach of the second paragraph of section 4 you will pay us a contractual penalty (kara umowna, Article 483 of the Polish Civil Code) of EUR 5,000, within 14 days of our demand. We may claim damages beyond the penalty (Article 484 §1). The penalty does not limit your obligations under the previous paragraph. We may set off any amount you owe us against amounts we owe you.

6. Availability and changes to the service

The service is provided "as is" and "as available". There is no service level agreement on any plan. We do not warrant that it will be uninterrupted, error-free, or fit for a particular purpose, and the statutory warranty for defects (rękojmia, Articles 556 to 576⁵ of the Polish Civil Code) is excluded. The service depends on providers we do not control, among them Cloudflare, Apple, Google and Stripe; their outages and changes are outside our responsibility.

We may change, add or remove features. If a change removes something material to your paid plan, we will give you at least 30 days' notice, and you may cancel.

7. Liability

The fees reflect this allocation of risk. To the fullest extent the law allows:

• we are not liable for the content that passes through the service, for the conduct of your apps or their users, or for loss of data, including envelopes that expire or are deleted as described in section 2;
• we are not liable for anything we do in good faith to comply with the law, an order or a notice, including suspending or deleting an app, a mailbox or an account;
• we are not liable for indirect or consequential loss, lost profits, revenue, business or goodwill, however caused, nor for the acts of the providers named in section 6 or of other persons we use to perform the service;
• our total liability arising from or in connection with the service, in contract, tort or otherwise, is limited to the fees you paid us in the 12 months before the event giving rise to the claim.

Nothing in these terms limits liability for damage we cause intentionally (Article 473 §2 of the Polish Civil Code), or any other liability that cannot be limited under the law that applies.

8. Personal data

For your account we are the controller of the data needed to run it, as described in the privacy notice.

Whatever your apps' devices send through the relay we handle as your processor, under Article 28 of the GDPR, and these terms are the processing agreement between us. We process that data only to provide the service as these terms describe, which are your documented instructions. People who handle it for us are bound to confidentiality. We secure it as described in the protocol: end-to-end encryption on the devices, no logs of requests or IP addresses on the relay, and access tokens stored only as digests. Our sub-processors are Cloudflare, Inc. (hosting and storage) and, for account and billing data only, Stripe; we will tell you 30 days before adding another, and you may object by closing your account. We will help you, as far as the encryption allows, with your users' requests and your obligations, tell you without undue delay of a personal data breach affecting your data, delete the data when the service ends (the relay's data expires by itself), and give you the information needed to show compliance. Transfers outside the EEA rely on the providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.

9. Notices of illegal content, and points of contact

Under the EU Digital Services Act, anyone may notify us of content or activity they consider illegal at abuse@zerobyte.cloud. Please include the app id or mailbox URL, why you consider it illegal, your name and email address (unless the notice concerns child sexual abuse material), and a statement that the notice is accurate and complete. We confirm receipt, decide without undue delay, and give the customer concerned a statement of the reasons for any restriction, with the means to contest it, unless the law or an authority forbids it. Notices are decided by a person; we use no automated content moderation, and cannot, because we cannot see content. If we learn of information that gives rise to a suspicion of a criminal offence involving a threat to the life or safety of persons, we inform the competent authorities, as Article 18 of the Digital Services Act requires.

Our single point of contact for authorities of the Member States, the European Commission and the European Board for Digital Services, and for users of the service, is legal@zerobyte.cloud, in English or Polish.

10. Requests from authorities

We do not sell, rent or share customer data, and we do not give anyone access to it, except to our sub-processors to run the service or when a law that binds us requires it. We disclose data to a public authority only in response to an order that is legally binding on us, such as one from a Polish court or prosecutor or one issued under an EU instrument that applies to us; a request from another country must come through the channels of mutual legal assistance. We check every order, answer it as narrowly as it allows, and contest it where we have grounds. Unless the law or the order forbids it, we tell the customer concerned before we disclose anything. We will publish once a year how many orders we received and how we answered them.

The relay is built so that there is very little to disclose. This is everything we could produce, if ordered to:

About an account

• the email address, the Apple or Google account identifier used to sign in, and when the account was created;
• the Stripe customer and subscription identifiers and the plan; the billing name, address and payment details are held by Stripe, not by us;
• the apps: their names, push topics, settings, creation dates and the number of envelopes stored each month;
• the push credentials uploaded for the apps, which we hold encrypted under our own key in order to send pushes;
• the IP address that asked for a sign-in link, kept for 24 hours to limit abuse.

About a mailbox, given its app id and mailbox id

• whether it exists;
• the envelopes not yet read: their sizes, sequence numbers and encrypted bytes, which we cannot decrypt;
• the last sequence number stored in each direction;
• the day it will expire if idle, which shows, to within a day, when it last received a write or claim;
• the SHA-256 digest of its access token.

What we do not have

• the content of any envelope or signal frame, or any key that opens one;
• who or which device a mailbox belongs to: mailbox ids are random-looking values derived from keys that exist only on the paired devices, and they are not linked to any account of an app's user;
• the IP addresses of devices: the relay keeps no request logs, and an address exists only while a request lasts (Cloudflare, which carries the traffic, processes addresses briefly to deliver it and to block attacks);
• devices' push tokens, which the relay stores encrypted under the device's own access token and opens only while that device's request is being served;
• who talks to whom, when an envelope was stored or read, or a history of envelopes already read and deleted.

On relay.zerobyte.cloud, Cloudflare's storage keeps a 30-day history of each mailbox so that it can be recovered after a failure; it holds the same sealed envelopes and nothing more, so a pruned envelope may stay there, still sealed, for up to 30 days. The documentation describes exactly what the relay keeps, and the relay's source code is public. We have not built, and do not intend to build, any way to read the content that passes through the service.

11. Suspension, ending and switching

You may cancel Pro at any time in the console's billing portal; it stays active until the end of the period you paid for. You may close your account at any time by writing to hello@zerobyte.cloud; we then delete its apps, which stops their devices from reaching the relay within minutes. For 30 days after that you may ask us for a copy of your account data (your apps, their settings and usage) in JSON, free of charge, which is how you switch to another relay, including one you run yourself with the open-source software; envelopes are transient and are not exported. We then delete the account data, except records we must keep by law, such as invoices. This section also gives effect to your switching rights under Chapter VI of the EU Data Act.

We may suspend or close an app or account, with notice where possible, if you break these terms, if payment is overdue, if an authority or the law requires it, or if it threatens the security or stability of the service. We may end the service as a whole with at least 90 days' notice and a pro rata refund of fees paid for the time after it ends.

12. Complaints

Send complaints about the service to hello@zerobyte.cloud from your account's email address, with the app concerned and a description of the problem. We answer by email within 14 days.

13. Changes to these terms

We will email you at least 30 days before a material change takes effect. Continuing to use the service after that date means you accept the change; if you do not, cancel and close your account before then. Changes required by law or by an authority may take effect sooner.

14. General

These terms are governed by Polish law, excluding the UN Convention on Contracts for the International Sale of Goods. The courts having jurisdiction over our place of residence have exclusive jurisdiction. Neither party is liable for failures caused by events beyond its reasonable control. You may not transfer these terms without our consent; we may transfer them to a successor of the service with notice. If any part of them is unenforceable, the rest stays in force. They are the entire agreement between us about the service, and the English version prevails.

Contact: hello@zerobyte.cloud · abuse: abuse@zerobyte.cloud · legal and authorities: legal@zerobyte.cloud