Terms of service

These Terms of Service ("Terms") govern your access to and use of Rowly ("Service"), operated at rowly.me. By using the Service, you agree to these Terms.

1. The Service

Rowly provides external security scanning and reporting for your domain and the platforms behind it - Supabase, Firebase, Vercel, Netlify, AWS, and others - including a web application, optional dashboard features, and related tools. Features available to you depend on your plan (Free, Pro, or Pro+).

2. Accounts

You must provide accurate account information and keep your credentials secure. You are responsible for activity under your account and for any workspaces or organizations you own or administer.

3. Acceptable use

You agree not to:

• Scan systems you are not authorized to test
• Abuse, disrupt, or attempt to break the Service
• Misuse rate limits, automation, or shared infrastructure
• Use the Service for unlawful purposes

4. Domains and scans

When you run a scan, you provide a domain for that request. You represent that you have permission to scan that domain and any infrastructure it exposes. Scan results are for your security review and do not guarantee that your app or its underlying project is free of vulnerabilities.

Unverified domains only receive read-only checks (HTTP headers, TLS, DNS, exposed secrets, reads using the domain's own public anon key, and passive detection of publicly-reachable hosting platforms such as Vercel, Netlify, AWS S3/CloudFront, Firebase, and similar services - all ordinary GET requests and DNS lookups, the same as any visitor or browser would make). This also includes read-only grading from reputable third-party scanners (Mozilla HTTP Observatory, Qualys SSL Labs, Google Safe Browsing), public Certificate Transparency log lookups (crt.sh), and public domain-registration lookups (RDAP) - these share only the domain's hostname with that third party, never page content or credentials, and results are never published to SSL Labs' public results board. Verifying a domain by publishing the DNS TXT record we provide is an explicit, specific representation that you are authorized to run Rowly's full active test suite against that domain and its backend - including writing canary data, creating and signing in test accounts, triggering password-recovery and confirmation emails, and invoking discovered RPC and Edge Functions. Only verify domains you are authorized to test in this way.

You explicitly acknowledge that active testing entails interacting with your live or staging infrastructure. Rowly shall not be liable for any system downtime, rate-limiting, data modification, or third-party service fees (including cloud host or transactional email provider costs) resulting from automated tests, canary writes, or function execution on your verified domains.

5. Subscriptions and billing

Paid plans are billed through our payment provider (Paddle). Fees, taxes, and renewal terms are shown at checkout. See our Refund policy for cancellations and refunds.

6. Intellectual property

Rowly, its branding, and the Service software remain our property. You retain ownership of your content and scan reports generated for your projects.

7. Disclaimer

The Service is provided "as is" without warranties of any kind. We do not warrant uninterrupted availability or that findings are complete or error-free. Scan reports provided by Rowly do not constitute a formal security audit, legal compliance certification (such as GDPR, HIPAA, or SOC 2), or a guarantee that your project is immune to cyberattacks or data breaches.

8. Limitation of liability

To the maximum extent permitted by law, Rowly is not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, data, or business opportunities arising from use of the Service. In no event shall Rowly's total aggregate liability for all claims arising out of or relating to the Service exceed the greater of $100 USD or the total amount paid by you to Rowly in the twelve (12) months preceding the event giving rise to liability.

9. Indemnification

You agree to defend, indemnify, and hold harmless Rowly, its operator, and service providers from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in any way connected with: (a) your access to or use of the Service; (b) your violation of these Terms or any representation made herein (including authorized domain scanning); or (c) your violation of any third-party right, including intellectual property or privacy rights.

10. Changes

We may update these Terms from time to time. Continued use of the Service after changes become effective constitutes acceptance of the updated Terms.

11. Governing law and jurisdiction

These Terms shall be governed by and construed in accordance with the laws of the State of Israel, without giving effect to any principles of conflicts of law. You agree that any legal action or proceeding arising out of or relating to these Terms or the Service shall be brought exclusively in the competent courts located in Tel Aviv, Israel.

12. Contact

Questions about these Terms: support@rowly.me.