Terms of service

Who provides yof

yof is provided by Mondaily Ltd (placeholder: the company is being registered in the United Kingdom). Company number: to be added after registration in England and Wales. Registered address: to be added after registration.

Questions about these terms: support@yof.io.

Who can use it

You must be at least 16, or older where the law where you live sets a higher age. If you use yof for a company, you confirm you may accept these terms for it.

Some parts of these terms apply only to consumers: people using it mainly for purposes outside their trade, business or profession. Where a part applies only to consumers or only to business customers, it says so. Nothing in these terms takes away the rights consumer law gives you.

What yof does

yof checks apps and websites for security problems: leaked keys, open databases, exposed files, admin pages, weak headers and known vulnerable packages. It shows what it found, explains it and, if you ask, helps you fix it.

A check is read-only. yof only sends GET and HEAD requests to your site, and every request names itself as yof-check (+https://yof.io). It never submits a form, signs in or changes your site.

yof reports what its checks found on the day they ran. A clean result does not mean an app is safe, certified or compliant, and no report promises that.

What a report is and isn't

A yof report is a check of one app at one point in time, covering only what its scope section names. It is evidence to support your security and compliance work. It is not a certification, a conformity assessment or legal advice. A result with no findings does not mean the app has no vulnerabilities: automated checks cannot find every flaw, unknown weaknesses and flaws in business logic may remain, and the app may change after the date shown. You confirm you have read this before you pay for a report.

AI answers and content

yof uses AI to answer, draft and check. AI can be wrong or incomplete, so read what it gives you before you rely on it or send it. yof gives information, not legal, tax, medical, financial or security advice from a professional. The yof chat says it is an AI. Fixes Patch writes with its AI model are proposals in a pull request that you review and merge yourself.

What AI makes for you is yours to use, subject to the rights of others in what you put in. Do not present AI content as written by a person where that would mislead people, and keep any AI label we add.

Your account

• You need an account for anything beyond the free check on yof.io. You can sign up with an email and password, with GitHub, with Google or with Microsoft.
• Keep your sign-in details to yourself. You are responsible for what is done with your account.

Only apps that are yours

yof runs full checks only on a site you have proved you control, with a meta tag, a file at /.well-known/yof-verify.txt or a DNS record. yof looks for the proof again on every full check. For a site you have not proved, yof shows counts only.

By proving a site you confirm that you own it or are allowed to test it. The Acceptable use policy applies to everything you do with yof.

GitHub, Guard and Patch

• Guard reads the changed files of a pull request and writes one comment and one check run. It never pushes, approves or merges.
• Patch reads the linked repository, opens fix pull requests on a new branch and can open issues and upload findings to code scanning. It never writes to your default branch and never merges. You review and merge every change yourself.
• Patch checks that your GitHub account can write to the repository before every write.
• You can remove the yof GitHub App from a repository at any time in your GitHub settings.

Reports you order

• Reports are one-off orders at the prices shown on yof.io/pricing when you order. You pay once; a report is not a subscription.
• A report covers one proven app: one domain and, for reports that read code, one repository of up to about 150,000 lines.
• If yof cannot finish a report within 14 days of payment, you get your money back to your card, or as credit if you choose.
• Every delivered report is signed and listed in yof's public register by its id and hash, so anyone can check it is genuine. The register never shows your app or your findings.
• Ordering opens at launch. Until then nothing can be bought and nothing is charged.
• Prices are in US dollars. If you buy as a consumer, the price you see at checkout includes any VAT or sales tax we must charge, before you confirm. If you buy for a business, VAT or sales tax may be added, or reverse charged where the law allows, and checkout shows it before you pay.

Patch

• Patch is the one subscription: 29 US dollars a month. It includes one Outside report every calendar quarter.
• Until payment opens, Patch is free early access. We will tell you before any charge starts, and you choose whether to continue.
• You can cancel at any time; Patch stops at the end of the period you paid for.

Your right to withdraw (consumers in the UK and the EU)

• You can withdraw from a paid subscription within 14 days of the day you subscribed, without giving a reason.
• Before you pay, we ask whether you want the service to start at once, within the 14 days. If you say yes and then withdraw, we refund what you paid minus a share for the days you used it. If you say no, it starts when the 14 days are over.
• For a one-off order that is fully delivered within the 14 days (a finished report, for example), you lose the right to withdraw once it is delivered, but only if, before paying, you asked us to start at once and confirmed that you knew you would lose the right. We confirm both by email. Until it is delivered you can withdraw and we refund you minus the share of the work already done.
• To withdraw, tell us clearly within the 14 days: cancel in the app, or write to support@yof.io with your account email and the words "I withdraw from my contract". We confirm by email and refund within 14 days to the way you paid.
• Business customers do not have this right; they can cancel as described under Renewal and cancelling.

Renewal and cancelling

• A subscription renews automatically at the end of each month or year, at the price shown when you subscribed, and is charged to the card you gave, until you cancel. We show this next to the button before you pay, and you confirm it.
• You can cancel at any time in the app, in a few clicks and without contacting us. The plan then runs to the end of the period you paid for and does not renew. You can also write to support@yof.io.
• If a price goes up, we tell you by email at least 30 days before it applies to you, and you can cancel before then without any charge for the new price.
• After you cancel, we send a confirmation by email. If you live in California, these terms are also our automatic renewal disclosure under California law.

yof Spark for Startups: terms

Spark is yof's programme for young companies, open worldwide. An approved startup gets credit in US dollars that pays for Patch and one-off reports (Inside, Outside, Fix pack, Retest and the others on the pricing page), at list price, until the credit is used up or 12 months have passed, whichever comes first.

Spark Founders gives $150 in credit. Spark Partner gives up to $500 in credit; the amount for each partner's startups is agreed with the partner and confirmed to you by email when we approve your place.

Credit is not money. It has no cash value, cannot be paid out, transferred or sold, and any credit left after 12 months ends.

• Spark Founders: for a company under 5 years old, with up to 25 people, that has raised under $5,000,000 in total and is not yet a paying yof customer. You apply with a work email on the same domain as your company's website.
• Spark Partner: for a company that meets the same limits as Spark Founders (under 5 years old, up to 25 people, under $5,000,000 raised in total, not yet a paying yof customer) and joins with a code from an accelerator or investor we work with, anywhere in the world. A partner code only raises the amount of credit; it never changes who can apply.
• The 12 months start on the day we approve your place. Billing is not open yet: for a place approved before it opens, the 12 months start on the day billing opens, so you lose nothing by applying early.
• Any extra perks are listed on the Spark page when you apply, and are part of the offer only as listed there.
• Not for agencies, consultancies, publicly listed companies or companies that already pay us. One Spark place per company for each product.
• Spark credit does not combine with any other discount or offer. Credit always pays list prices.
• We check that you qualify from the evidence you give us: your company's own email domain and its entry in an official company register. We may ask for proof of your funding or team size. A person decides every application.
• If the information you gave us was false, we may end your Spark credit. We tell you first, by email. A company that grows past the limits after joining keeps its credit.
• When the credit is used up or its time ends, your plan continues at the list price unless you cancel. We email you at least 7 days before the first charge.
• Questions about Spark or how we used your application data: privacy@yof.io. We keep application details only to decide on the place and while the credit runs, then for as long as tax law requires for the invoices. If we decline an application, we delete it 90 days after our decision.
• Prices are in US dollars. If you buy as a consumer, the price you see at checkout includes any VAT or sales tax we must charge, before you confirm. If you buy for a business, VAT or sales tax may be added, or reverse charged where the law allows, and checkout shows it before you pay.

Your content

Your code, your sites and your reports stay yours. You give us the right to process them only to run yof for you, as the Privacy policy describes.

When Patch writes a fix that you merge, yof keeps a copy of that change to make future fixes better. It is used only inside yof, never sold or shared.

Suspension and ending

You can stop using yof and delete your account at any time in the app. You have 14 days to change your mind before the account and its data are erased. Export anything you want to keep first.

We may suspend or end an account that seriously or repeatedly breaks these terms or the Acceptable use policy, puts others at risk, or where the law requires it. We tell you why and, where we can, give you time to fix it first, unless the law or an urgent risk does not allow it. If we end a paid plan without such a reason, we refund the unused part.

We may stop offering the service with at least 60 days' notice by email, and we refund any period paid in advance that we will not provide.

Liability

We provide yof with reasonable care and skill. Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow us to limit.

If you are a consumer: you keep your legal rights, for example to a service that is provided with reasonable care and skill, matches its description and is fit for purpose, and to a repair, a price reduction or a refund if it is not. We are responsible for loss you suffer that was a foreseeable result of our breaking these terms or failing to use reasonable care. We are not responsible for business losses, because the consumer plans are for personal use.

If you are a business customer: apart from the liability we cannot limit, our total liability for all claims in any 12 months is limited to what you paid us in the 12 months before the first claim, and we are not liable for loss of profit, revenue or data you could have restored, or for indirect loss.

Law, courts and changes to these terms

These terms are governed by the law of England and Wales, and the courts of England and Wales decide disputes.

If you are a consumer, you also keep the protection of the mandatory rules of the country where you live, and you can bring a claim in the courts where you live. If you live in Scotland or Northern Ireland you can use your own courts too. If we bring a claim against you as a consumer, we do so in the courts where you live.

We may change these terms to reflect a change in the law, in yof or in how we run it. We tell you by email at least 30 days before a change that affects you applies. If you do not agree, you can cancel before it applies and we refund any period paid in advance after that date. We will not change a price you already paid for or the main features of a paid plan during the period you paid for.

Questions or complaints: support@yof.io.