Terms of Service

1Parties and definitions

"Idlefy", "we", "us" means Idlefy, a sole trader (Empresário em Nome Individual) established in Portugal, NIF PT321558472, Leiria, Portugal. Full details are in the Legal Notice.

"Service" means the Idlefy platform: the web application at app.idlefy.com, the Slack and Telegram bots, the macOS widget, the MCP server and API, the Idle Audit, Dev Boxes, and related documentation and support.

"Customer", "you" means the legal entity, or the individual acting in a business or professional capacity, that creates an Idlefy account. If you create or use an account for an organization, you confirm that you may bind it, and "you" means that organization.

"Users" means the individuals authorized to use your account: the person who created it, owners and administrators, and the people you invite.

"Cloud Account" means an AWS or Google Cloud account you connect to the Service.

"Dev Box" means a virtual machine that the Service creates in your Cloud Account at your request, together with the resources it needs, as described in section 4.

"Provisioning Role" means the separate, optional cloud role you deploy in your Cloud Account from the template we publish, which allows the Service to create and delete Dev Boxes.

2Who may use the Service

The Service is offered to businesses and professionals for managing their own cloud infrastructure. It is not offered to consumers. The person who accepts these Terms must be at least 18 and authorized to bind the Customer.

3Acceptance

By creating an account or using the Service, you accept these Terms and the Privacy Policy. If you do not agree, do not use the Service.

4What the Service does

The Service lets your Users start and stop virtual machines in your Cloud Account on a lease basis: a machine you have enabled for Idlefy stays stopped by default, a User starts it for a fixed period, and the Service stops it when that period ends or when the User ends it earlier. The stop time is set by your Users; the Service does not infer it from activity. Idle detection and the Idle Audit read usage data exposed by your cloud provider's APIs and report it; they do not stop machines.

By default the Service acts only on resources you have explicitly enabled (for example, instances tagged idlefy=enabled on AWS) and only within the permissions you grant: it can start, stop and reboot those machines, and read instance metadata and usage data in the Cloud Account (for example for the Idle Audit). With that default access it cannot create, delete, resize or reconfigure anything in your Cloud Account. It has no access to data inside your instances.

Dev Boxes. Where we offer it for your cloud provider and connection method, you may additionally enable Dev Boxes for a Cloud Account by deploying the Provisioning Role in your own cloud console. An owner of your organization enables Dev Boxes by accepting these Terms, including their Dev Boxes provisions, through an explicit checkbox before the Service issues the setup link for the Provisioning Role; the Service records that acceptance (the User, the time and the version of these Terms accepted). With the Provisioning Role, and only at the request of an owner of your organization, the Service creates a Dev Box in your Cloud Account with the resources it needs (on AWS: a virtual private cloud with its subnets, internet gateway and route table, shared by your Dev Boxes in that region, a security group, an optional public address, an instance and its disk), runs it on the lease basis described above, and deletes it when an owner asks, when the automatic deletion period an owner chose when creating it expires, or, where a creation fails or the machine has already been deleted outside the Service, to remove the resources the Service created for it. The Service acts only inside the limits you set when you deploy the Provisioning Role (allowed regions, instance types and maximum disk size) and, where your plan includes it and you have not switched off the budget block, your cloud budget. Everything the Service creates carries Idlefy's tags for your organization, and the Service deletes only resources that carry those tags; it does not delete resources you or anyone else created. The Provisioning Role cannot open a session on a machine, push a key to a running machine or read its console output, and the Service does not have access inside a Dev Box: the only keys the Service places on it are the SSH public keys your Users enter, written when the box is created, and access is from the source addresses they provide. You may remove the Provisioning Role at any time by deleting its stack in your cloud console; from then on the Service can start and stop your existing Dev Boxes like any other enabled machine but can no longer create or delete them. For plan limits and fees a Dev Box is a machine (section 8).

We grant you and your Users a limited, non-exclusive, non-transferable right to use the Service for your business purposes, including the free plan, trials and the Idle Audit, in accordance with these Terms. It ends only on suspension or termination under section 13.

5Your Cloud Account and cloud charges

• You confirm that you are authorized to connect and manage each Cloud Account and that you have set up a supported access method as described in our documentation: keyless by default (AWS IAM role via OIDC, Google Cloud Workload Identity Federation), or the supported encrypted-key method where you choose it. You may revoke that access at any time in your cloud console.
• You remain solely responsible for all charges billed by your cloud provider. The Service is a tool that can reduce those charges; it does not guarantee any reduction. Savings shown in the Service are estimates based on list prices and observed run time.
• Starting, stopping and rebooting instances are actions you authorize when you enable a machine. Stopping an instance destroys data on local instance-store or local-SSD disks and interrupts running processes. Do not enable machines that cannot tolerate being stopped, and keep persistent data on persistent disks.
• The Service depends on your cloud provider's APIs, quotas and capacity. If a provider API is unavailable, rate-limited or returns an error, or your Cloud Account lacks quota or capacity, a machine may fail to start, stop, launch or be deleted, or may stop or be deleted later than scheduled. We notify you where we can and retry where it is safe to do so, but we are not responsible for cloud charges or losses caused by provider-side failures, by quota or capacity limits in your Cloud Account, or by permissions you have removed or misconfigured, including for resources the Service could not delete for those reasons. Check your cloud console when you receive such a notice.
• Dev Boxes are billed by your cloud provider, not by us. Resources the Service creates for a Dev Box are created in your Cloud Account at the request of your owners and are charged to you by your cloud provider at its prices, including while the box is stopped (its disk and any reserved public address continue to accrue charges) and after you remove the Provisioning Role or close your account, until they are deleted. Cost estimates shown for a Dev Box and any cloud budget you set are planning aids based on list prices; they are not a cap on what your cloud provider bills.
• The limits in the Provisioning Role template (regions, instance types, maximum disk size) and the cloud budget are yours to set. The Service refuses requests outside them, but it cannot make them stricter than you did, and the budget block, where your plan includes it, refuses new boxes and new leases only; it never stops a machine that is running.
• Deleting a Dev Box permanently deletes the machine and its disk. This applies whether an owner deletes one box, deletes all boxes on a Cloud Account, or set an automatic deletion period when the box was created. An automatic deletion an owner scheduled runs once the scheduled time has passed and no lease on the box is active, whatever the state of your subscription or payments, for as long as your account, the cloud connection (connected and active in the Service), the Provisioning Role and Dev Boxes on that Cloud Account remain in place, and until termination under section 13; it is your instruction, and a past-due payment does not pause it. The Service takes no backup and cannot undo a deletion. Keep anything you need on a persistent volume or storage you manage yourself.

6Your account and security

• Keep your credentials, API and MCP tokens and single sign-on setup confidential, and secure the Slack, Telegram, Google or identity-provider accounts you link. Actions taken through your account or a linked account are treated as yours.
• Tell us at support@idlefy.com without delay if you suspect unauthorized access.
• You are responsible for your Users and for keeping the roles and teams in your organization current.
• If you use Dev Boxes, you are responsible for the SSH keys and source address ranges your Users enter, including the choice to allow every address (0.0.0.0/0), for the software your Users run on a Dev Box, and for keeping it updated. Only owners of your organization can create or delete Dev Boxes; their actions are yours.

7Acceptable use

You will not: use the Service to manage cloud resources you are not authorized to manage; interfere with or probe the Service, other customers' data or our infrastructure; resell the Service without our written agreement; use the Service to break the law or a third party's terms (including AWS, Google Cloud, Slack and Telegram terms); or attempt to bypass plan limits or fees. We may suspend accounts that put the Service or other customers at risk, with notice where practical.

8Plans, fees and payment

• Plans, limits and prices are described on the pricing page at the time you subscribe. Prices are in US dollars and exclude VAT and similar taxes, which are added where applicable.
• Payments are processed by our payment partner Polar (Polar Software Inc.), which acts as merchant of record: your payment contract for the subscription is with Polar, which issues invoices and collects applicable taxes, and Polar's terms apply to the payment. We do not store card numbers.
• Subscriptions renew automatically for the same period until canceled. Usage-based add-ons (for example additional machines or workflows above your plan's included amount) are charged per day of use as shown on the pricing page. A Dev Box counts as a machine for plan limits and add-ons for as long as it exists, whether running or stopped; how many Dev Boxes you may have is subject to your plan's limits.
• We may change prices with at least 30 days' notice by email; the new price applies from your next renewal after the notice period.
• If a payment fails, we may downgrade or suspend paid features after notice and a reasonable retry period.

9Trial and credits

Paid plans may start with a trial (currently 7 days) and a one-time bonus credit (currently $100) as shown at checkout. Credits have no cash value, cannot be transferred or withdrawn, are applied only against Service fees, and expire when the subscription is canceled or the account is closed. We may withdraw a trial where we reasonably suspect abuse.

10Cancellation and refunds

You may cancel at any time in Billing settings. Cancellation stops renewal: it takes effect at the end of the current billing period, you keep paid features until then, and no further subscription fees are charged. Usage-based charges and other amounts incurred before cancellation takes effect remain payable. Fees already paid are non-refundable, except where the law requires otherwise or we decide otherwise in an individual case. Refunds, when granted, are issued through Polar to the original payment method.

11Availability and disclaimer

We aim to keep the Service available but do not promise uninterrupted or error-free operation, and we may perform maintenance. To the extent permitted by law, the Service is provided "as is" and "as available", without warranties of any kind, express or implied, including fitness for a particular purpose.

12Limitation of liability

To the extent permitted by law:

• Neither party is liable for indirect or consequential loss, lost profits, lost savings, or loss of data (other than data we are obliged to keep under the Privacy Policy).
• Our total liability for all claims arising from events in any 12-month period is limited to the greater of (a) the Service fees you paid for Idlefy, including through Polar, in the 12 months before the first event giving rise to the claims and (b) $100.
• These limits do not apply to liability for willful misconduct or gross negligence, death or personal injury, breach of data-protection obligations to the extent it cannot be limited by law, or any other liability that cannot be excluded under Portuguese law.

13Term, suspension and termination

• These Terms apply while you have an account.
• You may close your account at any time by emailing support@idlefy.com from an owner's address. Closing does not refund fees except as stated in section 10.
• We may suspend or terminate your account if you materially breach these Terms and do not cure within 14 days of notice (immediately for security threats, illegal use, or non-payment after the notice in section 8), or if we discontinue the Service with at least 60 days' notice. Discontinuation takes effect no earlier than the end of your current paid period; where that is not possible we refund the unused part of the period pro rata.
• On termination we end all active leases, which stops the machines they cover, including Dev Boxes, and take no further action in your Cloud Account. We do not delete Dev Boxes or their resources on termination, and no automatic deletion under section 5 runs after it: they stay in your Cloud Account, stopped, and your cloud provider keeps charging for them until you delete them in your cloud console. Before closing your account, delete your Dev Boxes in the Service (for example with "Delete everything" on the Cloud Account). Verify the state of your instances and Dev Boxes in your cloud console, as you remain responsible for cloud charges. Revoke the IAM role, the Provisioning Role stack, the Workload Identity binding or the stored key in your cloud console to remove our access. You may ask us for an export of your organization's analytics data within 30 days after termination. We delete your organization's operational data within 90 days after termination, except accounting records we must keep under tax law and records needed for a specific legal claim, which are kept for that purpose only, as described in the Privacy Policy.
• If you remove the Provisioning Role while Dev Boxes exist, the Service disables Dev Boxes for that Cloud Account once it detects the removal and tells your owners. The boxes stay in your Cloud Account and can still be started and stopped through the default access as long as they carry the enabling tag and their automatic deletion time has not passed, but the Service can no longer delete them and no scheduled automatic deletion will run; delete them yourself in your cloud console when you no longer need them. The same applies to scheduled automatic deletions while the cloud connection is deactivated in the Service.

14Changes to these Terms

We may update these Terms. For material changes we give at least 30 days' notice by email to your organization's owners and post the new version with a new "Last updated" date. A change that reduces your rights or adds obligations takes effect at your first renewal after the notice period, so it never alters a period you have already paid for. If you do not agree, you may cancel before it takes effect; continued use after that date is acceptance. Changes required by law, and additions that impose no new charges, obligations or restrictions, may take effect immediately.

15Third-party services

The Service integrates with AWS, Google Cloud, Slack, Telegram, Google sign-in and your identity provider. Those services are governed by their own terms; we do not control them and are not responsible for them. A Dev Box boots from an operating-system image supplied through your cloud provider (currently Ubuntu) and runs the software your Users install; those are governed by their own licences, and we are not responsible for them.

16Data processing

For personal data contained in the cloud resource metadata we process on your behalf (for example an owner's name or email in an instance tag), you are the controller and we are your processor under Article 28 GDPR. This section is the data processing agreement between us and binds both parties from the moment you connect a Cloud Account. A separately signed Data Processing Agreement prevails over it.

• Scope. Subject matter: operating the Service for you. Duration: while your account exists. Nature and purpose: reading, storing and displaying the metadata described in the Privacy Policy to manage leases, report idle time and estimated cost, and notify your Users; and, where you enable Dev Boxes, storing the SSH public keys and source addresses your Users enter and passing them to your cloud provider to create the box. Categories of data subjects: your Users, the people named in your resource tags, and the people whose SSH keys or addresses your Users enter for a Dev Box.
• Instructions. We process this data only on your documented instructions, which are these Terms and the configuration you set in the Service, unless the law requires otherwise, in which case we tell you first where permitted.
• Confidentiality and security. Everyone we authorize to process the data is bound by confidentiality. We apply the measures described in section 9 of the Privacy Policy and notify you without undue delay after becoming aware of a personal-data breach affecting your data.
• Sub-processors. You authorize the sub-processors listed in section 4 of the Privacy Policy. We update that list at least 30 days before adding one that processes customer data; you may object on reasonable grounds within that period, and if we cannot accommodate the objection you may terminate the affected part of the Service.
• Transfers. Transfers outside the EU/EEA take place only under the safeguards described in section 8 of the Privacy Policy.
• Assistance. We help you respond to data-subject requests and meet your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us. Requests we receive directly from your data subjects are forwarded to you.
• Deletion. At the end of the Service we delete the data as described in section 13 of these Terms, unless the law requires us to keep it.
• Audit. We make available the information reasonably necessary to demonstrate compliance with this section and allow audits, no more than once a year and at your expense, on 30 days' notice; we may satisfy an audit request with a current independent report or a written description of our measures where that is sufficient.

17Notices

Notices to you are sent to the email addresses of your organization's owners and are effective when they reach that mailbox; keep those addresses current, as a notice that fails only because an address is out of date counts as received. Notices to us go to hello@idlefy.com or to the postal address in the Legal Notice. Put "Legal notice" in the subject line.

18Order of precedence and related documents

If you have signed an Enterprise agreement or a separate Data Processing Agreement with us, it prevails over these Terms in case of conflict. Otherwise the order is: these Terms, then the pricing page for plan details, then our documentation. The Privacy Policy explains how we handle personal data; the Legal Notice identifies the provider. The Partner Program has its own terms.

19General

These Terms are the entire agreement between us on this subject. If a provision is unenforceable, the rest remains in force. Neither party may transfer its position under these Terms to a third party without the other's consent, except where the transfer occurs by operation of law (for example succession or merger). Failure to enforce a right is not a waiver.

20Governing law and courts

These Terms are governed by the laws of Portugal. Disputes are subject to the courts of Lisbon, Portugal.