flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh

git agents cloudflare rust forge mcp

Commit

The policies are published, and g1t is written to at support@g1t.sh. Terms, Privacy, Refunds, Acceptable use and Subprocessors lose the draft banner (POLICIES_DRAFT is false, updated 2026-10-14, with the change in the policies' history): the terms name Delaware as governing law, say plainly that the plan renews each month until cancelled, and leave statutory consumer rights (an EU or UK consumer's 14 days to withdraw, how to ask, refunds within the legal deadline) above the no-refund and no-proration rules; writing to us before disputing a charge is a request, never a condition. Privacy clarifies analytics consent and what credential redaction can and cannot catch, and drops assurances about provider contracts and transfers that were not verified. Every contact (support, security, privacy, billing, abuse, legal) is support@g1t.sh, an alias for support@flagon.io, in the policies, SECURITY.md, the security page, pricing's enterprise link, the spike banner, a suspended account's sign-in message and the guides that named hey@flagon.io. Email sign-up is protected by Cloudflare Turnstile: the site's public key is set (the challenge still turns on only with both keys present), and Privacy and Subprocessors say so. Cloudflare Web Analytics' beacon is out of the site's script policy, as it no longer loads.

syntaqxcommitted 20h agoParentc42cae9Browse files

28	28
29	29		### What agents do
30	30
31		−	When a coding agent you connect records its work on g1t, we keep a session: what it was asked, the steps and tools it reports, what it wrote, which model it says it used, and how it ended. Credentials are removed from what is recorded. When you ask g1t a question, the conversation is kept with your direct message with @g1t. A session is as visible as its project: on a public project, anyone can read it. Workflow and check logs are kept the same way.
	31	+	When a coding agent you connect records its work on g1t, we keep a session: what it was asked, the steps and tools it reports, what it wrote, which model it says it used, and how it ended. We attempt to redact recognizable credentials from recorded tool details, but redaction cannot catch every secret or sensitive value. Review what your agent sends, especially for public projects, and revoke any credential exposed in a session. When you ask g1t a question, the conversation is kept with your direct message with @g1t. A session is as visible as its project: on a public project, anyone can read it. Workflow and check logs are kept the same way.
32	32
33	33		To catch cryptocurrency mining, every sandbox samples its own CPU use, disk and network activity, and the command lines of the processes it runs. These measurements are used only for abuse detection.
34	34
⋯
62	62
63	63		Our hosting provider, Cloudflare, sees every request to g1t, including your IP address, browser and the address you visited, to deliver it and to protect g1t from attacks. Our servers keep request logs for debugging and security in Cloudflare Workers Logs, which deletes them after 7 days.
64	64
	65	+	The email sign-up form uses Cloudflare Turnstile to distinguish people from automated traffic. The widget sends browser and device signals to Cloudflare; our server sends the resulting verification token and, when available, your IP address to Cloudflare to validate the check. See [Cloudflare's Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/).
	66	+
65	67		## Cookies and browser storage
66	68
67	69		g1t uses the cookies it needs to work, and one analytics cookie. There are no advertising or cross-site tracking cookies.
⋯
94	96		- answer you when you write to us;
95	97		- improve g1t, using our own records of how it is used and the site analytics [above](#how-the-site-is-used). We don't use your private content to train AI models.
96	98
97		−	If you're in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (running the service you signed up for), our legitimate interests (keeping g1t secure, preventing abuse, and improving it, balanced against your rights), and legal obligations (such as keeping tax records).
	99	+	If you're in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (running the service you signed up for), our legitimate interests (keeping g1t secure, preventing abuse, and improving it, balanced against your rights), and legal obligations (such as keeping tax records). For optional analytics where we ask permission, we rely on your consent. You can withdraw it at any time through Cookie choices in the footer, without affecting processing that was lawful before you withdrew it.
98	100
99	101		We don't sell your personal information, and we don't share it for advertising.
100	102
⋯
102	104
103	105		We share information only to run g1t, at your direction, or when the law requires it.
104	106
105		−	- Service providers ("subprocessors") that run parts of g1t for us, under contracts that limit them to doing so: Cloudflare (hosting, storage, databases, sandboxes, sending email and search), Stripe (payments and tax), HeyCatch (site analytics), Expo (notifications to the phone app) and Google (our mailboxes). The [subprocessors](/policies/subprocessors) page lists them and what each receives.
	107	+	- Service providers ("subprocessors") that run parts of g1t for us: Cloudflare (hosting, storage, databases, sandboxes, sending email and search), Stripe (payments and tax), HeyCatch (site analytics), Expo (notifications to the phone app) and Google (our mailboxes). The [subprocessors](/policies/subprocessors) page lists them and what each receives.
106	108		- Services you connect. When you connect an AI provider, an issue tracker, error tracking or a webhook, or let your sandboxes reach a host, we send them what that connection needs, because you asked us to.
107	109		- Other people on g1t, as your settings allow: your workspace's members, and everyone for public projects and your public profile.
108	110		- Vulnerability databases. To find vulnerable dependencies, we send the names and versions of packages in your lockfiles to OSV.dev, an open database run by Google. Nothing else about you or your repository is sent.
⋯
135	137
136	138		If you're in the EEA, the UK or another place with similar laws (such as under the GDPR), you also have the right to object to processing based on legitimate interests, and to complain to your data protection authority. If you're a California resident, you have the right to know what we collect, to delete it, to correct it, and not to be treated differently for using these rights. We don't sell or share personal information as California law defines those words.
137	139
138		−	To use any of these rights, write to [hey@flagon.io](mailto:hey@flagon.io) from the email address on your account. We'll answer within 30 days. We may need to confirm it's you before we act.
	140	+	To use any of these rights, write to [support@g1t.sh](mailto:support@g1t.sh) from the email address on your account. We'll respond without undue delay and within one month, or sooner if applicable law requires. If a lawful extension is needed, we'll explain why and when to expect a response within that initial period. We may need to confirm it's you before we act.
139	141
140	142		## Where your information is
141	143
142		−	g1t runs on Cloudflare's global network, so your information may be processed in the United States and other countries where Cloudflare operates, which may have different data protection laws from yours. Flagon is based in the United States. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses (and their UK equivalent) with our providers for these transfers.
	144	+	g1t runs on Cloudflare's global network, so your information may be processed in the United States and other countries where Cloudflare operates, which may have different data protection laws from yours. Flagon is based in the United States. International transfers must meet the safeguards required by applicable law. Contact [support@g1t.sh](mailto:support@g1t.sh) for information about the safeguards applicable to your data and how to obtain a copy.
143	145
144	146		## Security
145	147
⋯
147	149
148	150		## Children
149	151
150		−	g1t isn't meant for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, write to [hey@flagon.io](mailto:hey@flagon.io) and we'll delete it.
	152	+	g1t isn't meant for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, write to [support@g1t.sh](mailto:support@g1t.sh) and we'll delete it.
151	153
152	154		## Changes to this policy
153	155
⋯
155	157
156	158		## Contact
157	159
158		−	Questions about privacy, or a request about your information: [hey@flagon.io](mailto:hey@flagon.io).
	160	+	Questions about privacy, or a request about your information: [support@g1t.sh](mailto:support@g1t.sh).
159	161
160	162		Flagon, Inc.

1	1		We'd rather you pay for what you use and feel good about it than argue over a bill. This page says when money goes back to you, and how ending the plan works. It's part of the [Terms of Service](/policies/terms). Prices and limits are on [pricing](/pricing) and in the [usage and billing guide](https://docs.g1t.sh/guides/usage-and-billing/).
2	2
	3	+	## Your statutory rights
	4	+
	5	+	This policy does not limit cancellation, refund or other consumer rights that the law gives you. Those rights take precedence over the no-refund and no-proration rules below, including when you delete a workspace.
	6	+
	7	+	If you are an EU or UK consumer buying a service online, you generally have 14 days from entering the contract to withdraw without giving a reason. To exercise an applicable withdrawal right, email [support@g1t.sh](mailto:support@g1t.sh) with your account email, workspace and the purchase you want to cancel. A clear statement is enough; no special form is required. We will refund amounts due within the applicable legal deadline. We deduct for service supplied during that period only where the law permits it and any required request or consent was obtained. Using g1t does not by itself waive your statutory rights.
	8	+
3	9		## What is charged, and why
4	10
5	11		The forge is free. What costs money is compute, and the g1t plan, $21 a month per workspace with $10 of usage included, with no separate card or processing fee. Compute is hosted runner minutes (for checks, workflows and the merge queue), deploy builds, deployed apps (requests, CPU time, custom domains and containers), storage and git operations past what is included, search indexing, and observability data past the free amount. Most of it is charged at what it costs us plus 20%; runner minutes are a fixed rate for each machine, set from what a minute of it costs us. Model use isn't on g1t's bill: your agents, Ask g1t and sessions you start from g1t use your own AI provider, which bills you. The plan is billed monthly in advance; usage is billed when each month closes, or sooner as the workspace nears its limit on unpaid usage. Because usage is charged at close to what it costs us, most of it can't be given back once it has run: we've already paid for it.
⋯
21	27
22	28		- Charged in error. If we charged you twice, charged the wrong amount, or charged for something that didn't run because of a fault on our side, we refund it to the card it was paid with.
23	29		- Unused prepaid balance, when you close the workspace: write to us before you delete it, and we'll refund what's left to the card or account it came from.
24		−	- Anything else is up to us, case by case. Write to [hey@flagon.io](mailto:hey@flagon.io) and we'll be fair about it.
	30	+	- Anything else is up to us, case by case. Write to [support@g1t.sh](mailto:support@g1t.sh) and we'll be fair about it.
25	31
26	32		Refunds appear on the statement under Refunds and take as long as your bank takes to show them, usually 5 to 10 business days. Tax paid on a refunded amount is refunded in proportion.
27	33
⋯
29	35
30	36		## Ending the plan
31	37
	38	+	The plan renews automatically each month until cancelled. Cancel before the next renewal to avoid the next plan charge.
	39	+
32	40		- An owner or billing manager can end the plan at any time from Settings → Billing and plans: Manage billing opens Stripe's billing page, where you cancel it. The plan stays on until the end of the period you've paid for, and nothing more is charged for it after; the rest of the period isn't prorated. Until the period ends, you can renew it from the same page.
33	41		- Usage until the plan ends is still billed, on the final invoice.
34	42		- When the plan ends, the workspace goes back to free. Repositories, issues, pull requests and the audit log stay. Compute stops unless the trial or the open-source pool pays for it, and private storage past the free amount stops taking pushes until it's back under, though nothing is deleted.
⋯
36	44
37	45		## Closing a workspace or account
38	46
39		−	An owner deletes a workspace from its Settings → General. What it owes is charged at once, and its plan ends at once, without a refund for the rest of the period. If it has prepaid balance left, write to [hey@flagon.io](mailto:hey@flagon.io) first (see above). A deleted workspace can be restored for 30 days, then it is purged. You delete your own account from your account settings. See [cancelling](/policies/terms#cancelling-and-taking-your-data-with-you) in the terms.
	47	+	An owner deletes a workspace from its Settings → General. What it owes is charged at once, and its plan ends at once, without a refund for the rest of the period. If it has prepaid balance left, write to [support@g1t.sh](mailto:support@g1t.sh) first (see above). A deleted workspace can be restored for 30 days, then it is purged. You delete your own account from your account settings. See [cancelling](/policies/terms#cancelling-and-taking-your-data-with-you) in the terms.
40	48
41	49		## Disputes
42	50
43		−	If a charge looks wrong, please write to [hey@flagon.io](mailto:hey@flagon.io) before disputing it with your bank. We'll answer within one business day, and we can usually fix it faster. While a payment is disputed, the workspace's paid work stops. If the dispute is decided against us, it stays stopped until what the bank took back is paid. See the [usage and billing guide](https://docs.g1t.sh/guides/usage-and-billing/#your-card-and-billing-details).
	51	+	If a charge looks wrong, please write to [support@g1t.sh](mailto:support@g1t.sh) before disputing it with your bank. We aim to answer within one business day. Contacting us first is optional and does not limit your right to dispute a charge or extend your bank's deadlines. While a payment is disputed, the workspace's paid work stops. If the dispute is decided against us, it stays stopped until what the bank took back is paid. See the [usage and billing guide](https://docs.g1t.sh/guides/usage-and-billing/#your-card-and-billing-details).
44	52
45	53		## Custom terms
46	54

1		−	These are the companies that process information for g1t on our behalf, what each does, and what it receives. Each is bound by a contract that limits it to doing that. We'll update this page before we add a new subprocessor, and list the change in the [policies' history](/policies).
	1	+	These are the companies that process information for g1t on our behalf, what each does, and what it receives. We'll update this page before we add a new subprocessor, and list the change in the [policies' history](/policies).
2	2
3	3		## Subprocessors
4	4
5	5		\| Company \| What they do for g1t \| What they receive \| Where \|
6	6		\| --- \| --- \| --- \| --- \|
7		−	\| Cloudflare, Inc. \| Hosting and the network g1t runs on (Workers), databases (D1), storage for repositories, avatars and screenshots (Artifacts, KV and R2), queues, the sandboxes checks, workflows and builds run in (Containers), sending email (Email Service), search embeddings (Workers AI and Vectorize), and screenshots of deployed apps (Browser Rendering) \| Everything stored on g1t, and every request to it \| Global \|
	7	+	\| Cloudflare, Inc. \| Hosting and the network g1t runs on (Workers), sign-up bot protection (Turnstile), databases (D1), storage for repositories, avatars and screenshots (Artifacts, KV and R2), queues, the sandboxes checks, workflows and builds run in (Containers), sending email (Email Service), search embeddings (Workers AI and Vectorize), and screenshots of deployed apps (Browser Rendering) \| Everything stored on g1t, and every request to it \| Global \|
8	8		\| Stripe, Inc. \| Payments, cards, invoices and receipts, and working out sales tax and VAT (Stripe Tax) \| Workspace owners' billing details, billing address and tax ID, card details (entered on Stripe's page, never on g1t), and what each invoice charges \| United States \|
9	9		\| 650 Industries, Inc. (Expo) \| Delivering notifications to the g1t phone app, through Apple's and Google's push services \| The phone's push token, and each notification's title, text and where it opens in the app \| United States \|
10	10		\| Google LLC \| Google Workspace: the mailboxes that receive email sent to us \| What you write to us, and your email address \| United States \|
⋯
26	26		- Hosts your sandboxes reach, such as package registries and anything your jobs and builds fetch from or send to.
27	27		- Custom domains you point at your deployments.
28	28
29		−	Questions about subprocessors: [hey@flagon.io](mailto:hey@flagon.io).
	29	+	Questions about subprocessors: [support@g1t.sh](mailto:support@g1t.sh).

1		−	These terms are the agreement between you and Flagon, Inc. ("Flagon", "we", "us") when you use g1t: the website at g1t.sh, its API at api.g1t.sh, its MCP server at mcp.g1t.sh, git over g1t.sh, the documentation, apps deployed to g1t.page, and the runners and sandboxes g1t runs for you (together, "g1t" or "the service").
	1	+	These terms are the agreement between you and Flagon, Inc., a Delaware corporation ("Flagon", "we", "us") when you use g1t: the website at g1t.sh, its API at api.g1t.sh, its MCP server at mcp.g1t.sh, git over g1t.sh, the documentation, apps deployed to g1t.page, and the runners and sandboxes g1t runs for you (together, "g1t" or "the service").
2	2
3		−	We've tried to write them the way we'd want to read them: plainly. If anything here is unclear, write to [hey@flagon.io](mailto:hey@flagon.io) and we'll explain it.
	3	+	We've tried to write them the way we'd want to read them: plainly. If anything here is unclear, write to [support@g1t.sh](mailto:support@g1t.sh) and we'll explain it.
4	4
5	5		By creating an account or using g1t, you agree to these terms, the [Acceptable Use Policy](/policies/acceptable-use), and the [Refunds and Cancellation](/policies/refunds) policy. The [Privacy Policy](/policies/privacy) explains what we do with your information. If you use g1t for a company or another organization, you're agreeing for it, and you're telling us you're allowed to.
6	6
	7	+	Your statutory rights remain intact. Nothing in these terms or the policies they incorporate takes away consumer rights that cannot be waived, including rights to cancellation, refunds and remedies for a faulty service. These rights take precedence over any conflicting wording below.
	8	+
7	9		The g1t software is open source under the MIT license. These terms cover the service we run at g1t.sh, not your use of the source code; the license covers that.
8	10
9	11		## 1. Your account
⋯
11	13		- You need an account to do most things. Give us a real email address and keep it current: it's how we reach you about your account, security and billing, and how you get back in if you lose your password.
12	14		- You must be at least 13 years old, and old enough where you live to agree to these terms yourself. If you're under 18, a parent or guardian must agree to them for you.
13	15		- An account is for one person. Automation is welcome: use access tokens, workspace tokens and coding agents for it. Don't share a password, and don't create accounts to get around a limit, a trial, or a suspension.
14		−	- Keep your credentials safe. You're responsible for what happens under your account, your tokens and your SSH keys. If you think someone else has them, revoke them in your settings and tell us at [hey@flagon.io](mailto:hey@flagon.io).
	16	+	- Keep your credentials safe. You're responsible for what happens under your account, your tokens and your SSH keys. If you think someone else has them, revoke them in your settings and tell us at [support@g1t.sh](mailto:support@g1t.sh).
15	17
16	18		## 2. Workspaces
17	19
⋯
67	69
68	70		- The forge is free. Repositories, git, issues, pull requests and review cost nothing, within the free limits described on [pricing](/pricing).
69	71		- Compute is paid. Hosted runner minutes (for checks, workflows and the merge queue), deploy builds, deployed apps (requests, CPU time, custom domains and containers), storage and git operations past the free amounts, package and actions cache storage, search indexing, observability data past the free amount, and the other metered items on [pricing](/pricing) are charged to the workspace that owns the repository or project. Most are priced at what they cost us plus 20%; runner minutes are a fixed rate for each machine, set from what a minute of it costs us. Jobs on your own runners aren't charged. There is no price per person.
70		−	- The g1t plan is $21 a month per workspace, with $10 of usage included each month. Included usage doesn't roll over. There is no separate card or processing fee, on the plan or on anything else.
	72	+	- The g1t plan is $21 a month per workspace, with $10 of usage included each month. Included usage doesn't roll over. The plan renews automatically each month until you cancel. An owner or billing manager can cancel before the next renewal through Settings -> Billing and plans -> Manage billing. Cancellation takes effect at the end of the paid period; usage already incurred remains payable. There is no separate card or processing fee, on the plan or on anything else.
71	73		- When you're billed. The plan is billed monthly in advance, at the start of each billing period. Usage is billed in arrears: what a workspace used is invoiced when each month (UTC) closes, or sooner when the workspace nears our limit on unpaid usage (below). What a workspace owes when it is deleted is charged then.
72		−	- Price changes. Usage prices follow our costs. A price that goes down changes at once. When a usage price goes up, it's listed on [pricing](/pricing) with its reason and the day it takes effect, and owners of workspaces on the plan are emailed, at least 14 days before it applies. We'll give owners at least 30 days' notice by email before we raise the plan's own monthly price. Nothing already charged is repriced.
	74	+	- Price changes. Usage prices follow our costs. A price that goes down changes at once. When a usage price goes up, it's listed on [pricing](/pricing) with its reason and the day it takes effect, and owners of workspaces on the plan are emailed, at least 14 days before it applies. We'll give owners at least 30 days' notice by email before we raise the plan's own monthly price. Nothing already charged is repriced. You can cancel before a higher plan price applies, or stop using the affected metered services before their prices increase. Where the law requires your express agreement or longer notice, we will obtain that agreement or give that notice first.
73	75		- Payment. Payments are processed by Stripe. You authorize us to charge the workspace's card, or another payment method on file, for the plan each period, for usage as it is billed, and when the workspace nears our limit on unpaid usage. Invoices and receipts are on the Billing page. Card numbers never reach g1t.
74	76		- Taxes. Prices don't include taxes. Where the law requires it, sales tax, VAT or GST is added, worked out by Stripe from the workspace's billing address, and shown as its own line before you pay and on every invoice. Without a billing address we can't work tax out, so we don't charge the card until one is added. You're responsible for the taxes that apply to your purchases, other than taxes on our income.
75	77		- Failed payments. If a card is declined, new paid work stops until the workspace pays; if a renewal fails, the plan's features stop too. What the workspace owes stays owed, and if it stays unpaid we may suspend the workspace (section 11).
⋯
104	106		- it hasn't paid what it owes; or
105	107		- the law requires us to.
106	108
107		−	Some of this is automatic: a sandbox that looks like it's mining cryptocurrency is stopped at once, and a workspace whose spending spikes is paused until an owner answers. When we act, we'll tell you why, unless the law stops us or telling you would help someone abuse g1t. If you think we got it wrong, reply or write to [hey@flagon.io](mailto:hey@flagon.io) and a person will look at it.
	109	+	Some of this is automatic: a sandbox that looks like it's mining cryptocurrency is stopped at once, and a workspace whose spending spikes is paused until an owner answers. When we act, we'll tell you why, unless the law stops us or telling you would help someone abuse g1t. If you think we got it wrong, reply or write to [support@g1t.sh](mailto:support@g1t.sh) and a person will look at it.
108	110
109	111		When we close an account or workspace, we'll keep its content for 30 days so it can be exported, unless it was closed for illegal content or serious abuse, then delete it. What it owed for the plan and usage before it closed is still owed.
110	112
⋯
127	129
128	130		## 15. Copyright complaints
129	131
130		−	If you believe something on g1t infringes your copyright, send a notice to [hey@flagon.io](mailto:hey@flagon.io) with what is infringed, where it is on g1t, your contact details, and a statement that you believe in good faith the use isn't authorized and that your notice is accurate. If your content was removed and you believe that was a mistake, you can send a counter-notice to the same address. We close the accounts of repeat infringers.
	132	+	If you believe something on g1t infringes your copyright, send a notice to [support@g1t.sh](mailto:support@g1t.sh) with what is infringed, where it is on g1t, your contact details, and a statement that you believe in good faith the use isn't authorized and that your notice is accurate. If your content was removed and you believe that was a mistake, you can send a counter-notice to the same address. We close the accounts of repeat infringers.
131	133
132		−	Copyright notices and counter-notices go to Flagon, Inc. at [hey@flagon.io](mailto:hey@flagon.io).
	134	+	Copyright notices and counter-notices go to Flagon, Inc. at [support@g1t.sh](mailto:support@g1t.sh).
133	135
134	136		## 16. Governing law and disputes
135	137
136		−	These terms are governed by the laws of the United States and of the state in which Flagon, Inc. is incorporated, without regard to conflict-of-law rules. Any dispute will be resolved in the state or federal courts there, and you and Flagon agree to their jurisdiction. If you're a consumer, you keep the protections of the law where you live that can't be waived by contract.
	138	+	These terms are governed by the laws of the United States and of the State of Delaware, without regard to conflict-of-law rules. Any dispute will be resolved in the state or federal courts in Delaware, and you and Flagon agree to their jurisdiction. If you're a consumer, you keep the protections of the law where you live that can't be waived by contract, including any right to bring a claim in your local courts.
137	139
138		−	Before going to court, please write to [hey@flagon.io](mailto:hey@flagon.io). Most problems are solved faster by talking.
	140	+	Before going to court, please write to [support@g1t.sh](mailto:support@g1t.sh). Most problems are solved faster by talking.
139	141
140	142		## 17. Changes to these terms
141	143
142		−	We'll update these terms as g1t changes. We'll tell you before material changes take effect: by email to workspace owners and on the [policies](/policies) page, at least 30 days ahead, unless a change is needed sooner for legal or security reasons. Every change is listed in the policies' change history. If you keep using g1t after a change takes effect, you're agreeing to the new terms. If you don't agree, you can stop using g1t and take your data with you.
	144	+	We'll update these terms as g1t changes. We'll tell you before material changes take effect: by email to workspace owners and on the [policies](/policies) page, at least 30 days ahead, unless a change is needed sooner for legal or security reasons. Every change is listed in the policies' change history. To the extent permitted by law, continuing to use g1t after a change takes effect means you accept the updated terms. Where express consent is required, we will ask for it; continued use alone does not replace that consent. If you don't agree, you can stop using g1t and take your data with you.
143	145
144	146		## 18. The rest
145	147
⋯
152	154		## 19. Contact
153	155
154	156		Flagon, Inc.\
155		−	[hey@flagon.io](mailto:hey@flagon.io)
	157	+	[support@g1t.sh](mailto:support@g1t.sh)

58	58
59	59		## Responsible disclosure
60	60
61		−	If you've found a security problem in g1t, please tell us at [hey@flagon.io](mailto:hey@flagon.io). Our [security.txt](/.well-known/security.txt) says the same.
	61	+	If you've found a security problem in g1t, please tell us at [support@g1t.sh](mailto:support@g1t.sh). Our [security.txt](/.well-known/security.txt) says the same.
62	62
63	63		### What to send
64	64
⋯
74	74
75	75		### Out of scope
76	76
77		−	- Apps customers deploy to g1t.page, and the content of customers' repositories: report those to their owners, or to [hey@flagon.io](mailto:hey@flagon.io) if they're harmful.
	77	+	- Apps customers deploy to g1t.page, and the content of customers' repositories: report those to their owners, or to [support@g1t.sh](mailto:support@g1t.sh) if they're harmful.
78	78		- Denial of service, load testing, and spam.
79	79		- Social engineering of Flagon staff or customers, and physical attacks.
80	80		- Reports from automated scanners without a demonstrated impact, missing headers or best practices without a way to exploit them, and self-XSS.
⋯
105	105
106	106		### Safe harbour
107	107
108		−	If you act in good faith and follow this policy, we consider your research authorized. We won't pursue legal action against you or report you to law enforcement for it, and if someone else brings a claim against you for research that followed this policy, we'll make it known that it was authorized. If you're unsure whether something is in scope or allowed, ask us first at [hey@flagon.io](mailto:hey@flagon.io).
	108	+	If you act in good faith and follow this policy, we consider your research authorized. We won't pursue legal action against you or report you to law enforcement for it, and if someone else brings a claim against you for research that followed this policy, we'll make it known that it was authorized. If you're unsure whether something is in scope or allowed, ask us first at [support@g1t.sh](mailto:support@g1t.sh).

1	1		# Security
2	2
3	3		If you've found a security problem in g1t, please tell us privately at
4		−	[hey@flagon.io](mailto:hey@flagon.io) rather than in an issue, a pull
	4	+	[support@g1t.sh](mailto:support@g1t.sh) rather than in an issue, a pull
5	5		request or a chat channel. Our
6	6		[security.txt](https://g1t.sh/.well-known/security.txt) says the same.
7	7

117	117		support if this was a real job." A check or merge queue run fails with
118	118		it, a workflow job fails with it, and a deployment's status says it. g1t's
119	119		staff are told, with the measurements, and look at what ran. If it was a
120		−	real job, write to hey@flagon.io and say which run.
	120	+	real job, write to support@g1t.sh and say which run.
121	121
122	122		Beyond that, what a sandbox may do is bounded by its time cap, your
123	123		plan's limits on how much may run and how long, the short-lived

839	839		what customers pay.
840	840
841	841		Each change is made by g1t staff and recorded with who made it and why. To
842		−	ask for one, write to [hey@flagon.io](mailto:hey@flagon.io).
	842	+	ask for one, write to [support@g1t.sh](mailto:support@g1t.sh).
843	843
844	844		## Earlier plans
845	845

133	133		the end of a browser's user agent.
134	134
135	135		If something is broken and the page does not show it, write to
136		−	[hey@flagon.io](mailto:hey@flagon.io) or see
	136	+	[support@g1t.sh](mailto:support@g1t.sh) or see
137	137		[support](https://g1t.sh/support).
138	138
139	139		## Planned maintenance

40	40		- suspend or close accounts and workspaces;
41	41		- report it to the authorities, when the law requires or the harm is serious.
42	42
43		−	We'll tell you what we did and why, unless the law stops us or telling you would help someone abuse g1t. Honest mistakes happen: a build that looked like a miner, a script that ran too hard. If you think we got it wrong, write to [hey@flagon.io](mailto:hey@flagon.io) and a person will look at it.
	43	+	We'll tell you what we did and why, unless the law stops us or telling you would help someone abuse g1t. Honest mistakes happen: a build that looked like a miner, a script that ran too hard. If you think we got it wrong, write to [support@g1t.sh](mailto:support@g1t.sh) and a person will look at it.
44	44
45	45		## Reporting abuse
46	46
47		−	To report something on g1t that breaks this policy, write to [hey@flagon.io](mailto:hey@flagon.io) with links to what you found and why it's a problem. For security vulnerabilities in g1t itself, use [hey@flagon.io](mailto:hey@flagon.io) instead.
	47	+	To report something on g1t that breaks this policy, write to [support@g1t.sh](mailto:support@g1t.sh) with links to what you found and why it's a problem. For security vulnerabilities in g1t itself, use [support@g1t.sh](mailto:support@g1t.sh) instead.

42	42
43	43		/**
44	44		* Where people reach g1t. Each must be a real, watched mailbox. For now
45		−	* every topic goes to Flagon's one address; give a topic its own address
46		−	* here once the g1t.sh aliases exist.
	45	+	* every topic goes to support@g1t.sh, an alias for support@flagon.io.
47	46		*/
48	47		export const CONTACT = {
49		−	support: "hey@flagon.io",
50		−	security: "hey@flagon.io",
51		−	privacy: "hey@flagon.io",
52		−	billing: "hey@flagon.io",
53		−	abuse: "hey@flagon.io",
54		−	legal: "hey@flagon.io",
	48	+	support: "support@g1t.sh",
	49	+	security: "support@g1t.sh",
	50	+	privacy: "support@g1t.sh",
	51	+	billing: "support@g1t.sh",
	52	+	abuse: "support@g1t.sh",
	53	+	legal: "support@g1t.sh",
55	54		};
56	55
57	56		export type Policy = {
⋯
90	89		];
91	90
92	91		/**
93		−	* The policies are drafts until g1t's general launch: while this is true,
94		−	* the policies index and every policy page say so at the top
95		−	* (components/policies-draft.tsx). Set it to false to take the note down.
	92	+	* Publication approved on 2026-10-14. Set true only when intentionally
	93	+	* presenting the policies as drafts (components/policies-draft.tsx).
96	94		*/
97		−	export const POLICIES_DRAFT = true;
	95	+	export const POLICIES_DRAFT = false;
98	96
99	97		/** When any policy last changed, `YYYY-MM-DD`. */
100		−	export const POLICIES_UPDATED = "2026-10-13";
	98	+	export const POLICIES_UPDATED = "2026-10-14";
101	99
102	100		/** Every change to the policies, newest first. */
103	101		export const POLICY_HISTORY: { date: string; change: string }[] = [
104	102		{
	103	+	date: "2026-10-14",
	104	+	change:
	105	+	"Removed the draft banner. Standardized contact addresses on support@g1t.sh and named Delaware in the governing-law clause. Clarified automatic renewal, consumer cancellation and refund rights, and consent for changes where required. Privacy Policy: clarified analytics consent and the limits of credential redaction; removed unverified assurances about provider contracts and transfer arrangements. Privacy Policy and Subprocessors: Cloudflare Turnstile protects email sign-up.",
	106	+	},
	107	+	{
105	108		date: "2026-10-13",
106	109		change:
107	110		"Terms of Service and Privacy Policy: g1t no longer runs agents of its own. Section 6 of the terms covers the coding agents you connect and Ask g1t, which answers with your workspace's own AI provider; agents are no longer billed compute. Subprocessors: your workspace's AI provider listed among the integrations you choose. Terms and Refunds, for paid plans: the g1t plan is $21 a month with $10 of usage included and no card fee on anything; how the plan and usage are billed, taxes, failed payments, disputes, price-change notice and spend limits; card, billing address, tax IDs, invoices and cancelling are managed on Stripe's billing page; deleting a workspace or account is self-serve. Privacy Policy: audit log kept 7 days on Free and 90 on the plan; push devices, observability data and search embeddings disclosed. Subprocessors: Expo (phone notifications) and Google (Google Workspace mail) added; Stripe also works out tax.",

7	7		* - No other site may put g1t's pages in a frame.
8	8		* - A page runs only the scripts the site served it: its own files, and the
9	9		* inline scripts React and React Router write, each carrying the page's
10		−	* nonce, plus Cloudflare's and HeyCatch's analytics scripts. Styles may
	10	+	* nonce, plus Turnstile and HeyCatch's analytics script. Styles may
11	11		* be inline (highlighting and layout set them); images may come from any
12	12		* HTTPS address (pictures in a README); requests may go to any HTTPS
13	13		* address (the status page's summary, analytics events).
⋯
28	28		const files = usercontent && /^http:/.test(usercontent) ? ` ${new URL(usercontent).origin}` : "";
29	29		return [
30	30		"default-src 'self'",
31		−	// Cloudflare's Web Analytics beacon, when the zone turns it on,
32	31		// HeyCatch's helper for product analytics (lib/analytics.client.ts), and
33	32		// Cloudflare Turnstile on sign-up when it is on (lib/turnstile.ts).
34		−	`script-src 'self' 'nonce-${nonce}' https://static.cloudflareinsights.com https://in.heycatch.ai https://challenges.cloudflare.com`,
	33	+	`script-src 'self' 'nonce-${nonce}' https://in.heycatch.ai https://challenges.cloudflare.com`,
35	34		"style-src 'self' 'unsafe-inline'",
36	35		`img-src 'self' https: data: blob:${files}`,
37	36		`media-src 'self' https:${files}`,

158	158		];
159	159
160	160		/** The ways to reach g1t about an enterprise account. */
161		−	const ENTERPRISE_MAIL = "mailto:hey@flagon.io?subject=Enterprise%20billing%20for%20g1t";
	161	+	const ENTERPRISE_MAIL = "mailto:support@g1t.sh?subject=Enterprise%20billing%20for%20g1t";
162	162
163	163		const HOW = [
164	164		{

70	70		// Cloudflare Turnstile on email sign-up (app/lib/turnstile.ts): the
71	71		// widget's public site key here, and its secret as the TURNSTILE_SECRET
72	72		// secret. Either one empty turns it off.
73		−	"vars": { "TURNSTILE_SITE_KEY": "" },
	73	+	"vars": { "TURNSTILE_SITE_KEY": "0x4AAAAAAFWhRDwKfGS3CEvZ" },
74	74		"observability": { "enabled": true, "head_sampling_rate": 0.1 },
75	75		"upload_source_maps": true
76	76		}

25	25		use crate::Identity;
26	26
27	27		/// What a suspended account is told when it signs in.
28		−	pub const SUSPENDED: &str = "This account is suspended. If you think this is a mistake, write to hey@flagon.io from its address.";
	28	+	pub const SUSPENDED: &str = "This account is suspended. If you think this is a mistake, write to support@g1t.sh from its address.";
29	29		/// What signing up with a blocked domain is told.
30	30		pub const BLOCKED: &str = "Accounts cannot be made with addresses at this domain. Use another address.";
31	31

57	57		<p className={compact ? "text-xs text-muted" : "mt-3 text-sm text-muted"}>An owner chooses Keep going or Stop on Billing.</p>
58	58		) : (
59	59		<p className={compact ? "text-xs text-muted" : "mt-3 text-sm text-muted"}>
60		−	Write to <a href="mailto:hey@flagon.io" className="underline underline-offset-2">hey@flagon.io</a> to have it looked at.
	60	+	Write to <a href="mailto:support@g1t.sh" className="underline underline-offset-2">support@g1t.sh</a> to have it looked at.
61	61		</p>
62	62		)}
63	63		{!compact && spike && (

flagon-io/g1t

Comments