Effective date: May 16, 2026
These Terms of Service ("Terms") govern your access to and use of the VibeKit platform — the website at vibekit.bot, the Telegram bot, the iOS application, the web dashboard at app.vibekit.bot, the published npm packages, and any related services (collectively, the "Service"). By using the Service, you agree to these Terms.
VibeKit provides AI-powered software development tooling: each app you create gets its own persistent AI agent, an isolated container hosted on AWS Fargate (us-east-2), a public subdomain at <name>.vibekit.bot, optional custom-domain mapping, and optional GitHub repository integration. You can interact with your agent from Telegram, iOS, or the web dashboard.
The Service is offered "as is." Features change. We may add, modify, or remove functionality. Material changes affecting paying users will be communicated in advance where reasonable.
You must be at least 13 years old to use the Service, or the minimum age required by the laws of your country, whichever is greater. If you use the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.
VibeKit lets you route AI requests through your own provider credentials — currently Anthropic API keys (sk-ant-api03-…), Anthropic OAuth tokens from claude setup-token (sk-ant-oat01-…), OpenAI API keys (sk-proj-… and others), and ChatGPT-subscription Codex OAuth tokens.
By submitting any third-party credential to VibeKit — an API key, OAuth token, subscription token, or equivalent — you represent and warrant that the credential is yours (or your organization's), that you are authorized to use it for the purposes for which you are using it via VibeKit, and that doing so does not violate any agreement you have with the issuing provider (e.g. Anthropic, OpenAI, or any other AI service). You are solely responsible for compliance with the terms of the underlying provider, including any restrictions on automated use, sharing, or reselling.
If a provider terminates, throttles, or invoices you because of usage routed through VibeKit, that is between you and the provider. VibeKit has no visibility into your account standing with third-party providers and is not a party to your agreement with them.
Keys are encrypted at rest with AES-256-GCM, using per-user encryption keys derived from a master key via HKDF-SHA256 with your account UUID as salt. Master-key compromise alone does not expose any single user's credentials. Plaintext is held only in process memory at request time and is never written to logs, telemetry, analytics, or backups. You can remove a key at any time from Profile → AI Provider, which deletes the ciphertext from our database.
When you submit a request to your VibeKit agent, the request — including chat messages, file contents, code, and app context relevant to the task — is sent to a third-party AI provider to generate a response.
Each provider operates under its own terms and privacy policy. By using the Service you acknowledge that prompts and context will be transmitted to whichever provider applies to your routing.
You agree not to use the Service to:
We may suspend or terminate accounts that violate this section. Egregious abuse may be reported to upstream providers, hosting partners, or law enforcement.
You own the code, files, prompts, and other content you create with the Service ("Your Content"). You grant VibeKit a limited license to host, process, transmit, and display Your Content only as necessary to operate the Service for you — e.g., running your code in your Fargate container, serving your subdomain, sending prompts to AI providers, syncing to your linked GitHub repo, and showing you your data in the dashboard. We don't claim ownership of Your Content, we don't sell it, and we don't use it to train our own models (we don't train models).
You're responsible for Your Content. Don't upload anything you don't have rights to.
Agent responses are generated by third-party language models. They may be inaccurate, incomplete, or unsafe to deploy without review. You are responsible for reviewing any code, configuration, or output produced by your agent before relying on it in production or shipping it to users. The same model output, given identical prompts, can vary between calls.
We do not warrant that AI output is correct, fit for any particular purpose, free of intellectual-property issues, or compliant with the laws of any jurisdiction in which you operate.
The Service integrates with third parties including but not limited to: Anthropic, OpenAI, OpenRouter, DeepSeek, Qwen (via OpenRouter), Stripe, Supabase, Cloudflare, GitHub, Vercel (legacy paths), Namecheap, AWS, Telegram, Apple (App Store and Sign in with Apple), Google (Sign in with Google). Their terms govern their portions of the Service.
VibeKit-hosted apps run as standalone AWS Fargate tasks in us-east-2, served at <name>.vibekit.bot behind a shared nginx layer. You may map a custom domain to your app via the in-product flow. Subdomains are issued first-come, first-served and may be reclaimed if (a) your account is terminated, (b) the subdomain impersonates VibeKit or another brand in a way that creates user confusion, or (c) the subdomain is unused for an extended period after we have notified you.
We aim for high availability but make no uptime guarantee. Maintenance windows, third-party outages (AI providers, AWS, Cloudflare, etc.), and emergency patches may interrupt access. AWS Fargate task retirements are handled automatically by an internal watcher that redeploys affected apps before AWS stops the original task, but brief restart windows can still occur.
You can stop using the Service and delete your account at any time from the dashboard. We can suspend or terminate access for material breach of these Terms, prolonged inactivity (12+ months for free accounts with no balance), or to comply with legal obligations.
On termination, your Fargate tasks stop, your subdomain mapping is removed, agent sessions and transcripts are deleted, your workspace and file uploads are deleted within 30 days, and any unused refundable credit balance is processed according to Section 6. Your linked GitHub repository (if any) and any custom-domain registration you purchased through Namecheap remain yours — VibeKit does not delete external resources you own.
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. VIBEKIT DOES NOT WARRANT THAT THE SERVICE OR AI OUTPUT WILL BE UNINTERRUPTED, ERROR-FREE, OR ACCURATE.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, VIBEKIT WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. VIBEKIT'S TOTAL CUMULATIVE LIABILITY FOR ANY CLAIM RELATED TO THE SERVICE IS LIMITED TO THE GREATER OF (A) THE AMOUNT YOU PAID VIBEKIT IN THE TWELVE MONTHS PRECEDING THE CLAIM, OR (B) USD $50.
You agree to indemnify and hold VibeKit harmless from any third-party claim arising out of (a) Your Content, (b) your use of the Service, (c) your breach of these Terms, (d) your representations about BYOK credentials in Section 4a, or (e) your violation of any third-party provider's terms via the Service.
These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws principles. Any dispute will be brought exclusively in the state or federal courts located in Delaware, and you consent to that jurisdiction. Nothing in this section prevents either party from seeking injunctive relief in a court of competent jurisdiction.
We may update these Terms. Material changes will be announced on the platform with reasonable notice (typically 30 days for paying users). Continued use of the Service after the effective date constitutes acceptance.
Questions about these Terms? Email [email protected].