Terms of Service

1. What FactorCat is

FactorCat is a multi-factor authentication (MFA) platform operated by FactorCat ("we," "us," "our"). It stores TOTP tokens, delivers approval notifications to your phone, and auto-fills authentication codes in your browser. FactorCat does not store passwords.

2. Acceptance

By creating an account or using FactorCat, you agree to these terms and our Privacy Policy. If you don't agree, don't use the service.

3. Age requirement

FactorCat is intended for users aged 16 and older. By using the service, you confirm that you are at least 16. If you are between 16 and 18 (or the age of majority in your jurisdiction), you confirm that a parent or guardian has reviewed and consented to these terms.

4. Accounts

• You must provide a valid email address via a supported OAuth provider (Google, Apple, or Microsoft).
• You are responsible for maintaining access to your OAuth provider account.
• One account per person. Accounts are not transferable.
• You may use FactorCat without an account (anonymous mode, local TOTP only). These terms apply in full once you create an account.

5. What you can do

• Store TOTP factors and associated metadata
• Use the mobile app, browser extension, and web dashboard
• Use Cloud Vault or Locked Vault encryption
• Share factors with other FactorCat users (subject to plan limits)
• Export your factor metadata via the API
• Delete your account and all data at any time

6. What you must not do

• Use FactorCat to facilitate unauthorized access to systems you don't own
• Attempt to extract, reverse-engineer, or tamper with other users' encrypted data
• Abuse the API beyond reasonable use (rate limits are enforced)
• Resell access to the service
• Use the service in violation of any applicable law

7. Encryption modes and your responsibilities

Cloud Vault

Secrets encrypted with a server-managed key. FactorCat can decrypt them for features like the web dashboard and phone-offline fallback. We are responsible for the security of the key.

Locked Vault

Secrets encrypted with a key derived from your master key. We store encrypted blobs we cannot read. You are responsible for your master key and Emergency Kit. If you lose both your phone and Emergency Kit, your Locked Vault factors are irrecoverable. FactorCat cannot help you.

8. Service availability

We run on Cloudflare's global infrastructure and aim for high availability, but do not guarantee a specific uptime percentage outside of Enterprise SLA agreements. We may perform maintenance with reasonable notice, and may suspend accounts that abuse rate limits or degrade service.

9. Billing

• Free tier requires no payment.
• Pro and Team plans are billed annually via Stripe.
• Prices may change with 30 days' notice. Existing subscriptions are honored through their current term.
• Refunds are handled on a case-by-case basis. Contact hello@factorcat.com.
• Supporter contributions are voluntary and non-refundable.

10. Data and privacy

Your data is handled as described in our Privacy Policy. We do not sell your data, do not use it for advertising, and you can delete everything at any time.

11. Intellectual property

• FactorCat owns the service, software, brand, and documentation.
• You own your data (factor metadata, encrypted secrets, account information).
• You grant FactorCat a limited license to process your data solely to provide the service. This license terminates when you delete your account.

12. Limitation of liability

FactorCat is provided "as is." To the maximum extent permitted by law:

• We are not liable for indirect, incidental, or consequential damages.
• We are not liable for loss of access to accounts protected by FactorCat. You should always retain original recovery codes from each service.
• Our total liability is limited to the amount you paid us in the 12 months preceding the claim.

Nothing in these terms excludes liability for death or personal injury caused by our negligence, fraud, or any liability that cannot be excluded under applicable law (including consumer protection laws in the EEA, UK, and Canada).

13. Account termination

• By you: Delete your account at any time via Settings → Account → Delete Account, or via the web fallback. Permanent.
• By us: We may terminate accounts that violate these terms, with notice where practicable. We will not terminate for inactivity without 90 days' notice.

Upon termination by us, you may request a data export within 30 days.

14. Changes to these terms

Material changes will be communicated via in-app notification or email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

15. Governing law

These terms are governed by the laws of the State of Delaware, United States. If you are in the EEA, UK, or Canada, nothing in these terms affects your rights under mandatory consumer protection laws. Disputes will be resolved in the courts of your country of residence if required by applicable law.

16. Contact

General: hello@factorcat.com
Privacy: privacy@factorcat.com
Security: security@factorcat.com