diff --git a/apps/marketing/src/components/LegalPage.astro b/apps/marketing/src/components/LegalPage.astro new file mode 100644 index 00000000000..eb824039e98 --- /dev/null +++ b/apps/marketing/src/components/LegalPage.astro @@ -0,0 +1,414 @@ +--- +import Layout from "../layouts/Layout.astro"; + +interface Props { + readonly title: string; + readonly description: string; + readonly heading: string; + readonly lede: string; + readonly effectiveDate: string; + readonly lastUpdated: string; + readonly sections: ReadonlyArray; +} + +const { title, description, heading, lede, effectiveDate, lastUpdated, sections } = Astro.props; +--- + + +
+ All legal documents +
+

T3 Tools, Inc. / Legal

+

{heading}

+

{lede}

+
+
+
Effective Date
+
{effectiveDate}
+
+
+
Last Updated
+
{lastUpdated}
+
+
+
+ + + +
+ + +
+ +
+
+
+ + + + + diff --git a/apps/marketing/src/layouts/Layout.astro b/apps/marketing/src/layouts/Layout.astro index 5d9fc4e8f3b..9c454c4b78b 100644 --- a/apps/marketing/src/layouts/Layout.astro +++ b/apps/marketing/src/layouts/Layout.astro @@ -4,11 +4,13 @@ import { GITHUB_REPOSITORY_URL, MARKETING_STATS } from "../lib/site"; interface Props { title?: string; description?: string; + pageClass?: string; } const { title = "T3 Code", description = "T3 Code — The open-source control plane for coding agents.", + pageClass, } = Astro.props; --- @@ -30,7 +32,7 @@ const { {title} -
+
@@ -279,7 +284,7 @@ const { min-height: 100vh; display: flex; flex-direction: column; - overflow-x: hidden; + overflow-x: clip; } .nav { @@ -402,6 +407,8 @@ const { .footer-links { display: flex; + flex-wrap: wrap; + justify-content: flex-end; gap: 20px; } @@ -421,6 +428,28 @@ const { padding-left: 20px; padding-right: 20px; } + + .legal-document-page .nav { + display: none; + } + + .footer { + padding-bottom: max(32px, env(safe-area-inset-bottom)); + } + + .footer-inner { + align-items: flex-start; + flex-direction: column; + gap: 28px; + } + + .footer-links { + display: grid; + grid-template-columns: repeat(3, minmax(0, 1fr)); + width: 100%; + gap: 14px 20px; + justify-content: initial; + } } @media (max-width: 420px) { diff --git a/apps/marketing/src/pages/legal.astro b/apps/marketing/src/pages/legal.astro new file mode 100644 index 00000000000..d75413a8da7 --- /dev/null +++ b/apps/marketing/src/pages/legal.astro @@ -0,0 +1,172 @@ +--- +import Layout from "../layouts/Layout.astro"; + +const documents = [ + { + number: "01", + title: "Privacy Policy", + description: "How T3 Code handles information, connected services, and your privacy choices.", + href: "/privacy-policy", + }, + { + number: "02", + title: "Terms of Service", + description: "The terms that govern your use of T3 Code and T3 Tools-operated services.", + href: "/terms-of-service", + }, + { + number: "03", + title: "Security Policy", + description: "Our security practices, responsible disclosure process, and shared responsibilities.", + href: "/security-policy", + }, +] as const; +--- + + +
+
+

T3 Tools, Inc. / Legal

+

Legal

+

Policies and terms for T3 Code, collected in one place.

+
+ + +
+ + + diff --git a/apps/marketing/src/pages/privacy-policy.astro b/apps/marketing/src/pages/privacy-policy.astro new file mode 100644 index 00000000000..b85bc0b12b4 --- /dev/null +++ b/apps/marketing/src/pages/privacy-policy.astro @@ -0,0 +1,445 @@ +--- +import LegalPage from "../components/LegalPage.astro"; + +const sections = [ + ["introduction", "Introduction"], + ["information", "Personal information we collect"], + ["uses", "How we use your personal information"], + ["sharing", "How we share your personal information"], + ["choices", "Your choices regarding your personal information"], + ["security", "Security of your personal information"], + ["international", "International users"], + ["children", "Children"], + ["do-not-track", "Do Not Track"], + ["updates", "Updates to this Privacy Policy"], + ["contact", "Contact us"], +] as const; +--- + + +
+

01

+

Introduction

+

+ This Privacy Policy (the “Policy”) describes how T3 Tools, Inc. (the “Company,” “T3 + Tools,” “we,” or “us”) collects, uses, and shares personal information when you use the T3 + Code desktop and mobile applications, the hosted T3 Code web application located at + {" "}https://app.t3.codes, or the optional T3 Connect + service (together, the “Services”), or visit the T3 Code marketing website located at + {" "}https://t3.codes (the “Site”). This Policy applies to + personal information we collect through the Site and the Services, as well as personal + information you provide to us directly. +

+

+ By using the Site or the Services, you acknowledge the practices described in this + Policy. If you do not agree with this Policy, please do not use the Site or the Services. + This Policy does not govern third-party coding agents, artificial-intelligence providers, + identity providers, or environments that you choose to connect to T3 Code; those third + parties process information under their own terms and privacy policies. +

+
+ +
+

02

+

Personal Information We Collect

+ +

+ We collect personal information about you in different ways depending on how you use + T3 Code and which optional features you enable. +

+ +

Personal Information From Users of T3 Code

+ +

+ When you use T3 Code, we may collect the following categories of personal information: +

+
    +
  • + Account information. If you create or sign in to a T3 account, we + receive general identifiers and profile information from our authentication provider + and the identity provider you select. This may include your name, email address, + profile image, user ID, sign-in method, and authentication credentials or tokens. +
    • +
  • + Environment and device information. If you enable T3 Connect, we + process information needed to connect and secure your environments and devices, + including identifiers, labels you assign, public keys, connection endpoints, + credential hashes, connection status, app and operating-system versions, and + notification preferences. +
    • +
  • + Agent activity and notifications. If you enable notifications or Live + Activities, we process push tokens and limited activity information needed to provide + those features, such as project and thread titles, model name, status, and activity + headline. +
    • +
  • + Information you provide to us. We collect information that you choose + to provide when you request support, send feedback, or otherwise communicate with us. +
    • +
+ +

Personal Information From Users of Our Site Generally

+

+ When you visit the Site or use online portions of the Services, we and our service + providers may automatically log online identifiers and internet-activity information, + including your Internet Protocol (IP) address, device and operating-system type, browser + or app type and version, pages viewed, access times, request timestamps, connection + events, latency, error details, and diagnostic traces. The amount of information we + collect depends on the Services you use and your device and browser settings. +

+

+ We use operational and diagnostic information to provide, secure, maintain, and + troubleshoot the Services, not for targeted advertising. +

+ +

Information We Get From Others

+

+ We may receive personal information from service providers that help us operate the + Services, such as authentication and identity providers, app stores, device-platform + providers, and coding-agent providers you choose to use. We may combine this information + with information we collect through the Site and the Services. +

+ +

Cookies and Local Storage

+

+ The Site and online portions of the Services may use cookies or similar technologies to + operate essential features, maintain sessions, remember preferences, and understand + whether the Services are functioning correctly. T3 Code also stores connection settings, + credentials, preferences, drafts, and cached thread, file, branch, and server metadata on + your device. Credentials and session tokens use platform-provided protected storage where + supported. Information stored only on your device is not collected by T3 Tools unless it + is transmitted as part of a feature you use. +

+ +

Device Permissions

+
    +
  • + Camera. Used when you choose to scan a pairing QR code. Camera frames + are processed on your device. +
    • +
  • + Photos and files. Items you select are accessed only to preview them or + attach them to a request you initiate. +
    • +
  • + Notifications. Used only if you enable agent-status notifications or + Live Activities. +
    • +
  • + Local network. Used to discover or connect to T3 Code environments + accessible from your machine over the network. +
    • +
+
+ +
+

03

+

How We Use Your Personal Information

+

+ Subject to this Policy and applicable terms governing third-party applications and + services, we may use personal information for the following purposes: +

+
    +
  • To establish and verify your identity and authenticate your account;
    • +
  • To link and protect devices and environments and deliver optional notifications;
    • +
  • To process and fulfill requests you make through the Services;
    • +
  • To provide customer service and respond to support requests and feedback;
    • +
  • To communicate with you about the Services and your relationship with us;
    • +
  • To monitor reliability, prevent abuse, and investigate security incidents;
    • +
  • To comply with applicable law and enforce the terms governing the Services; and
    • +
  • + To analyze and improve T3 Code using aggregated, de-identified, or other anonymous + operational information. +
    • +
+ +

Training of AI Models

+

+ We do not use your personal information, source code, prompts, or agent responses to + train artificial-intelligence models. +

+ +

Compliance and Protection

+

We may use personal information to:

+
    +
  • Comply with applicable laws, lawful requests, and legal process;
    • +
  • Protect the rights, privacy, safety, and property of T3 Tools, our users, and others;
    • +
  • Audit our internal processes for legal, contractual, and policy compliance;
    • +
  • Enforce the terms and conditions that govern the Site and the Services; and
    • +
  • + Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, + unethical, or illegal activity, including cyberattacks and identity theft. +
    • +
+

+ We may also use personal information for other purposes consistent with this Policy or + explained to you when we collect the information. +

+
+ +
+

04

+

How We Share Your Personal Information

+

+ We may disclose the categories of personal information described above to the following + categories of third parties: +

+ +

Providers You Choose

+

+ At your direction, prompts, files, and related content are sent to coding agents and + artificial-intelligence providers configured in your environment. Because you bring and + configure your own coding-agent harness and provider, the applicable third parties vary. + Those providers process information under their own terms and privacy policies. +

+ +

Third-Party Service Providers

+

+ We use third-party service providers to help provide the Services and operate our + business. Depending on the features you use, these providers may include: +

+
    +
  • + Clerk (Clerk, Inc.).
    + We use Clerk to provide account authentication.
    + You can view Clerk's privacy policy here:{" "}https://clerk.com/legal/privacy. +
    • +
  • + Cloudflare (Cloudflare, Inc.).
    + We use Cloudflare for networking, T3 Connect infrastructure, and content delivery.
    + You can view Cloudflare's privacy policy here:{" "}https://www.cloudflare.com/policies/privacy/. +
    • +
  • + PlanetScale (PlanetScale, Inc.).
    + We use PlanetScale to host the database that supports T3 Connect.
    + You can view PlanetScale's privacy policy here:{" "}https://planetscale.com/legal/privacy. +
    • +
  • + Vercel (Vercel Inc.).
    + We use Vercel to host and deploy the T3 Code Site.
    + You can view Vercel's privacy notice here:{" "}https://vercel.com/legal/privacy-notice. +
    • +
  • + Axiom (Axiom, Inc.).
    + We use Axiom for operational diagnostics that help us maintain and troubleshoot the + Services.
    + You can view Axiom's privacy policy here:{" "}https://axiom.co/docs/legal/privacy. +
    • +
  • + Expo (650 Industries, Inc.).
    + We use Expo for application updates and related mobile-app services.
    + You can view Expo's privacy policy here:{" "}https://expo.dev/privacy. +
    • +
  • + Apple (Apple Inc.).
    + We use Apple services for app distribution, optional authentication, and platform + notifications.
    + You can view Apple's privacy policy here:{" "}https://www.apple.com/legal/privacy/. +
    • +
  • + Google (Google LLC).
    + We use Google services for app distribution and optional authentication.
    + You can view Google's privacy policy here:{" "}https://policies.google.com/privacy. +
    • +
+

+ These providers process information for us under their own contractual and privacy + obligations. +

+ +

Affiliates and Professional Advisors

+

+ We may share personal information with our affiliates for purposes consistent with this + Policy and with lawyers, accountants, bankers, and other professional advisors in the + course of the services they provide to us. +

+ +

Corporate Restructuring

+

+ We may share some or all personal information in connection with or during negotiation of + a merger, financing, acquisition, reorganization, bankruptcy, dissolution, sale of + assets, or similar transaction. If another company acquires T3 Tools or its assets, that + company may possess the personal information collected by us and assume the rights and + obligations described in this Policy. +

+ +

Legal and Safety Disclosures

+

+ We may disclose personal information if we believe in good faith that disclosure is + necessary to comply with law or legal process; protect or defend the rights, property, or + safety of T3 Tools, users of the Site or the Services, or others; investigate or prevent + fraud, abuse, or unlawful activity; or enforce this Policy and the terms governing the + Services. We may also share personal information at your direction, with your consent, or + as described to you when the information is collected. +

+ +

No Sale of Personal Information

+

+ We do not sell your personal information or share it for cross-context behavioral or + targeted advertising. +

+ +

Third-Party Websites and Services

+

+ The Site and the Services may contain links to third-party websites or services. When you + follow a third-party link or connect a third-party service, that third party may collect + personal information from you. We do not control and are not responsible for the privacy + practices or content of third parties. +

+
+ +
+

05

+

Your Choices Regarding Your Personal Information

+ +

Account and Connection Choices

+

+ You may use local or direct connections without signing in to a T3 account. You can + disconnect environments, sign out, disable optional notifications and Live Activities, + and clear local caches from Settings. You can grant or revoke camera, photo, local-network, + and notification permissions in your device settings. +

+ +

Cookies and Local Data

+

+ You can use your browser settings to stop accepting or to delete cookies, although some + portions of the Site or the Services may not function correctly as a result. Information + stored only on your device remains there until you clear it, remove the relevant + connection, or uninstall the app. The mobile app provides cache controls under + {" "}Settings → App → Client Storage. +

+ +

Retention and Deletion

+

+ We retain account, environment-link, device-registration, notification, and security + information while your account or the relevant feature is active and for as long as + reasonably necessary to provide the Services, protect them from abuse, comply with law, + and resolve disputes. Operational diagnostic traces are configured to expire after 30 + days. Some records may remain longer in backups or where retention is required for + security, fraud prevention, or legal compliance. +

+

+ To request deletion of your T3 account and associated T3 Connect data, email{" "}privacy@t3.tools{" "}from the email address associated with your account. We may need to verify your + identity. Deleting a T3 account does not delete information held by an environment or + coding-agent provider you control; contact those providers or delete that information + directly. +

+ +

Your Privacy Rights

+

+ Depending on where you live, you may have rights to request access to, correction of, + deletion of, or a portable copy of your personal information, or to restrict or object + to certain processing. You may also have the right to appeal our response or complain to + a data-protection authority. We will honor applicable rights after verifying your + request. +

+
+ +
+

06

+

Security of Your Personal Information

+

+ T3 Tools is committed to protecting the security of your personal information. We use + administrative, technical, and organizational safeguards designed to protect personal + information from unauthorized access, use, or disclosure. These safeguards include + encrypted network transport, scoped and proof-bound access tokens for supported + connection flows, protected credential storage, and redaction of authorization headers + from relay diagnostics. +

+

+ No method of transmission over the Internet or method of electronic storage is completely + secure. While we use reasonable efforts to protect personal information, we cannot + guarantee its absolute security. You are responsible for securing the environments, + coding-agent accounts, credentials, and networks that you connect to T3 Code. +

+
+ +
+

07

+

International Users

+

+ The Site and the Services are provided from the United States and are governed by United + States law. If you use the Site or the Services from outside the United States, your + personal information may be transferred to and processed in the United States and other + countries where we or our service providers operate. Where required, we use lawful + safeguards for international transfers of personal information. +

+
+ +
+

08

+

Children

+

+ The Site and the Services are not intended for children under 13 years of age, and you + must be at least 13 years old to use them. We do not knowingly collect, use, or disclose + personal information from children under 13. If you believe a child under 13 has provided + us with personal information, please contact us so that we can take appropriate action. +

+
+ +
+

09

+

Do Not Track

+

+ We currently do not respond to browser “Do Not Track” signals. T3 Code does not use + personal information for cross-context behavioral or targeted advertising. +

+
+ +
+

10

+

Updates to This Privacy Policy

+

+ We reserve the right to update this Policy from time to time. If we make material changes, + we will post the revised Policy at this URL, update the “Last Updated” and “Effective Date” + above, and provide any additional notice required by law. Except as otherwise indicated, + changes become effective when the revised Policy is posted. +

+
+ +
+

11

+

Contact Us

+

+ If you have questions about this Policy or wish to make a privacy or deletion request, + please contact us at: +

+
+ T3 Tools, Inc.
+ 2261 Market Street #5309
+ San Francisco, CA 94114
+ United States +
+ privacy@t3.tools +
+ diff --git a/apps/marketing/src/pages/security-policy.astro b/apps/marketing/src/pages/security-policy.astro new file mode 100644 index 00000000000..c9b05ec36fd --- /dev/null +++ b/apps/marketing/src/pages/security-policy.astro @@ -0,0 +1,187 @@ +--- +import LegalPage from "../components/LegalPage.astro"; + +const sections = [ + ["introduction", "Introduction"], + ["reporting", "Reporting security issues"], + ["safe-harbor", "Responsible research and safe harbor"], + ["practices", "Our security practices"], + ["responsibilities", "Your responsibilities"], + ["updates", "Updates to this policy"], + ["contact", "Contact us"], +] as const; +--- + + +
+

01

+

Introduction

+

+ This Security Policy describes the vulnerability-reporting process and security practices for + the T3 Code desktop and mobile applications, the hosted application at{" "}https://app.t3.codes, the optional T3 Connect service, and the T3 Code website at{" "}https://t3.codes. +

+

+ T3 Code connects software running on your devices and in environments you control with + coding-agent harnesses and providers you choose. We secure the software and infrastructure + operated by T3 Tools, but we do not control the security of your devices, environments, + repositories, networks, credentials, or third-party providers. Please review the shared + responsibilities below when assessing risk. +

+
+ +
+

02

+

Reporting Security Issues

+

+ If you believe you have found a security vulnerability affecting T3 Code or T3 Tools-operated + infrastructure, email{" "}security@ping.gg. Please do not + disclose the issue publicly until we have had a reasonable opportunity to investigate and + remediate it. +

+

Please include, when available:

+
    +
  • A description of the issue and its potential impact;
    • +
  • The affected application, version, URL, endpoint, or component;
    • +
  • Clear reproduction steps or a minimal proof of concept;
    • +
  • Relevant logs, screenshots, or request and response details with secrets removed; and
    • +
  • Your preferred contact information and whether you want public credit.
    • +
+

+ We aim to acknowledge complete reports within one business day, keep reporters informed of + material progress, and coordinate disclosure after a fix is available. Resolution time varies + with severity, complexity, and dependencies on third parties. +

+
+ +
+

03

+

Responsible Research and Safe Harbor

+

+ We support good-faith security research. If you make a genuine effort to comply with this + policy, avoid harm, respect privacy, and report findings promptly, we will treat your research + as authorized and will not initiate legal action against you for accidental, good-faith + violations of this policy. If a third party initiates legal action concerning compliant + research, we will make our authorization known where appropriate. +

+

To remain within this safe harbor, you must:

+
    +
  • Test only accounts, data, and systems you own or have explicit permission to test;
    • +
  • Stop and report immediately if you encounter personal, confidential, or production data;
    • +
  • Access only the minimum information needed to demonstrate the issue;
    • +
  • Avoid disrupting availability, degrading performance, or damaging or deleting data;
    • +
  • Not use social engineering, phishing, physical attacks, or denial-of-service testing;
    • +
  • Not test third-party services or infrastructure outside T3 Tools’ control; and
    • +
  • Give us reasonable time to address the issue before public disclosure.
    • +
+

+ This safe harbor does not authorize violations of law or activity outside the scope of this + policy. Vulnerability rewards are not guaranteed and, if offered, are determined by T3 Tools + in its discretion. +

+
+ +
+

04

+

Our Security Practices

+

+ We use administrative, technical, and organizational safeguards designed for the nature of T3 + Code and the information processed by T3 Tools-operated services. These practices include: +

+
    +
  • + Data minimization. T3 Code is designed so coding-session content can remain + between your clients, your environment, and the harnesses and providers you configure. We + process information through T3 Tools-operated infrastructure only when needed for a feature + you enable. +
    • +
  • + Encrypted transport. T3 Tools-operated network services use encrypted + transport. Supported connection flows use scoped credentials and security controls designed + to reduce unauthorized reuse. +
    • +
  • + Credential protection. T3 Code uses platform-provided protected storage for + credentials and session tokens where supported. We design operational logging to avoid + collecting secrets that are not needed to operate or troubleshoot the Services. +
    • +
  • + Access controls. Access to production systems and operational data is limited + according to job responsibilities and protected using authentication and authorization + controls. +
    • +
  • + Maintenance and monitoring. We monitor T3 Tools-operated services for + reliability and security events, review dependencies, and deploy updates and mitigations as + appropriate. +
    • +
  • + Established providers. We use specialized providers for services such as + authentication, hosting, and application distribution and evaluate the controls relevant to + their role. +
    • +
+

+ No system is completely secure. These practices reduce risk but do not guarantee that the Site + or Services will be free from vulnerabilities or unauthorized access. +

+
+ +
+

05

+

Your Responsibilities

+

+ Because you control much of the T3 Code execution path, you play an important role in securing + it. You are responsible for: +

+
    +
  • Keeping T3 Code, your operating systems, and connected tools up to date;
    • +
  • Securing your devices, repositories, environments, networks, and backups;
    • +
  • Protecting account, provider, repository, and environment credentials;
    • +
  • Using multi-factor authentication where your identity and coding-agent providers support it;
    • +
  • Granting providers and integrations only the permissions they need;
    • +
  • Reviewing commands, source changes, and other agent output before applying or executing it;
    • +
  • Removing lost or unused devices and revoking credentials you believe may be compromised; and
    • +
  • Following the security policies of your selected harnesses, providers, and infrastructure.
    • +
+

+ Do not send passwords, API keys, access tokens, or private keys in a vulnerability report. + Revoke any secret that may have been exposed before sharing sanitized evidence with us. +

+
+ +
+

06

+

Updates to This Policy

+

+ We may update this Security Policy as T3 Code, our infrastructure, and security practices + evolve. We will post revisions at this URL and update the dates above. Material changes to the + vulnerability-reporting process or safe-harbor terms will apply prospectively. +

+
+ +
+

07

+

Contact Us

+

+ Report security issues or ask security-related questions at{" "}security@ping.gg. +

+

+ For general legal questions, contact{" "}legal@t3.tools. + For privacy requests, contact{" "}privacy@t3.tools. +

+
+ diff --git a/apps/marketing/src/pages/terms-of-service.astro b/apps/marketing/src/pages/terms-of-service.astro new file mode 100644 index 00000000000..e6de5f2c751 --- /dev/null +++ b/apps/marketing/src/pages/terms-of-service.astro @@ -0,0 +1,396 @@ +--- +import LegalPage from "../components/LegalPage.astro"; + +const sections = [ + ["introduction", "Introduction"], + ["accounts", "Accounts"], + ["content", "Your content and providers"], + ["rights", "T3 Code and proprietary rights"], + ["acceptable-use", "Acceptable use"], + ["availability", "Availability and changes"], + ["fees", "Fees"], + ["privacy", "Privacy"], + ["termination", "Suspension and termination"], + ["beta", "Beta services"], + ["disclaimers", "Disclaimers"], + ["liability", "Limitation of liability"], + ["indemnification", "Indemnification"], + ["copyright", "Copyright complaints"], + ["third-parties", "Third-party services"], + ["feedback", "Feedback"], + ["disputes", "Dispute resolution"], + ["miscellaneous", "Miscellaneous"], + ["changes", "Changes to these Terms"], + ["contact", "Contact us"], +] as const; +--- + + +
+

01

+

Introduction

+

+ These Terms of Service (the “Terms”) are a binding agreement between you and T3 Tools, Inc. + (“T3 Tools,” “we,” “us,” or “our”). They govern your access to and use of the T3 Code desktop + and mobile applications, the hosted T3 Code application at{" "}https://app.t3.codes, and the optional T3 Connect service (together, the “Services”), as well as the T3 Code + marketing website at{" "}https://t3.codes (the “Site”). +

+

+ By accessing or using the Site or Services, you agree to these Terms. If you use the Services + for an organization, you represent that you have authority to bind that organization, and + “you” includes the organization. If you do not agree to these Terms, do not use the Site or + Services. +

+

+ You must be at least 13 years old to use the Site or Services. If the law where you live + requires a greater age to enter into these Terms, you must meet that requirement or have a + parent or legal guardian agree on your behalf. +

+
+ +
+

02

+

Accounts

+

+ You can use some T3 Code features without creating a T3 account. An account may be required + for account-backed features, including T3 Connect. You agree to provide accurate account + information, keep your credentials secure, and promptly notify us if you suspect unauthorized + access. You are responsible for activity performed through your account and connected devices, + except to the extent caused by our failure to use reasonable security measures. +

+

+ You may not share credentials in a way that compromises the Services, impersonate another + person, or create accounts through unauthorized automated means. We may require reasonable + verification before restoring access or acting on an account request. +

+
+ +
+

03

+

Your Content and Providers

+

+ T3 Code can help you send prompts, source files, images, attachments, review comments, and + instructions to coding-agent harnesses and providers you choose, and display their responses, + command output, file changes, source code, and diffs (collectively, “User Content”). You retain + all rights you have in your User Content. +

+

+ You bring and configure your own coding-agent harness and provider. Your User Content is + ordinarily processed in the environment you control and by the providers you select, not by + T3 Tools. When you enable a T3 Tools-operated feature that must transmit or process User + Content, you grant us a limited, non-exclusive license to host, transmit, reproduce, and + process that content only as reasonably necessary to provide, secure, and troubleshoot that + feature. This license ends when the content is no longer needed for those purposes, subject to + reasonable backup, security, and legal-retention requirements. +

+

+ You represent that you have the rights and permissions needed to use and submit User Content + and to direct its processing by your selected harnesses and providers. You are responsible for + reviewing those providers’ terms, privacy practices, data controls, and output before using + them with confidential, proprietary, regulated, or personal information. +

+
+ +
+

04

+

T3 Code and Proprietary Rights

+

+ T3 Tools and its licensors own the Site, the Services, and their branding, designs, hosted + infrastructure, documentation, and other materials, excluding User Content and third-party + materials. These Terms do not transfer ownership of either party’s intellectual property. +

+

+ Portions of T3 Code are available as open-source software. Your use, copying, modification, and + distribution of that source code are governed by the license included with the applicable + repository or component. These Terms govern your use of the hosted Services and do not limit + rights granted to you by an applicable open-source license. +

+

+ Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable right + to access and use the Services for lawful personal or internal business purposes. You may not + use our trademarks, service marks, or trade dress without written permission. +

+
+ +
+

05

+

Acceptable Use

+

You may not use the Site or Services to:

+
    +
  • Violate applicable law or another person’s rights;
    • +
  • Upload, transmit, or generate content you do not have the right to use;
    • +
  • Distribute malware, exploit code, or harmful content except in authorized security work;
    • +
  • Probe, attack, disrupt, or gain unauthorized access to the Services or another system;
    • +
  • Bypass rate limits, access controls, security measures, or usage restrictions;
    • +
  • Interfere with other users or place an unreasonable load on shared infrastructure;
    • +
  • Use the Services to facilitate fraud, harassment, abuse, or deceptive conduct; or
    • +
  • Misrepresent that output or activity from a third-party agent was produced or endorsed by us.
    • +
+

+ Authorized security research must follow our{" "}Security Policy. + We may investigate suspected violations and take proportionate action to protect users and the + Services. +

+
+ +
+

06

+

Availability and Changes

+

+ We may add, change, suspend, or discontinue features, integrations, or supported platforms. We + aim to provide reasonable notice when a change materially reduces an account-backed feature, + but urgent security, legal, or reliability changes may take effect immediately. The Services + may be unavailable because of maintenance, provider outages, network conditions, or events + outside our control. +

+

+ T3 Code depends on software, environments, networks, and coding-agent providers that you + configure or that third parties operate. We do not control their availability, compatibility, + pricing, or behavior. +

+
+ +
+

07

+

Fees

+

+ T3 Code is currently offered without a T3 Tools subscription fee unless we clearly state + otherwise for a feature. You remain responsible for charges from your coding-agent providers, + cloud infrastructure, network operators, app stores, and other third parties. If we introduce + a paid feature, we will present its price and applicable payment terms before you purchase it. +

+
+ +
+

08

+

Privacy

+

+ Our{" "}Privacy Policy explains how T3 Tools collects, uses, and + shares personal information when you use the Site and Services. Third-party environments, + harnesses, identity providers, and coding-agent providers process information under their own + terms and privacy policies. +

+
+ +
+

09

+

Suspension and Termination

+

+ You may stop using the Services at any time. You may disconnect environments and devices from + within T3 Code and may request deletion of an account as described in our Privacy Policy. +

+

+ We may suspend or terminate access to account-backed or hosted features if we reasonably + believe you materially violated these Terms, created a security or legal risk, failed to pay an + applicable fee, or used the Services in a way that could harm other users or shared + infrastructure. When practicable, we will give notice and an opportunity to cure. We may act + immediately where needed to prevent harm or comply with law. +

+

+ Provisions that by their nature should survive termination—including ownership, disclaimers, + limitations of liability, indemnification, and dispute terms—will survive. +

+
+ +
+

10

+

Beta Services

+

+ T3 Code is an early-stage product, and some or all features may be identified as alpha, beta, + preview, experimental, or pre-release (“Beta Services”). Beta Services may be incomplete, + change without notice, contain errors, or lose data. Do not rely on Beta Services as the sole + copy of important work, and review proposed commands and file changes before applying them. +

+
+ +
+

11

+

Disclaimers

+

+ TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SITE AND SERVICES ARE PROVIDED “AS IS” AND “AS + AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. +

+

+ Coding agents and artificial-intelligence systems can produce incorrect, insecure, incomplete, + or harmful output. You are responsible for reviewing output, commands, patches, and other + actions before relying on or executing them. We do not warrant that the Services or third-party + output will be uninterrupted, secure, accurate, error-free, or suitable for your purpose. +

+

+ Some jurisdictions do not allow certain warranty exclusions, so some of the foregoing may not + apply to you. +

+
+ +
+

12

+

Limitation of Liability

+

+ TO THE MAXIMUM EXTENT PERMITTED BY LAW, T3 TOOLS AND ITS AFFILIATES, OFFICERS, EMPLOYEES, + AGENTS, AND LICENSORS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, + EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS + OPPORTUNITIES, ARISING FROM OR RELATED TO THE SITE, SERVICES, OR THESE TERMS. +

+

+ To the maximum extent permitted by law, our aggregate liability for all claims arising from or + relating to the Site, Services, or these Terms will not exceed the greater of $100 or the amount + you paid directly to T3 Tools for the Services during the 12 months before the event giving rise + to the claim. These limitations apply regardless of the legal theory and even if a remedy fails + of its essential purpose. They do not limit liability that cannot lawfully be limited. +

+
+ +
+

13

+

Indemnification

+

+ To the extent permitted by law, you will defend, indemnify, and hold harmless T3 Tools and its + affiliates, officers, employees, and agents from third-party claims, damages, losses, and + reasonable legal fees arising from your User Content, your use of the Site or Services in + violation of these Terms or law, or your infringement of another person’s rights. We will + promptly notify you of a covered claim and reasonably cooperate in its defense. You may not + settle a claim in a way that admits fault by or imposes obligations on us without our written + consent. +

+
+ + + +
+

15

+

Third-Party Services

+

+ The Services may connect to or display content from third-party coding agents, model providers, + identity providers, repositories, app stores, websites, and infrastructure. Your use of those + services is governed by their terms. We do not endorse or control third-party services and are + not responsible for their content, security, availability, output, or data practices. +

+

+ Third-party and open-source software included with T3 Code is governed by its applicable + license notices. Where those licenses conflict with these Terms for that software, the + applicable open-source license controls. +

+
+ +
+

16

+

Feedback

+

+ If you send us ideas, suggestions, or other feedback about T3 Code, you grant T3 Tools a + perpetual, irrevocable, worldwide, royalty-free right to use and commercialize that feedback + without restriction or compensation. This does not transfer ownership of your User Content. +

+
+ +
+

17

+

Dispute Resolution

+

+ PLEASE READ THIS SECTION CAREFULLY. IT REQUIRES MOST DISPUTES TO BE RESOLVED BY INDIVIDUAL + BINDING ARBITRATION AND WAIVES JURY TRIALS AND CLASS OR REPRESENTATIVE ACTIONS. +

+

Informal Resolution

+

+ Before starting arbitration or a court proceeding, the party raising a dispute must send a + written notice describing the dispute and requested relief. Notices to us must be sent to{" "}legal@t3.tools. The parties will try in good faith to resolve the dispute for at least 30 days. +

+

Binding Arbitration

+

+ Except for disputes eligible for small-claims court and requests for injunctive relief to + protect intellectual property or prevent unauthorized access, unresolved disputes will be + resolved by binding individual arbitration administered by JAMS under its applicable consumer + or comprehensive rules. The Federal Arbitration Act governs this agreement. Arbitration may + take place remotely unless the arbitrator determines that an in-person hearing is necessary. +

+

No Class Actions

+

+ Disputes must be brought only on an individual basis. Neither party may participate in a class, + collective, consolidated, or representative action or arbitration to the extent permitted by + law. +

+

Opt Out

+

+ You may opt out of this arbitration agreement by emailing{" "}legal@t3.tools within 30 days after you first accept these Terms. Include your name, the email associated + with your account if any, and a clear statement that you opt out of arbitration. +

+

+ If the arbitration agreement does not apply, exclusive jurisdiction and venue will lie in the + state and federal courts located in San Francisco County, California, and each party consents + to those courts. +

+
+ +
+

18

+

Miscellaneous

+

+ California law governs these Terms without regard to conflict-of-law principles, except that + the Federal Arbitration Act governs the arbitration provisions. These Terms and documents + incorporated by reference are the entire agreement between you and us regarding the Site and + Services. If a provision is unenforceable, it will be modified to the minimum extent necessary + or severed, and the remaining provisions will continue in effect. +

+

+ Our failure to enforce a provision is not a waiver. You may not assign these Terms without our + written consent. We may assign them in connection with a merger, acquisition, reorganization, + or sale of assets. We are not liable for delays or failures caused by events beyond our + reasonable control. Headings are for convenience only, and “including” means “including without + limitation.” +

+
+ +
+

19

+

Changes to These Terms

+

+ We may update these Terms from time to time. We will post updated Terms at this URL and update + the dates above. If a change materially affects your rights, we will provide additional notice + when reasonably practicable or as required by law. Changes apply prospectively from their + effective date. Your continued use of the Site or Services after that date means you accept the + updated Terms. +

+
+ +
+

20

+

Contact Us

+

If you have questions about these Terms, contact us at:

+
+ T3 Tools, Inc.
+ 2261 Market Street #5309
+ San Francisco, CA 94114
+ United States +
+ legal@t3.tools +
+ diff --git a/apps/mobile/package.json b/apps/mobile/package.json index 0bc0daecafc..1f87560c8ca 100644 --- a/apps/mobile/package.json +++ b/apps/mobile/package.json @@ -5,7 +5,7 @@ "main": "index.ts", "scripts": { "dev": "expo start --clear", - "dev:client": "APP_VARIANT=development expo start --dev-client --scheme t3code-dev --clear --localhost", + "dev:client": "APP_VARIANT=development expo start --dev-client --scheme t3code-dev --clear --lan", "dev:client:preview": "eas env:exec preview 'EXPO_NO_DOTENV=1 APP_VARIANT=preview expo start --dev-client --scheme t3code-preview --clear --lan'", "start": "expo start", "start:dev": "APP_VARIANT=development expo start", diff --git a/apps/mobile/src/Stack.tsx b/apps/mobile/src/Stack.tsx index 73c9ee9414a..c2abb50c559 100644 --- a/apps/mobile/src/Stack.tsx +++ b/apps/mobile/src/Stack.tsx @@ -44,8 +44,13 @@ import { SettingsAppearanceRouteScreen } from "./features/settings/SettingsAppea import { SettingsClientStorageRouteScreen } from "./features/settings/SettingsClientStorageRouteScreen"; import { SettingsAuthRouteScreen } from "./features/settings/SettingsAuthRouteScreen"; import { SettingsEnvironmentsRouteScreen } from "./features/settings/SettingsEnvironmentsRouteScreen"; +import { SettingsLegalRouteScreen } from "./features/settings/SettingsLegalRouteScreen"; import { SettingsRouteScreen } from "./features/settings/SettingsRouteScreen"; import { SettingsWaitlistRouteScreen } from "./features/settings/SettingsWaitlistRouteScreen"; +import { + SettingsLegalDocumentCloseHeaderButton, + SettingsLegalDocumentExternalHeaderButton, +} from "./features/settings/components/SettingsLegalDocumentRouteScreen"; import { useAppShortcuts } from "./features/shortcuts/useAppShortcuts"; import { nativeHeaderScrollEdgeEffects } from "./native/StackHeader"; import { useThreadOutboxDrain } from "./state/use-thread-outbox-drain"; @@ -106,6 +111,14 @@ const SHEET_SOLID_HEADER_OPTIONS: AppScreenOptions = { unstable_navigationItemStyle: undefined, }; +const LEGAL_DOCUMENT_HEADER_OPTIONS: AppScreenOptions = { + ...SHEET_SOLID_HEADER_OPTIONS, + headerBackVisible: false, + headerLeft: SettingsLegalDocumentCloseHeaderButton, + headerRight: SettingsLegalDocumentExternalHeaderButton, + presentation: "fullScreenModal", +}; + const SettingsSheetStack = createNativeStackNavigator({ initialRouteName: "Settings", screenOptions: { @@ -239,6 +252,7 @@ const WORKSPACE_OVERLAY_ROUTES = new Set([ "GitConfirm", "GitOverview", "NewTaskSheet", + "SettingsLegal", "SettingsSheet", "ThreadReviewComment", ]); @@ -436,6 +450,14 @@ export const RootStack = createNativeStackNavigator({ }), }, }), + SettingsLegal: createNativeStackScreen({ + screen: SettingsLegalRouteScreen, + linking: "settings/legal", + options: { + ...LEGAL_DOCUMENT_HEADER_OPTIONS, + title: "Legal", + }, + }), ConnectOnboarding: createNativeStackScreen({ screen: ConnectOnboardingRouteScreen, linking: "connect-onboarding", diff --git a/apps/mobile/src/features/settings/SettingsLegalRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsLegalRouteScreen.tsx new file mode 100644 index 00000000000..7254186cf4c --- /dev/null +++ b/apps/mobile/src/features/settings/SettingsLegalRouteScreen.tsx @@ -0,0 +1,6 @@ +import { SettingsLegalDocumentRouteScreen } from "./components/SettingsLegalDocumentRouteScreen"; +import { LEGAL_URL } from "./lib/legal-document-url"; + +export function SettingsLegalRouteScreen() { + return ; +} diff --git a/apps/mobile/src/features/settings/SettingsRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsRouteScreen.tsx index 6f87eeeba84..6c67a4d89e8 100644 --- a/apps/mobile/src/features/settings/SettingsRouteScreen.tsx +++ b/apps/mobile/src/features/settings/SettingsRouteScreen.tsx @@ -537,6 +537,7 @@ function AppSettingsSection() { return ( + navigation.goBack()} + className="p-2 active:opacity-60" + > + + + ); +} + +export function SettingsLegalDocumentExternalHeaderButton() { + const iconColor = useThemeColor("--color-icon"); + const route = useRoute>(); + const externalUrl = + route.params?.externalUrl && isLegalDocumentUrl(route.params.externalUrl) + ? route.params.externalUrl + : LEGAL_URL; + + return ( + void Linking.openURL(externalUrl).catch(() => undefined)} + className="p-2 active:opacity-60" + > + + + ); +} + +interface SettingsLegalDocumentRouteScreenProps { + readonly documentName: string; + readonly documentUrl: string; +} + +export function SettingsLegalDocumentRouteScreen({ + documentName, + documentUrl, +}: SettingsLegalDocumentRouteScreenProps) { + const navigation = useNavigation>(); + const iconColor = useThemeColor("--color-icon"); + const [reloadKey, setReloadKey] = useState(0); + const [loadProgress, setLoadProgress] = useState(0); + const [loadError, setLoadError] = useState(null); + + const openExternalUrl = useCallback((url: string) => { + void Linking.openURL(url).catch(() => undefined); + }, []); + if (loadError) { + return ( + + + + + Couldn't load the {documentName.toLowerCase()} + + + {loadError} + + + + { + setLoadError(null); + setReloadKey((value) => value + 1); + }} + className="items-center rounded-xl bg-foreground px-4 py-3 active:opacity-80" + > + Try Again + + openExternalUrl(documentUrl)} + className="items-center rounded-xl px-4 py-3 active:bg-foreground/5" + > + Open in Browser + + + + ); + } + + return ( + + {loadProgress > 0 && loadProgress < 1 ? : null} + { + if (isLegalDocumentUrl(request.url)) return true; + + openExternalUrl(request.url); + return false; + }} + onLoadProgress={(event) => { + setLoadProgress(event.nativeEvent.progress); + }} + onLoadStart={() => { + setLoadProgress(0.05); + setLoadError(null); + }} + onLoadEnd={(event) => { + if (isLegalDocumentUrl(event.nativeEvent.url)) { + navigation.setParams({ externalUrl: event.nativeEvent.url }); + } + setLoadProgress(0); + }} + onError={(event) => { + setLoadProgress(0); + setLoadError(event.nativeEvent.description || "The page could not be loaded."); + }} + onHttpError={(event) => { + if (!isLegalDocumentUrl(event.nativeEvent.url)) return; + setLoadProgress(0); + setLoadError(`The server returned status ${event.nativeEvent.statusCode}.`); + }} + renderLoading={() => ( + + + + )} + style={{ flex: 1, backgroundColor: "transparent" }} + /> + + ); +} diff --git a/apps/mobile/src/features/settings/components/SettingsRow.tsx b/apps/mobile/src/features/settings/components/SettingsRow.tsx index 7c3d9144e1a..2f435c3a47f 100644 --- a/apps/mobile/src/features/settings/components/SettingsRow.tsx +++ b/apps/mobile/src/features/settings/components/SettingsRow.tsx @@ -6,7 +6,7 @@ import { SymbolView } from "../../../components/AppSymbol"; import { AppText as Text } from "../../../components/AppText"; import { useThemeColor } from "../../../lib/useThemeColor"; -import type { SettingsSheetTarget } from "./settings-sheet-targets"; +import type { SettingsLegalDocumentTarget, SettingsSheetTarget } from "./settings-sheet-targets"; type SymbolName = ComponentProps["name"]; @@ -16,6 +16,7 @@ export function SettingsRow(props: { readonly label: string; readonly value?: string; readonly target?: SettingsSheetTarget; + readonly fullScreenTarget?: SettingsLegalDocumentTarget; readonly onPress?: () => void; }) { const navigation = useNavigation(); @@ -72,6 +73,20 @@ export function SettingsRow(props: { ); } + const fullScreenTarget = props.fullScreenTarget; + if (fullScreenTarget) { + return ( + navigation.navigate(fullScreenTarget)} + > + {content} + + ); + } + return ( {content} diff --git a/apps/mobile/src/features/settings/components/settings-sheet-targets.ts b/apps/mobile/src/features/settings/components/settings-sheet-targets.ts index 677dd5e4ed7..71c059bedb4 100644 --- a/apps/mobile/src/features/settings/components/settings-sheet-targets.ts +++ b/apps/mobile/src/features/settings/components/settings-sheet-targets.ts @@ -3,3 +3,5 @@ export type SettingsSheetTarget = | "SettingsArchive" | "SettingsAppearance" | "SettingsClientStorage"; + +export type SettingsLegalDocumentTarget = "SettingsLegal"; diff --git a/apps/mobile/src/features/settings/lib/legal-document-url.test.ts b/apps/mobile/src/features/settings/lib/legal-document-url.test.ts new file mode 100644 index 00000000000..10ce4ca4879 --- /dev/null +++ b/apps/mobile/src/features/settings/lib/legal-document-url.test.ts @@ -0,0 +1,24 @@ +import { describe, expect, it } from "vite-plus/test"; + +import { isLegalDocumentUrl } from "./legal-document-url"; + +describe("isLegalDocumentUrl", () => { + it.each([ + "https://t3.codes/legal", + "https://t3.codes/legal/", + "https://t3.codes/privacy-policy?source=app", + "https://t3.codes/terms-of-service#updates", + "https://t3.codes/security-policy", + ])("allows a configured legal document: %s", (url) => { + expect(isLegalDocumentUrl(url)).toBe(true); + }); + + it.each([ + "https://t3.codes/download", + "https://example.com/legal", + "javascript:alert(1)", + "not-a-url", + ])("rejects a URL outside the legal-document allowlist: %s", (url) => { + expect(isLegalDocumentUrl(url)).toBe(false); + }); +}); diff --git a/apps/mobile/src/features/settings/lib/legal-document-url.ts b/apps/mobile/src/features/settings/lib/legal-document-url.ts new file mode 100644 index 00000000000..4556375615d --- /dev/null +++ b/apps/mobile/src/features/settings/lib/legal-document-url.ts @@ -0,0 +1,58 @@ +const DEFAULT_MARKETING_SITE_URL = "https://t3.codes"; + +function resolveMarketingSiteUrl(override: string | undefined): URL { + try { + const url = new URL(override?.trim() || DEFAULT_MARKETING_SITE_URL); + if (url.protocol !== "https:" && url.protocol !== "http:") { + return new URL(DEFAULT_MARKETING_SITE_URL); + } + + url.search = ""; + url.hash = ""; + url.pathname = `${url.pathname.replace(/\/+$/, "")}/`; + return url; + } catch { + return new URL(DEFAULT_MARKETING_SITE_URL); + } +} + +const MARKETING_SITE_URL = resolveMarketingSiteUrl(process.env.EXPO_PUBLIC_MARKETING_SITE_URL); + +function marketingSiteDocumentUrl(path: string): string { + return new URL(path, MARKETING_SITE_URL).toString(); +} + +export const PRIVACY_POLICY_URL = marketingSiteDocumentUrl("privacy-policy"); +export const SECURITY_POLICY_URL = marketingSiteDocumentUrl("security-policy"); +export const TERMS_OF_SERVICE_URL = marketingSiteDocumentUrl("terms-of-service"); +export const LEGAL_URL = marketingSiteDocumentUrl("legal"); + +export const ALLOWED_LEGAL_DOCUMENT_URLS = [ + LEGAL_URL, + PRIVACY_POLICY_URL, + TERMS_OF_SERVICE_URL, + SECURITY_POLICY_URL, +] as const; + +function webDocumentIdentity(value: string): string | null { + try { + const url = new URL(value); + if (url.protocol !== "https:" && url.protocol !== "http:") return null; + + const pathname = url.pathname.replace(/\/+$/, "") || "/"; + return `${url.origin}${pathname}`; + } catch { + return null; + } +} + +const ALLOWED_LEGAL_DOCUMENT_IDENTITIES = new Set( + ALLOWED_LEGAL_DOCUMENT_URLS.map(webDocumentIdentity).filter( + (value): value is string => value !== null, + ), +); + +export function isLegalDocumentUrl(value: string): boolean { + const identity = webDocumentIdentity(value); + return identity !== null && ALLOWED_LEGAL_DOCUMENT_IDENTITIES.has(identity); +}