1. Scope and acceptance
These Terms of Service ("Terms") are an agreement between you and AppFocus GmbH, Haselstrasse 19, 5400 Baden, Switzerland, UID CHE-139.464.954 ("AppFocus", "we"). They cover the Intellity website, the rules scanner, user accounts, the read-only Firebase connection, continuous monitoring, paid subscriptions, and everything else we make available under the Intellity name (together "the Service"). By accessing or using the Service you accept these Terms; if you do not accept them, do not use the Service. If you use the Service for a company, you confirm that you are authorised to accept these Terms on its behalf.
2. What the service does
Intellity loads Firebase security-rules text into an instance of the real Firebase rules engine running on our servers, executes a defined set of automated probes (for example as an anonymous visitor and as a logged-in user), and reports the outcomes together with suggested fixes. The rules come either from text you paste, or, if you connect a project, from the rules you have deployed, which we read through a read-only authorisation (section 4).
The Service tests only Firestore and Cloud Storage security rules, and only against the probes implemented at the time of your scan. It does not analyse your application code, your Cloud Functions, other Firebase services, your infrastructure, your stored data, or attack classes outside its probe set, and it never reads or writes the contents of your database or storage. A scan is not a security audit and does not replace one.
3. Accounts
Some features (saving scans, connecting a project, and monitoring) require an account, created with an email and password or with Google sign-in. You are responsible for keeping your credentials secure and for activity under your account, and you agree to give accurate information and to tell us promptly of any unauthorised use. You must be able to form a binding contract to use the Service.
4. Connecting your Firebase (read-only)
You may optionally connect Firebase projects by granting a read-only Google authorisation. This lets Intellity list your projects and read the security rules you have deployed. It does not permit reading or writing your database, your users, or your stored files, and it cannot modify anything in your project. You may only connect projects you own or are authorised to test, and you are responsible for having that authority. You can revoke the connection at any time from within Intellity or from your Google Account.
5. What a result does not mean
A finding means the tested rules allowed a specific operation during our probes. A result with zero findings means the tested rules withstood the probes we ran, and nothing more. It is not a statement that your rules, your database, your application, or your users' data are secure. False positives and false negatives can occur. The probe set changes over time, so the same rules can produce different results on different days.
Suggested fixes are generic starting points derived from the finding. They are not reviewed for your specific application, they can change your app's behaviour, and they can be wrong for your case. Review and test any fix in a non-production environment before deploying it.
6. No warranty
The Service and all results are provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, availability, and accuracy. In particular, we do not warrant that results are correct or complete, that the probes detect every vulnerability or misconfiguration, that suggested fixes are correct or suitable, that monitoring runs on any schedule or detects every change, or that alert emails are delivered.
7. Your responsibility
You remain solely responsible for your security rules, your configuration, and the security of your applications and data, and for every action you take based on the Service. You will independently verify results and fixes before relying on them. The Service provides technical information; it is not legal advice, not compliance advice, and not professional security consulting, and using it creates no advisory or client relationship.
8. Paid plans, billing, and cancellation
Scanning and connecting are free. Continuous monitoring is a paid plan ("Pro"), currently USD 19 per month, and it starts with a free trial (currently 14 days). We show you the price before you subscribe. Payments are processed by Stripe; we do not receive or store your card details.
By subscribing, you authorise recurring charges to your payment method at the then-current price, plus any applicable taxes (for example Swiss VAT), on each renewal until you cancel. The subscription renews automatically each period. You can cancel at any time from the billing portal; access to Pro continues to the end of the paid period already started, and you are not charged again after that. If you cancel during the free trial, you are not charged at all.
Fees are non-refundable except where required by law, and we do not provide partial-period refunds. We may change prices or plan features with reasonable advance notice, and changes take effect from your next renewal. If a payment fails, we may suspend or downgrade Pro features. Mandatory consumer rights, including any statutory right of withdrawal, remain reserved.
9. Acceptable use
You must not: submit content or connect projects you are not authorised to test; submit content that is unlawful or infringes third-party rights; attempt to disrupt, overload, or gain unauthorised access to the Service; circumvent rate limits, account limits, or other protective measures; resell or run automated bulk scanning without our prior written consent; or present Service output in a way that misrepresents it as issued or endorsed by us. We may rate-limit, suspend, or block use that violates these Terms or endangers the Service.
10. Availability and changes to the service
Intellity is in active development. We may modify, suspend, or discontinue the Service or any part of it, and we give no commitment to availability, response times, or support. Usage caps and rate limits apply and can change. If we discontinue a paid feature you are paying for, we will stop charging you for it.
11. Your content and anonymised statistics
You keep all rights to the rules you submit or make available to us through a connection. You grant AppFocus a limited, non-exclusive licence to process that rules text transiently for the sole purpose of running your scan and showing you the result. The rules text is held in memory only and is not stored after the scan. We store anonymised structural statistics and the scan summaries described in the Privacy Policy; they contain no rules text and nothing that identifies your app, and we may use and retain them to operate and improve the Service.
12. Communications
We send service emails needed to operate your account and the features you use, including email verification, monitoring alerts, and billing notices, as described in the Privacy Policy. Any purely promotional email is sent only with your consent and always includes an unsubscribe path.
13. Intellectual property
The Service, including its design, text, software, probe catalogue, and report formats, belongs to AppFocus or its licensors and is protected by law. These Terms grant you no rights to it beyond normal use of the Service. Firebase, Firestore, and Google Cloud are trademarks of Google LLC; Intellity is an independent product and is not affiliated with, sponsored by, or endorsed by Google.
14. Limitation of liability
To the maximum extent permitted by applicable law, AppFocus and its managing directors, employees, and agents are not liable for: indirect or consequential damage; loss of profits, revenue, data, or goodwill; business interruption; costs of substitute services; or any damage arising from (a) reliance on scan results, including findings that were wrong and issues that were not found, (b) vulnerabilities or security incidents in your applications, whether or not a scan could have revealed them, (c) fixes or other changes you apply, (d) the read-only connection or its revocation, (e) modification, suspension, or discontinuation of the Service, or (f) use of the Service contrary to these Terms.
To the extent liability cannot be excluded, our total aggregate liability is limited to the amounts you paid us for the Service in the twelve months before the event giving rise to the claim. This clause does not limit liability that cannot be limited under applicable law, in particular liability for unlawful intent or gross negligence (Art. 100 of the Swiss Code of Obligations) and for personal injury. Claims in connection with the Service are to be directed at AppFocus GmbH and, to the extent permitted by law, not personally at its managing directors, employees, or agents.
15. Indemnity
You will hold AppFocus harmless from third-party claims and reasonable related costs arising from your breach of these Terms, in particular from submitting rules or connecting projects you were not authorised to test, or from misuse of the Service.
16. Suspension and termination
You can stop using the Service at any time and delete your account from Settings, which cancels any active subscription and removes your data as described in the Privacy Policy. We may suspend or terminate access, with or without notice, if you breach these Terms or to protect the Service or other users. Sections that by their nature should survive termination, including your responsibility, disclaimers, limitation of liability, and indemnity, continue to apply.
17. Changes to these terms
We may update these Terms as the Service evolves. The date at the top shows the current version, and we will announce material changes on the site. Using the Service after a change takes effect means you accept the updated Terms.
18. Governing law and jurisdiction
These Terms are governed by substantive Swiss law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is Baden, Canton of Aargau, Switzerland. Mandatory statutory jurisdictions, for example for consumers, remain reserved.
19. Final provisions
If a provision of these Terms is or becomes invalid, the remaining provisions stay in force, and the invalid provision is replaced by a valid one that comes closest to its purpose. Our not enforcing a provision is not a waiver. The English version of these Terms governs. Questions: nikola@appfocus.ch.