Terms

The agreements and policies of WolOS Hub. Each one starts with a short summary in plain words. The summary helps you read; the numbered sections are what counts.

Contributor Licence Agreement

Version 1, effective 2026-11-04.Accepted at first sign-in (and by an owner for an organisation)

In shortNot binding

You keep your copyright. You give everyone the same licence the project already uses, usually GPL-2.0-or-later. In, out: same terms.
No hidden patent grab: you give no patent rights beyond what that licence itself gives.
Send only what you may send: your own work, or someone else's with its licence on it. If your employer owns your code, get their yes first.
Your moral rights stay yours where the law says they cannot be given away.
We may take your contribution, change it, or say no thanks. We owe you no merge, no credit line beyond the history, and no money.
What you send comes "as is" from you, and WolOS goes out "as is" from us. Checked never means harmless.
You are 16 or older. You accept by signing in and pressing accept. We record the version, the hash of this exact text, and the time.
Not the binding text; the numbered sections below are.

Read the Contributor Licence Agreement
Terms of Use

Version 1, effective 2026-11-04.Accepted at first sign-in

In shortNot binding

WolOS Hub is a free catalogue of apps, plugins and extensions made by other people. We check files and verify who published them. "Checked" means checked. It never means harmless, and it is never a guarantee.
You sign in with GitHub, you are 16 or older, and you follow the Wonderland Doctrine. Be blunt about code, never about people.
Being listed or certified is a licence we give and may take back. Your code and its licence stay yours. A licence works the same in every country.
Our house, our keys. We can list, delist, hide, revoke, downgrade, suspend or switch off anything, any time, as far as the law lets us. We still tell you why, and you can ask a person to look again.
Other people's apps are other people's apps. If yours lands us in court, you pay for the lawyers.
The hub comes "as is". If it breaks, our bill is capped at the smallest amount the law allows.
If you live in the EU, in Brazil or in a US state with strong consumer law, those protections stay with you, whatever this page says.
Questions and legal notices: julia@wolos.org.
Not the binding text; the numbered sections below are.

Read the Terms of Use
Privacy Policy

Version 1, effective 2026-11-04.Notice, not accepted

In shortNot binding

We keep what GitHub tells us when you sign in, what you accept, what you publish and report, and a log of who did what. That is it.
We keep no IP address, except for two days inside a counter that stops floods.
One cookie keeps you signed in (and a short one lives for minutes during sign-in). No analytics, no ads, no tracking pixels, no selling, no sharing for ads. Ever.
Two companies run the machines for us: Cloudflare and GitHub.
You can see, fix, take away or delete your data. Write to julia@wolos.org; we answer within 15 days.
A few things stay even after you leave: the public log, the revocation list, and what we need to answer a court or defend ourselves. The law lets us keep those, and we keep nothing more.
If someone's life is at risk, or a crime is on the table, we talk to the police.
16 or older only.
Not the binding text; the numbered sections below are.

Read the Privacy Policy
Cookie Notice

Version 1, effective 2026-11-04.Notice, not accepted

In shortNot binding

One cookie keeps you signed in. A second one lives for ten minutes while you sign in, then goes.
No analytics, no ads, no tracking pixels, no third-party cookies, no fingerprinting.
Your colour theme stays in your own browser and never reaches us.
Both are strictly necessary, so there is no banner to click. Block them and you can still read everything; you just cannot sign in.
Same controller, same contact as the Privacy Policy: julia@wolos.org.
Not the binding text; the numbered sections below are.

Read the Cookie Notice
Publisher Agreement

Version 1, effective 2026-11-04.Accepted before the first publish

In shortNot binding

Your code stays yours, under your licence. We take no right over it.
Being on the hub is a licence we give you: free, personal, not transferable, and revocable at our call, with or without notice. It covers distribution through the hub, never your code.
Why a licence? One that we give and may take back holds in every country. It does not hang on local rules about your code, consumer contracts or platform liability.
In return you let us host, hash, scan, mirror, show and sign your files. Nothing more.
You promise it does what the listing says, and nothing it hides. Malware ends everything, at once.
You answer for your code, every version, on every machine it runs on. That includes the laws that apply to software you put out there.
A listing is a licence, not a right. We can flag, hold, hide, delist or withdraw any listing or version, any time, at our call, and we owe you nothing for it. We still tell you why.
Your code, your problem: if it lands us in front of a judge, you defend us and pay the bill.
Lost a key or your account? Tell us within 24 hours. Faster is better.
Checked never means harmless, and your listing must never say otherwise.
You accept this page before your first publish, and again for each new version of it.
Not the binding text; the numbered sections below are.

Read the Publisher Agreement
Trust Terms

Version 1, effective 2026-11-04.Accepted with every certificate request

In shortNot binding

"Checked" means a machine looked at that exact file and wrote down what it found. Not more.
"Origin" means we know who published it and from which repository. "Trusted" means people vetted the publisher and a reviewer read each release.
None of this means "harmless". Checked never means risk-free. We look at what a release declares and what changed. We do not run it for you.
A listing and a certificate are licences we give and may take back, never a licence over anyone's code. That holds in every country.
Labels can change any time, at our call. A revoked certificate or a withdrawn version shows up on every WolOS machine that checks the list.
Think our own keys leaked? We can pull the plug on every certificate at once. Annoying for everyone; good for you.
You still decide what you install. The label is a fact, not a promise.
If you ask for a certificate, you accept this page and the Certificate Terms each time.
Not the binding text; the numbered sections below are.

Read the Trust Terms
Certificate Terms

Version 1, effective 2026-11-04.Accepted with every certificate request, through the Trust Terms

In shortNot binding

A certificate says who you are and which repositories you sign. It says nothing about whether your code is any good.
A certificate is a licence we give you: to use the WolOS Authors certificate and its signature lines. Free, personal, not transferable, revocable at our call. It is never a licence over your code.
Why a licence? One that we give and may take back holds in every country. It does not hang on local rules about your code, consumer contracts or platform liability.
Origin is automatic if you meet the rules. Trusted needs people, a review of every release, and an incident contact that answers.
Your keys never leave your machine. Lose one, or think someone has it? Tell us within 24 hours.
We can revoke, downgrade, suspend or withdraw any certificate, any time, with or without notice, at our call. We owe you nothing for it. Your files then stop counting, as the reason says.
If we think our own keys leaked, every certificate can go at once. You then ask for a new one.
A certificate says who you are. Checked never means harmless, and your certificate never says so either.
If your code hurts someone and they come after us, that one is on you: you defend us and pay for it.
Not the binding text; the numbered sections below are.

Read the Certificate Terms
Hub Policies

Version 1, effective 2026-11-04.Part of the Terms of Use and the Publisher Agreement

In shortNot binding

The hub is slow on purpose. A stranger's first app waits a week; updates wait three days. Bad actors hate calendars.
No code at install, no network at install, no files outside your own folders. No exceptions.
Your name lives in your namespace. Look-alikes of someone else's name wait for a person, and usually lose.
Report malware and a person looks within 24 hours, often within 4. Other reports within 3 to 7 days.
Every decision comes with a reason, and you can ask a different person to look again.
A listing is a licence we give and may take back, never a licence over your code. Following every rule here gets you considered, not listed. We decide, and in a fire we can tighten any rule on the spot.
Checked never means harmless. Not here, not anywhere.
Not the binding text; the numbered sections below are.

Read the Hub Policies
Notices and Takedown

Version 1, effective 2026-11-04.Part of the Terms of Use

In shortNot binding

See something illegal on the hub, or your work used without permission? Tell us: julia@wolos.org, subject "Notice".
Say what, where (the exact link), why it is illegal, who you are, and that you mean it in good faith.
We confirm we got it, decide fast, and tell both sides why. The other side can answer back.
Lying in a notice can cost you in court. Infringe again and again and your hub account goes.
We are the messenger, not the judge. We act on what we see, at our call, and the publisher answers for the content.
US copyright, Brazil's Marco Civil and the EU Digital Services Act each get their own steps below.
Not the binding text; the numbered sections below are.

Read the Notices and Takedown
Disclosure Policy

Version 1, effective 2026-11-04.Part of the Terms of Use

In shortNot binding

Found a hole in the hub, in WolOS or in the way we sign things? Tell us first, privately: security@wolos.org.
We answer within 2 working days, fix it in the open, and name you if you want.
Test in good faith, touch only your own data, stop when you find something. Do that and we will not come after you.
No bounty. We are a small project; we pay in thanks and credit. Nothing here is a contract to pay you.
Break the rules on this page and the promise not to come after you is gone. We decide whether you stayed inside them, fairly.
Bugs in someone else's app go to its publisher, or to the report button.
Not the binding text; the numbered sections below are.

Read the Disclosure Policy
Trade Mark Policy

Version 1, effective 2026-11-04.Part of the Terms of Use

In shortNot binding

The code is free. The names are not a free-for-all.
Say your app is "made for WolOS" or "runs on WolOS" all you like, if it is true.
Do not make people think WolOS made, approved or vouches for your thing. "Made by WolOS" is ours.
Fork away, but give your fork its own name and logo.
Unsure? Ask julia@wolos.org. We say yes a lot. We can also take a yes back.
Every mark is ours, all rights reserved. Letting something slide once is not a licence.
"Checked" on the hub never means harmless, so do not dress it up as more.
Not the binding text; the numbered sections below are.

Read the Trade Mark Policy
Changes Log

Version 1, effective 2026-11-04.Part of the Terms of Use

In shortNot binding

Every text has a version number and a date. Nothing changes silently.
Big changes: 30 days' notice, on the hub and by GitHub or email. The hub asks you to accept again where needed.
Every version stays readable forever, and the hub shows the hash of the exact text you accepted.
This page is the list. If a text is not here, it does not bind you.
Urgent fixes for the law or to protect people can land faster. We still say what and why.
Not the binding text; the numbered sections below are.

Read the Changes Log