Terms and legal documents
Overview
The Terms of Service are the agreement between you and Gitmoap. Beside them sit the policies the Terms include — what you may not do with the service, and how content is reported — the notices that tell you how personal data is handled, the addendum for an organisation's personal data, and the Entity Details: who operates Gitmoap and how to reach them. You can read every one of them, signed in or not, and every version published stays readable at its own permanent address for as long as Gitmoap runs.
Gitmoap is a Beta — a proof of concept, run by one person and free of charge — and comes without guarantees: the Terms say exactly what that means, including what happens if it stops. Keep your own copy of anything that matters to you; a clone is a complete copy of a repository.
You accept the Terms once, in the web app, and again when a new version comes. Until you accept the version in force, Gitmoap lets you read everything that is yours but refuses changes until you accept. Not accepting does not, by itself, close your account or delete anything. A version that introduces a charge is different: you accept it only if you choose to, and declining it never blocks you.
Before you start
- Nothing, to read.The documents and the means of contact need no account.
- A signed-in session in the web app, to accept.An acceptance is your statement about a text you read, so it is made where you read it: never from the command line, and never by an access token, an AI agent or an app acting for you.
How it works
Each document is published at a version — v1, v2, and so on — with the day it takes effect and the stage Gitmoap is at. While Gitmoap is a Beta, every term written only for the Beta starts with the tag [Beta], so you can see at a glance which terms are temporary. A version is usually published ahead of that day, so you can read it, and accept it, before it binds. Every version after the first comes with a summary of what changed, written by Gitmoap and published with the text, and a new version of the Terms is announced in the web app or by email. Gitmoap counts days in UTC.
| Document | What it is |
|---|---|
| Terms of Service | the agreement you accept |
| Acceptable Use Policy, Content Reporting Policy | part of the Terms, accepted with them |
| Entity Details | part of the Terms; its means of contact are always its current ones |
| Privacy Statement, Cookie Statement | notices: they inform, and ask nothing of you |
| Data Processing Addendum | for personal data an organisation puts into Gitmoap |
| Security Disclosure Policy, Subprocessors | how to report a vulnerability to us, and who processes data for us |
The list of documents also carries Gitmoap's means of contact — the support, notices, privacy, abuse and security mailboxes, the contact form, and the Digital Services Act points of contact — each with the contact-form topic that reaches the same desk.
If Gitmoap is shut down, the Terms give you seven days' notice in the web app or by email — unless it cannot keep running that long, for a reason the Terms list — and nothing more: no export period and no copy afterwards. Take out what you want to keep while it runs.
While you owe an acceptance, any change you make — from the web app, the command-line interface, the API or a git push — is refused with 409 LEGAL_ACCEPTANCE_REQUIRED, naming the document. Cloning and fetching are reads, and keep working. Reading is never refused, and you can always ask us to close your account, revoke an access token or disconnect an app. A service account or an AI agent never owes an acceptance.
How to
Read the Terms
Open Terms of Service from your account menu, or Terms under any signed-out page; every document is listed at /-/legal. Each document shows the version in force and, when one is published, the version coming and the day it takes effect.
gitmoap legal listcurl -X GET https://api.gitmoap.example/legalA document shows its version in force, with every earlier version listed below it.
gitmoap legal get --document-key <document key>curl -X GET https://api.gitmoap.example/legal/{document_key}Every version stays at its own address, word for word, for as long as Gitmoap runs. Save it if you want a copy: its SHA-256 checks that it is the text that was published.
gitmoap legal get-version --document-key <document key> --version <id>curl -X GET https://api.gitmoap.example/legal/{document_key}/versions/{version}Accept the Terms
The first time you use Gitmoap, and whenever a new version is coming, the web app shows you the Terms and asks you to accept them; when you accepted an earlier version, it opens on the summary of what changed and the changes since then, word by word, with the full text one tab away. Choose I accept, or Not now to keep reading — nothing is accepted until you choose. A change refused with LEGAL_ACCEPTANCE_REQUIRED opens the same prompt over the page, and you save the change again once you accept.
gitmoap legal accept \ --document-key <document key> \ --version <id> \ --moment signup|promptcurl -X PUT https://api.gitmoap.example/user/legal-acceptances/{document_key}/versions/{version} \ -H "Authorization: Bearer $GITMOAP_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "moment": "<one of prompt | signup>" }'What you have yet to accept, with whether it is refusing your changes now.
gitmoap legal list-my-pending-acceptancescurl -X GET https://api.gitmoap.example/user/legal-acceptances/pending \ -H "Authorization: Bearer $GITMOAP_TOKEN"Every version you accepted, and when — in the web app under Settings → Legal.
gitmoap legal list-my-acceptancescurl -X GET https://api.gitmoap.example/user/legal-acceptances \ -H "Authorization: Bearer $GITMOAP_TOKEN"Reference
6 endpoints
GET/legalpublic
The legal documents, the version of each in force and the one coming, and Gitmoap's means of contact
Token scope
None — this one is public
Send
Nothing — the address is the whole request.
Refuses
304Nothing changed since the caller's `If-None-Match`
Receive
- contact_languagesstringThe languages the points of contact answer in.
contacts[]object5 fields
- deskcontact_formdsa_authoritiesdsa_recipientsnoticesprivacy_requestsreports_of_illegal_contentsecurity_disclosuressupportOne of Gitmoap's means of contact.
- kindemailurlHow a means of contact is reached.
- labelstringWhat the Entity Details call it.
- topicobjectoptional
- valuestringThe address, or the page.
documents[]object5 fields
- currentobjectoptional
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- kindaddendumagreementannexnoticepolicyWhat a legal document is: an agreement you accept, a policy it incorporates, a notice that informs you, an addendum for organisations, or an annex.
- titlestringIts title.
- upcomingobjectoptional
- stagebetagenerally_availableThe stage Gitmoap is at.
GET/legal/{document_key}public
The version of a legal document in force today, with its text and every version published
Token scope
None — this one is public
Send
Path
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceThe document
Refuses
304Nothing changed since the caller's `If-None-Match`404No such document, or none of it is in force yet
Receive
- bodystringIts text, as markdown. Links name other documents as
<document_key>.md. - change_summaryobjectoptionalWhat changed since the version before it, as its publisher summarised it. None for a first version.
- content_sha256stringThe SHA-256 of
body. - document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- effective_datestring
history[]object4 fields
- change_summaryobjectoptionalWhat changed since the version before it, as its publisher summarised it. None for a first version.
- content_sha256stringThe SHA-256 of its text, as the published body hashes.
- effective_datestring
- versionstringA version of a legal document: v1, v2, and so on.
- kindaddendumagreementannexnoticepolicyWhat a legal document is: an agreement you accept, a policy it incorporates, a notice that informs you, an addendum for organisations, or an annex.
- titlestringIts title.
- upcomingobjectoptional
- versionstringA version of a legal document: v1, v2, and so on.
GET/legal/{document_key}/versions/{version}public
One published version of a legal document, exactly as it was published
Token scope
None — this one is public
Send
Path
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceThe document
- versionstringThe version: v1, v2, and so on
Refuses
304The caller already holds it400The version is not of the form v1, v2, …404No such document, or that version was never published
Receive
- bodystringIts text, as markdown. Links name other documents as
<document_key>.md. - change_summaryobjectoptionalWhat changed since the version before it, as its publisher summarised it. None for a first version.
- content_sha256stringThe SHA-256 of
body. - document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- effective_datestring
- kindaddendumagreementannexnoticepolicyWhat a legal document is: an agreement you accept, a policy it incorporates, a notice that informs you, an addendum for organisations, or an annex.
- titlestringIts title.
- versionstringA version of a legal document: v1, v2, and so on.
GET/user/legal-acceptancesuser:read
The versions of the legal documents you have accepted, newest first
Token scope
user:read
Send
Nothing — the address is the whole request.
Refuses
401Unauthorized403Forbidden — the caller's access level or token scope is insufficient
Receive
items[]object4 fields
- accepted_atstringWhen.
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- momentpromptsignupWhere an acceptance was asked for.
- versionstringA version of a legal document: v1, v2, and so on.
GET/user/legal-acceptances/pendinguser:read
The legal documents you have yet to accept
Token scope
user:read
Send
Nothing — the address is the whole request.
Refuses
401Unauthorized403Forbidden — the caller's access level or token scope is insufficient
Receive
items[]object8 fields
- change_summaryobjectoptionalWhat changed since the version before it, as its publisher summarised it. None for a first version.
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- effective_datestring
- gatesbooleanWhether, until you accept it, your changes are refused. Reading always stays open.
- introduces_chargebooleanWhether it introduces a charge, which is only ever accepted expressly and never blocks you.
- takes_effect_in_futurebooleanWhether it has yet to take effect: it can be accepted now, before it binds.
- titlestringIts title.
- versionstringA version of a legal document: v1, v2, and so on.
PUT/user/legal-acceptances/{document_key}/versions/{version}user:update
Accept a legal document at the version you were shown
accept_legal_documentPUT /user/legal-acceptances/{document_key}/versions/{version}Open in the API referenceToken scope
user:update
Counts against
legal_acceptances_per_principal
Send
Path
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceThe document
- versionstringThe version you were shown: v1, v2, and so on
Body
- momentpromptsignupWhere an acceptance was asked for.
Refuses
400The document needs no acceptance, or a field is not valid401Unauthorized403Only a signed-in session can accept404No such document, or that version was never published409That version is neither in force nor the one coming429You hold as many acceptances as one person may
Receive
- accepted_atstringWhen.
- document_keyacceptable-use-policycontent-reporting-policycookie-statementdata-processing-addendumentityprivacy-statementsecurity-disclosure-policysubprocessorsterms-of-serviceA binding legal document, named by its file stem.
- momentpromptsignupWhere an acceptance was asked for.
- versionstringA version of a legal document: v1, v2, and so on.
Limits
| What | Limit |
|---|---|
| Acceptances one person may hold | 200 |
| Accepting the same version again | changes nothing, and answers with your original acceptance |
| Versions you can accept | the one in force, and the one coming |
Troubleshooting
409 LEGAL_ACCEPTANCE_REQUIREDon a change
- Cause
- A version of the Terms you have not accepted is in force
- What to do
- Open the web app and accept it; reading, deleting your account and revoking credentials stay open meanwhile
git push rejected with LEGAL_ACCEPTANCE_REQUIRED
- Cause
- The same: a push is a change
- What to do
- Accept the Terms in the web app, then push again
409 LEGAL_VERSION_NOT_CURRENT
- Cause
- The version you named is neither in force nor the one coming
- What to do
- Accept the version the list of documents shows
403 SESSION_REQUIREDwhen accepting
- Cause
- The request carried an access token, or came from the command line
- What to do
- Accept in the web app, signed in
404for a document
- Cause
- Nothing of it is in force yet, or the key names no document
- What to do
- The list of documents names each document and the version coming
400for a version
- Cause
- The version is not of the form
v1,v2, … - What to do
- Use the version as the list shows it
Related
- Contact Gitmoapwriting to a person at Gitmoap, through the desks the Entity Details name
- Your accountdeleting your account, which is never refused
- Access tokensrevoking a token, which is never refused