Software license agreement (EULA)

01License grant

Subject to this EULA and your compliance, we grant you a limited, non-exclusive, non-transferable license to install and use the software for your personal or internal business use.

02Device limits

A license covers a set number of Macs, shown on the product page, at checkout and in your account; an app's own section may say more. To activate another Mac when every place is in use, release one first (Your Macs › Release, in the app or in your account).

03Restrictions

• No resale, sublicensing, or transfer of licenses without permission.
• No reverse engineering, decompiling, or bypassing licensing controls where prohibited by law.
• No use of the software to infringe rights or violate applicable laws.

04Updates and availability

We may provide updates, bug fixes, or feature changes. Some functionality may depend on third-party services or operating system capabilities.

05Internet access

Some features use the internet, for example license checks for Pro, web search and update checks. Each app lists what it sends and lets you turn off what is optional. The apps work offline for everything that runs on your Mac, and Pro keeps working for up to 30 days without a connection.

06Third-party components

The software bundles open-source AI models and libraries that carry their own licenses (MIT, Apache, BSD, and others). Optional services you choose to use (such as a search service or cloud model provider you set up, and Apple iCloud) are governed by their own terms. A full list of dependencies and their licenses can be found in the application's about screen or package.json file.

07Termination

We may suspend or terminate licenses for refunds, fraud, abuse, or material violations of this EULA or our Terms of Service. Upon termination, you must stop using the software.

08Disclaimer and limitation of liability

The software is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim warranties and limit liability as described in the Terms of Service.

09Refunds

Refund requests are governed by our Refund Policy. If a refund is granted, the associated license may be voided. Where an app's own section says more about refunds, that section applies too.

10Saferow

Saferow is a Mac app for your databases, from saferow.app. In this section "Saferow" means the app, its updates, its command-line and MCP components, and its documentation. If you use Saferow for an organization, you accept this agreement for it and confirm that you may.

Saferow Free and Saferow Pro

Saferow Free needs no license and never checks one. Anyone may use it, for personal or commercial work, on any number of Macs, at no charge. It has the whole loop: Browse, the agent and the changes it proposes for your approval, 7 days of Rewind, Memory, saved questions, playbooks, Saferow MCP on one connection, and 3 remote connections (databases on your Mac and SQLite files never count). The Safety Kernel, approvals and the ledger work the same on Free and Pro.

Saferow Pro is sold by LonelyDuck Software at lonelyduck.io as a perpetual license: one payment turns Pro on for all of your own Macs, with every Saferow 1.x update included and nothing to renew. Pro adds every remote connection, 30 days of Rewind, watches that run on their own, a second opinion on answers (Check this answer and split compare) and Saferow MCP on every connection.

• A Pro license is for one person, on the Macs that person uses. It isn't a license for other people or a team: a team buys one license for each person. A fair-use limit on the number of Macs applies only to stop a license being shared.
• A Pro license doesn't expire and needs no renewal payment. It covers the public beta and every Saferow 1.x release. A later major version may be offered separately, at a price announced before it ships.
• A Saferow license issued before 17 October 2026, for the beta or as a gift, stays a Pro license under this agreement. It is checked on your Mac, needs no lease and sends nothing.
• A change to this agreement doesn't take away a Pro license you bought: this section's grant, as it stood when you bought, keeps applying to it.

Pro on your Macs

• Pro on each Mac runs on a 30-day lease. Saferow renews it about twice a week, sending only the Mac's activation id and a signature made with a key kept in that Mac's Keychain; we keep the day it checked in, not its IP address. Without a connection Pro keeps working until the lease ends (up to 30 days); after that the Mac uses Saferow Free until it connects again, and Pro comes back by itself.
• Saferow Pro also reads an anonymous, signed list of refunded activations and a stream that only says when the list changes. Neither carries anything about you or your Mac.
• Saferow › Settings › License lists Your Macs, and so does Account › Saferow on lonelyduck.io. Release frees a Mac's place, and that Mac goes back to Saferow Free.

Your databases and your decisions

Saferow works on the databases you connect it to, with the credentials you give it, at your instruction. You remain responsible for those systems, for having the right to access them, and for the changes you approve.

The Safety Kernel, approvals, restore points and Rewind reduce risk. They are not a backup, and they can't guarantee that a change can always be undone. We don't promise that Saferow is free of errors or that it will stop every unwanted change to your data. Keep backups of data that matters.

The agent's answers

Answers, SQL and plans written by AI models can be wrong. Saferow shows you the query, the rows it read, what it assumed and what it checked, and holds every change the agent proposes until you approve it. The line under an answer says whether its numbers and dates appear in the reads behind it; that is a check, not a promise that the answer is right. Whether to rely on an answer, and whether to approve a change, is your decision.

Models and services you choose

AI models you download or use through Saferow are licensed by their makers. Services you choose to connect, such as OpenRouter, Anthropic, OpenAI, Google, xAI, DeepSeek, Ollama and Ollama Cloud, LM Studio, oMLX, Hugging Face or a server you add, are provided under their own terms, with your own account or key, and we are not responsible for them. When you choose a model in the cloud, what Saferow sends it depends on the connection, as What leaves this Mac describes.

Your data

We don't receive your databases, their rows, your queries or your conversations. Saferow sends no telemetry and never calls our telemetry endpoint. What the app sends, when and to whom, is listed in What leaves this Mac; what reaches LonelyDuck, and what saferow.app keeps from its forms, is in our privacy policy.

Refunds

Saferow Pro is refunded in full within 30 days of purchase, for any reason, whether or not it has been activated. If a purchase is refunded or charged back, Pro turns off on the license's Macs: within seconds on a Mac that is online, and when it next connects or its lease ends (30 days at most) on one that isn't. Nothing in Saferow is deleted: your connections, the ledger, restore points, Memory, saved questions and watches stay on your Mac, changes waiting for you can still be approved or rejected, and the app keeps working as Saferow Free.

Betas and testing

Pre-release versions of Saferow, including the public beta, may have defects and are provided for evaluation; keep your own backups while you use them. Checking how Saferow behaves on your own systems (its network connections, the grants it uses, the escape tests on saferow.app/security/) is welcome, and we appreciate reports to security@saferow.app. Using Saferow against systems you aren't authorized to access is not allowed.

11Carriel

Carriel is a Mac app, from carriel.app, for the private things you keep around: API keys, passwords, recovery codes, notes and small files. In this section "Carriel" means the app (Carriel, its agent in the menu bar and Carriel Updater), its updates and its help. If you use Carriel for an organization, you accept this agreement for it and confirm that you may. Sections 1 to 9 and this section are Carriel's whole license agreement.

The free pouch and the bigger pouch

Carriel is free to download and to use, with every feature, for up to 25 things in your pouch. The free pouch needs no license and never checks one.

The bigger pouch is sold by LonelyDuck Software at lonelyduck.io as a perpetual license: one payment lets your pouch hold up to 100 things, on up to 10 of your own Macs, with every Carriel update included for as long as we make Carriel, and nothing to renew. Nothing else is behind it.

• A license is for one person's pouch, on the Macs that person uses. It isn't a license for other people or a team: each person buys their own. The limit of 10 Macs is there only to stop a license being shared.
• A license doesn't expire. A change to this agreement or to Carriel's limits doesn't take away a bigger pouch you bought: this section's grant, as it stood when you bought, keeps applying to it.
• If we ever stop checking licenses, we will first release an update that keeps the bigger pouch working without them.

The license on your Macs

• The license is emailed to you. Keep it private: anyone who has it can use it. You enter it once, with ⌃⌥⌘V or in Settings › About › Enter License…; your other Macs with the same pouch get it through iCloud Keychain, and each Mac uses it by itself.
• Each Mac with the bigger pouch holds a 30-day lease and renews it about twice a week, right after you enter, release or remove the license on one of your Macs, and when you open Settings › About on a Mac an hour or more after its last check, sending only the id LonelyDuck gave that Mac and a signature made with a key kept on it; we keep the day it checked in, not its IP address. Carriel Updater makes these requests for the app.
• A Mac without a current lease (one that couldn't check in for 30 days, one you released, a license refunded or charged back, or a license already used on 10 Macs) is a free pouch again: it keeps every thing and every feature, and takes new things up to 25 until it has a lease again.
• Settings › About › Macs… lists the Macs that use your license, and so does Account › Carriel on lonelyduck.io. Release gives a Mac's place back.

Updates

Carriel updates itself from carriel.app's download server, dl.carriel.dev. Every update is signed by us and notarized by Apple, and Carriel checks both before it installs one. A check sends the version you run and nothing unique to your Mac. In Settings › About you can have Carriel ask before it installs an update, or turn update checks off; the license's check-ins go on either way.

Your pouch

What you keep in Carriel is yours. Carriel seals it on your Mac before it reaches your own iCloud, and we never receive it: not your things, their values, their names or their notes. You are responsible for your Mac, your Apple Account and iCloud, and any pouch password and recovery key you set. We can't open your pouch, and we can't recover a lost pouch, a forgotten pouch password or a lost recovery key. Keep your own copy of anything you can't afford to lose.

What can leave your Mac

• iCloud: Carriel keeps your pouch in your own iCloud account, in CloudKit's private database, and the keys that encrypt it in iCloud Keychain. Every thing is encrypted on your Mac before it is sent; values, names and notes never leave your Mac unencrypted. Apple can see how many records there are, their sizes and when they change. We never receive any of it.
• Updates: when Carriel starts and about once an hour while your Mac is awake, and when you choose Check Now, Carriel asks dl.carriel.dev whether a newer version exists, with the version you run and nothing unique to your Mac, and checks an update's signature before installing it.
• The license: only with the bigger pouch. When the license reaches a Mac, Carriel Updater sends api.lonelyduck.io the license, an id made for this Mac and this license (a one-way value from the Mac's hardware id, never the id itself), the Mac's model (like "MacBook Air · M2", never its name), a public key (the Mac's device key, whose private half never leaves the Mac) and a signature, and brings back this Mac's 30-day lease. About twice a week after that, right after you enter, release or remove the license on one of your Macs, and when you open Settings › About on a Mac an hour or more after its last check, each Mac sends only the id LonelyDuck gave it and a signature. Macs… sends the license, and Release the license and the Mac it releases. Nothing from your pouch goes with any of them.
• Links you open: a link you click in Carriel, such as Help or Get the Bigger Pouch…, opens in your browser.

Carriel sends no usage data, no analytics and no crash reports of its own, and never calls our telemetry endpoint. Our privacy policy says what reaches us.

Refunds

The bigger pouch is refunded in full within 30 days of purchase, for any reason. A refund or a chargeback ends the license: each Mac hears it at its next check-in, within a few days, and becomes a free pouch again. Nothing in your pouch is deleted or hidden; past 25 things, it only stops taking new ones.