Terms of Service & Conditions
Last Updated: November 6, 2026
Separates responsibilities across Web Portal, MCP Server runtime, and your chosen AI Client (Claude Desktop, Cursor, Windsurf).
MCP tool invocations are triggered non-deterministically by third-party LLMs. Users maintain sole supervisory review.
We never train, fine-tune, or evaluate artificial intelligence models on your notes, terminal logs, code, or compiled PDFs.
01. Acceptance of Terms
By accessing, downloading, installing, or using the Doc Buddy web application ("Portal"), the Doc Buddy Model Context Protocol server ("MCP Server"), or any associated APIs, scripts, or documentation (collectively, the "Services"), you ("Customer", "User", or "you") agree to be bound by these Terms of Service ("Terms").
If you are entering into these Terms on behalf of an entity, organization, or company, you represent and warrant that you have the requisite authority to bind that entity to these Terms. If you do not agree with any provision of these Terms, you must not access, install, or use the Services.
02. Description of Services & Three-Tier Architecture
Doc Buddy is a developer-focused publishing engine that converts raw notes, terminal output, source code, and Mermaid diagrams into publication-grade PDF documents using the Typst typesetting system.
You acknowledge and agree that the Services operate across a distinct Three-Tier Architecture:
Next.js SaaS dashboard facilitating user accounts, Brand Kit custom styles, Polar.sh subscription checkouts, and RFC 6749 OAuth 2.0 authorization tokens.
The FastMCP server runtime providing Typst PDF compilation via local standard input/output (stdio) or hosted remote cloud (http/sse).
Independent third-party agent desktop environments (Anthropic Claude Desktop, Cursor IDE, Windsurf) executing autonomous LLM instructions.
Doc Buddy has no control over, and assumes no responsibility for, the availability, security, or terms of third-party MCP Clients or LLM providers.
03. Artificial Intelligence Disclaimer & Liability Shield
You explicitly recognize that the MCP Server tools (such as generate_designed_pdf) are typically invoked by artificial intelligence models (such as Large Language Models or autonomous agents). AI models are inherently probabilistic and non-deterministic. Tool calls, input parameters, and data transformations are executed based on algorithmic inference that may produce errors, hallucinations, unexpected parameter formatting, or misinterpretations of your notes.
You agree that: (a) You are solely responsible for supervising and reviewing every action, parameter, and document compiled by your AI agent; (b) You assume all risks associated with unintended tool executions, quota consumption, or content inaccuracies caused by your chosen AI model; and (c) Doc Buddy shall have no liability for data loss, document formatting artifacts, compilation failures, or decisions made in reliance upon AI-generated outputs.
04. Local Execution vs. Cloud Hosting Responsibilities
4.1 Local Deployment (stdio): When running the MCP Server locally on your workstation, all compilation occurs on your local hardware. Source files, temporary Typst files, and PDF binaries reside exclusively on your filesystem (DOCBUDDY_OUTPUT_DIR). Local usage quotas are recorded in your local SQLite database (docbuddy_billing.db). Doc Buddy operators have zero custody, ownership, or visibility into locally compiled documents. You bear sole responsibility for local security and disk management.
4.2 Hosted Remote Deployment (http/sse): When utilizing a remote hosted instance, document payloads transit over encrypted TLS connections. Compiled PDFs are stored temporarily in server output volumes or configured Cloudflare R2 / S3 storage for download. Download URLs (/files/[filename]) provide direct access to the compiled file; you are responsible for safeguarding your download URLs.
05. Developer Request Inspector & Payload Logging Notice
To enable developer prompt debugging and structural document verification, the MCP Server includes an automated Request Inspector (inspector.py). When the generate_designed_pdf tool executes, the server captures the incoming DocumentPayload (including title, author, summary, text sections, embedded code, tables, image metadata, and diagram definitions) in an in-memory ring buffer (last 100 requests) and writes it to disk at output/requests/req_[timestamp].json.
You can inspect, view, or purge these logs at any time via the authenticated Inspector dashboard (/debug/ui) or by sending an HTTP DELETE request to /debug/requests. You agree NOT to submit unencrypted passwords, secret API keys, payment card numbers, protected health information (PHI), or classified data within notes processed by the MCP Server.
06. Third-Party Diagram Services & SSRF Protections
Mermaid Flowchart Rendering: When a document includes a flowchart block, the Mermaid graph definition is base64-encoded and transmitted via HTTPS to https://mermaid.ink/img/... for raster image synthesis. If the external service is unreachable, Doc Buddy falls back to offline code box rendering. You acknowledge that diagram syntax passes to this external rendering endpoint.
Remote Image Fetching: When rendering remote image blocks, the server issues outbound HTTPS requests. The server enforces Server-Side Request Forgery (SSRF) validation blocking loopback (127.0.0.1), link-local (169.254.169.254), carrier-grade NAT, and private network addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
07. Intellectual Property & Zero AI Training Guarantee
STRICT ZERO AI MODEL TRAINING COMMITMENT
Doc Buddy will NEVER use your User Content, source notes, code snippets, Brand Kit settings, or compiled PDF documents to train, retrain, fine-tune, or improve any machine learning, deep learning, or artificial intelligence models.
You retain full, exclusive ownership of all text, code, notes, images, branding assets, and intellectual property submitted to the Services, as well as all compiled PDF deliverables. Doc Buddy retains all rights in the platform, Typst templates, and software code.
04. API Keys, Tokens & Credential Security
You are responsible for maintaining the confidentiality and security of your account credentials, session cookies (docbuddy_session), and OAuth 2.0 bearer access tokens issued to your MCP client devices.
If you suspect an OAuth access token or connected device has been compromised, you must immediately revoke the affected device connection via the web dashboard (/dashboard) and re-authenticate your clients.
Quotas & Rate Limits: Free Tier grants 5 PDF compilations per calendar month (watermarked). Pro Tier unlocks unlimited monthly compilations, all premium themes, custom Brand Kits, and watermark-free output. Circumventing rate limits, forging device identities, or tampering with local quota databases (docbuddy_billing.db) constitutes a material breach of these Terms.
05. Acceptable Use & Conduct
You agree not to use the Services to:
- Reverse engineer, decompile, or disassemble any proprietary portion of the Web Platform or MCP Server.
- Interfere with, disrupt, or launch automated denial-of-service (DoS) attacks against our infrastructure or sub-processors.
- Circumvent, disable, or tamper with usage quotas, license validation mechanisms, or security filters.
- Exploit the MCP server to probe internal networks, perform port scanning, or attempt Server-Side Request Forgery (SSRF) against private, loopback, or cloud metadata addresses (
169.254.169.254,127.0.0.1,10.0.0.0/8). - Process, compile, or distribute content that is illegal, defamatory, infringing on intellectual property, or malicious.
- Facilitate unauthorized system access, command injection, or privilege escalation.
06. Fees, Subscriptions & Merchant of Record
Paid subscriptions and license key issuance are processed through Polar.sh (Polar Inc.) or designated payment processors acting as the Merchant of Record. Polar is responsible for payment collection, invoice generation, currency conversion, and applicable sales tax/VAT remittance.
07. Disclaimer of Warranties ("AS IS")
THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE.
TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, DOC BUDDY EXPRESSLY DISCLAIMS ALL WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ACCURACY. WE DO NOT WARRANT THAT THE SERVICES WILL OPERATE UNINTERRUPTED, SECURE, OR ERROR-FREE, OR THAT AI MODELS COMMUNICATING WITH THE MCP SERVER WILL INTERPRET USER PROMPTS OR FORMAT ATTRIBUTES ACCURATELY.
08. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: (1) IN NO EVENT SHALL DOC BUDDY PVT. LTD., OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, USE, GOODWILL, OR BUSINESS INTERRUPTION; AND (2) OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS SHALL BE LIMITED TO THE AMOUNT ACTUALLY PAID BY YOU TO DOC BUDDY IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR FIFTY UNITED STATES DOLLARS ($50.00 USD), WHICHEVER IS GREATER.