Terms and conditions

1. Agreement

These terms are an agreement between you and Flywheel Studio LLC ("Flywheel", "we", "us") for the use of Supahound and its website. If you use Supahound for a company, you agree for that company and confirm that you may bind it. If you do not agree, do not use Supahound.

2. The service

Supahound monitors Supabase projects you connect. It runs posture scans, reads project logs to detect abnormal traffic, groups findings into incidents, writes summaries and sends alerts. The hack me scan checks a web domain you have verified. We may change features over time; we will not remove a core paid feature during a billing period you have paid for.

3. Your account

Keep your email account secure, because sign-in links go to it. You are responsible for activity in your workspace and for the people you invite to it. Tell us at once if you think someone has accessed your account without permission.

4. Your projects and your users' data

You confirm that you have the right to connect each Supabase org and project, and a lawful basis to let us process the personal data in its logs for you. You own your data. You give us the rights we need to process it to provide Supahound, as described in our Privacy Policy. You may disconnect a project or revoke our access at any time.

5. Hack me scans

• Scan only domains you own or have written permission to test. You must prove control of the domain with the DNS record we issue before any scan runs.
• The scan stays inside the verified domain. We refuse government, military and major platform domains, even with a valid record, and we may refuse any scan at our discretion.
• You must not try to get around domain verification or scope limits, or use Supahound to scan anyone else.
• You accept the scope agreement shown before each scan. We keep a record of that acceptance.
• The scan sends normal web requests to your domain. You are responsible for telling your hosting provider or anyone else who needs to know.

6. Acceptable use

• Do not use Supahound to break the law or to harm, probe or attack systems you do not own.
• Do not try to access other workspaces' data, or to test Supahound's own security without our written permission. Report vulnerabilities to us instead.
• Do not reverse engineer, resell or overload Supahound, except that Agency customers may share client reports with their clients.

7. Plans and billing

The Free plan costs nothing. Paid plans are billed monthly in advance per connected project, through Stripe, and renew automatically until cancelled. The Agency plan has a 10-project minimum. Prices are listed on the pricing page and exclude taxes.

You can cancel at any time. Cancellation takes effect at the end of the current billing period, and we do not refund partial periods unless the law requires it. We will give you at least 30 days' notice of a price increase. If a payment fails, we may move your projects to the Free plan.

8. What Supahound does not promise

Supahound detects suspicious activity; it does not block it. No monitoring tool finds every attack, and Supahound will miss some and may flag activity that is harmless. Supahound does not replace securing your app, your RLS policies or your keys.

Incident summaries and suggested fixes are generated partly by software, including AI models, and can be wrong. Review every suggested fix, especially SQL, before you apply it.

9. Third-party services

Supahound depends on services we do not control, including Supabase's Management API and log retention. Their outages or changes can affect Supahound. Your use of those services is governed by their own terms.

10. Intellectual property and feedback

We own Supahound, its software and its content. These terms give you the right to use Supahound while your account is in good standing. If you send us feedback, we may use it without any obligation to you.

11. Disclaimers

Except as these terms state, Supahound is provided "as is" and "as available", without warranties of any kind, including merchantability, fitness for a particular purpose and non-infringement, to the extent the law allows.

12. Limitation of liability

To the extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, even if told they were possible. Our total liability for any claim about Supahound is limited to the amount you paid us in the 12 months before the claim, or US$100 if you paid nothing.

13. Indemnity

You will defend and indemnify us against third-party claims that arise from your data, your breach of these terms, or a scan of a domain you were not authorized to test.

14. Ending the agreement

You can close your account at any time. We may suspend or close an account that breaks these terms, puts others at risk, or goes unpaid, and we will tell you why unless the law or safety prevents it. Sections 8 to 15 survive the end of this agreement.

15. Law and disputes

The laws of the State of Texas, USA, govern these terms, without regard to conflict-of-law rules. The state and federal courts in Texas have exclusive jurisdiction, and both parties consent to them.

16. Changes and contact

We may update these terms. We will post the change here and, for a material change, email account owners at least 14 days before it takes effect. Continued use after that means you accept the new terms. Questions go to hello@flywheel.so.