Hosting Terms

1. About these terms

These Hosting Terms are the agreement between Fly by wire AB (“we”, “us”) and the business or the individual that uses Koru hosting (“you”). Koru hosting runs the web apps and servers you deploy, with their databases, disks and buckets.

They add to the Koru Terms of Service, which cover your Koru account, the Koru app and Koru Cloud. For Koru hosting, where the two differ, these Hosting Terms apply.

These documents are part of the agreement:

• the Acceptable Use Policy, which says what you may not run, publish or send;
• the Data Processing Agreement, which covers the personal data your apps hold. On personal data it prevails over these terms;
• the prices shown in Koru when you use the service.

Privacy for Koru hosting explains what we keep about your account.

You accept these terms by using Koru hosting. A person who uses it for a business confirms that they may bind the business to these terms. This version applies from 24 October 2026.

2. Who may use Koru hosting

Businesses anywhere may use Koru hosting: companies, sole traders and other organisations that use it for their trade, business or profession. Individuals may use it in the countries we list in Koru; today that is the United States.

When you add a card or buy credit, you give your billing name and address. Outside the countries where individuals may buy, you buy as a business and give your business’s VAT or tax number; our payment provider checks it with the registry it belongs to where it can, such as the EU’s VIES. In the countries where individuals may buy, you buy as an individual unless you give a VAT or tax number. You keep these details up to date. We may ask you to prove your identity or your business before you use Koru hosting or a feature of it.

Where you buy as an individual in the EU, the EU’s consumer rules apply to you as these terms say: prices shown with VAT (5.1), and the right of withdrawal (5.7). They apply only once we list an EU country in Koru.

You need a Koru account to use Koru hosting. You do not need a Koru Cloud subscription.

3. The service

• Where it runs. Your apps, servers, databases, disks and buckets run on servers we rent from OVHcloud in Frankfurt, Germany (section 8).
• How you use it. You manage Koru hosting from the Koru app and its tools, including the AI agents you run in Koru. What you, your team or your agents do with your account counts as done by you. Before anything that costs money is created, Koru shows its price per month.
• Beta. Koru hosting is in beta. We may add, change or remove features, and we tell you ahead of changes that affect your apps whenever we can.
• No uptime promise. During the beta we make no promise of availability, performance or uptime, and we give no service credits.
• Your copies. Keep your own copies of anything you cannot afford to lose. Backups we make protect the platform; they are not a promise that any data can be restored.
• Your domains. Koru hosting does not host DNS. Your domain stays with your own DNS provider, where you point it at your app.
• Email. Our servers do not let apps send email on port 25. Send email through an email provider, with its login.

What we see, and what we do not

We built Koru hosting so that we do not see your secrets or your data:

• The values of your variables are sealed on your device. Koru’s servers keep only their names and ciphertext they cannot open. The values are opened only in the cluster that runs your app, because your app needs them.
• Database passwords are made on your device. Koru’s tunnel carries your database connection encrypted, and bucket files go straight between your device and the store.
• Your app’s logs stream from the cluster to you and are never stored on Koru’s servers.
• When you deploy from your Mac, your project folder is uploaded to Koru’s servers and kept only until the build in the cluster has fetched it and finished. Then it is deleted.
• The servers that run your apps, databases, disks and buckets hold your data, because they have to.
• Our operators have access to the servers that run your apps. They use it only to keep Koru hosting running, to fix problems, or when the law requires it.

4. Your responsibilities

You are responsible for:

• your apps, what they publish and do, and the people who use them;
• having the rights to everything you upload and run;
• following the law, including data protection law for the personal data your apps hold, and giving your own users terms and a privacy policy where the law requires them;
• following the Acceptable Use Policy, and making the people and agents who use your account or your apps follow it;
• keeping your Koru sign-in, your vault and your keys safe, and telling us at once about any use of your account you did not allow;
• keeping a working email address on your account. We send notices to it, about your apps and your invoices among others;
• acting on the notices about your apps that we forward to you, and answering our questions about your apps within the time we give. That time can be short when the law gives us a deadline.

5. Prices, billing and payment

5.1 Prices

Prices are shown in Koru and in each quote, in US dollars. To a business they are shown without VAT. To an individual in the EU they are shown with VAT, worked out by our payment provider, Stripe, wherever a price is offered and again before they pay. An app’s price includes everything it uses: instances, databases, disks, backups, buckets, traffic, builds and domains.

5.2 You pay for what you use

We measure what each app uses and price it by the hour. A line with a monthly price never costs more in a calendar month than that monthly price. Months and weeks in these terms are calendar months and weeks in UTC, and weeks start on Monday.

5.3 Credits

We may give your account credit to use on Koru Hosting: a one-time credit when your account first uses hosting, a monthly credit while you have a Koru Cloud subscription, and credit from a code we give out. Credit we give has no cash value, is never refunded, cannot be transferred or exchanged for money, and ends as we say when we give it: the monthly credit ends with its calendar month. One sign-up credit is given per person or business, whatever the number of accounts or email addresses, and a code gives its credit once per account and once per email address. We give a limited number of sign-up credits each day; when they run out, yours comes on a later day. We may refuse it, change its amount or stop giving it at any time, and we may take back credit given against these terms. Your usage is paid from the credit we give first: the monthly credit, then the sign-up credit, then credit from a code. Then it is paid from prepaid credit you bought, and then by your card.

5.4 Using hosting without a card

You may use Koru Hosting without a card while your credit lasts. Once it runs out, your apps keep running for up to 7 days, or until US$10 of usage is unpaid, whichever comes first. This period is given once per person, whatever the number of accounts or email addresses: accounts that share an email address share one period and one amount. While you have a Koru Cloud subscription, you have this period each time your credit runs out; a period that ends with usage unpaid keeps your apps stopped until you add a card, also in later months, as each month’s Koru Cloud credit pays only that month’s usage. We give a limited number of these periods each day; when they run out, your apps stop until your period begins on a later day, or until you add a card. When the period ends, we stop your apps until you add a card. Stopping keeps your data, and the storage it uses is still charged. When you add a card, we charge it what you owe at once, and your apps start again once that is paid. We tell you by email when this period starts, before it ends and when your apps stop.

5.5 Invoices

We charge your card for your usage that credit did not cover. New accounts are invoiced every week, on Monday, for the week before. Once your account is 3 months old and has paid an invoice, you may choose monthly invoices instead, on the first of each month. We invoice once at least US$5 is due. A smaller amount carries over, and is invoiced at the latest 3 months after the usage, from the smallest amount our payment provider can charge. If your unbilled usage reaches US$100 during a period, we invoice it early. Each invoice line is rounded down to the cent.

5.6 Prepaid credit

You may buy credit in advance, at the price shown in Koru when you buy it, which depends on how much credit one purchase buys. Prepaid credit is in US dollars and pays for Koru Hosting usage only. It does not expire while your account is open, and it cannot be transferred. Credit you used is not refunded. When your account closes, we refund the prepaid credit it has left, after it has paid for your usage that was not invoiced yet, at the price you paid for it and with its VAT in proportion, to the card you paid with. If you turn on automatic top-up, you authorise us to charge your card the price of the same amount of credit each time your prepaid credit falls below the level you set, until you turn it off. While a spending limit applies to your account (5.9), we do not buy it when it would take what is charged to your card in the month to that limit, and we tell you when that happens. If a purchase is refunded or disputed, the credit it bought is removed, as far as it has not been used, and automatic top-up is turned off.

5.7 Right of withdrawal (individuals in the EU)

If you buy as an individual in the EU, you may withdraw from a purchase of prepaid credit within 14 days of it, with the Withdraw from contract here button beside it in Koru’s Billing, or by telling us in any other clear way. Your credit starts as soon as you buy it, at your express request, and you acknowledge when you buy it that credit you used is not refunded on withdrawal, and that once it is all used you can no longer withdraw. When you withdraw, the credit stops paying for your usage, and we refund what it has left at the price you paid, with its VAT in proportion, to the card you paid with, within 14 days. We confirm your withdrawal by email at once, with its date and time.

5.8 Your card

Stripe, our payment provider, keeps your card. We keep only its brand, its last four digits and its expiry date, to show you which card it is. By saving a card you authorise us to charge it for your invoices, for what you owe after using hosting without a card, for your automatic top-ups, and for prepaid credit you buy in Koru at the price shown, which we charge once you have given your bank’s confirmation, if it asks for one.

5.9 Spending limit

A new account has a monthly spending limit that we set, shown in Koru’s Billing. It holds until your account has paid us that much in total: your paid invoices and the prepaid credit you bought count, less what was refunded of it, and a disputed purchase counts for nothing. After that we set no limit. You may also set a monthly limit of your own in Billing, and remove it again: while our limit holds, yours can be no higher than ours, and after that it can be up to the highest limit we allow. A limit counts what is charged to your card in a calendar month, automatic top-ups included, and not usage paid by credit. Wherever a limit applies, we email you when what it counts reaches 80% of it. When it reaches the limit, we email you again, you cannot deploy, and we stop your apps until the next month begins or the limit no longer holds them, for example because you raised or removed your own limit, or bought prepaid credit. Stopping keeps your data, and the storage it uses is still charged.

5.10 Failed payments

If a charge fails, or your bank asks you to approve it, your account is past due: Koru shows it with the date your account will be suspended, and we email you a link to pay. If an invoice is still unpaid 7 days after the first failed charge, we suspend your account: your apps stop, and you cannot deploy or change what runs until every unpaid invoice is paid. Paying lifts the suspension. Your data is kept while your account is suspended. If an invoice is still unpaid 30 days after the suspension, we may end the agreement (section 13).

5.11 Taxes

Prices to a business do not include VAT or other taxes; prices to an individual in the EU include VAT (5.1). We add VAT where the law requires it. Where the reverse charge applies, you account for the VAT.

5.12 Refunds

Usage that was charged is not refunded, except where we made a mistake (5.13), where the law requires it, or as 5.6 and 5.7 say for prepaid credit.

5.13 Questions about an invoice

Tell us within 30 days of an invoice if you think it is wrong. We look into it and correct any mistake. Please talk to us before you dispute a charge with your bank: a card dispute costs us a fee, and we may suspend the account while the dispute is open.

5.14 Price changes

We may change prices with at least 30 days’ notice by email and in Koru. A new price applies from the date given in the notice. A lower price can apply at once.

6. Suspension and removal

6.1 When we may suspend

We may suspend an app, an environment or your account at once, without notice, when that is needed:

• to stop a breach of the Acceptable Use Policy or of the law;
• to stop a threat to the security or the running of the platform, to other customers or to anyone else;
• to follow an order from a court or an authority, or another duty under the law;
• because one of our providers requires it. OVHcloud and Amazon Web Services can suspend our services at once, so we sometimes have to act at once too;
• because an invoice is unpaid (section 5.10).

6.2 The smallest step that works

Where it is enough, we suspend an app before an environment, and an environment before an account. We restore what we suspended once the reason is gone.

6.3 Removal orders

An authority can order us to remove terrorist content, or recruitment content under Swedish law, within one hour of receiving the order (see Contacts for authorities and users). When an order names content your app publishes, we stop the app, or the environment of it that publishes the content, within that hour, and its addresses answer, in every country, that the content is unavailable after a legal order. Its data, builds, databases and buckets stay as they are.

While the order stands, you cannot start, deploy to or delete what we stopped, or its databases and buckets. You can still change its variables and domains, and stop it yourself. If the order is withdrawn or set aside, we start it again as it was, unless you stopped it yourself or your account’s billing keeps it stopped.

As the law requires, we keep a copy of the app and its data as they were when we stopped it: its builds and settings, its databases and disks, and its buckets, which we copy the night after. Data the app holds only in memory, such as in a Valkey, is not kept. We keep the copy for six months, or longer if an authority or a court asks us to, apart from your account: deleting the app or your account does not delete it. Until the copy is made, within a day, you cannot delete what it copies, even once the order is lifted.

When we stop the app, we tell you what we did, which order it was and how to challenge it, unless the authority decides that you must not be told yet. Then we tell you on the date the authority gives us.

6.4 Reasons

When we restrict an app or your account, we tell you what we did, why, and how to ask us to look at it again, as the Acceptable Use Policy describes, unless the law forbids us to.

6.5 Repeat infringers

We end the agreement with customers who repeatedly break the Acceptable Use Policy or infringe other people’s rights.

A suspension made under this section is not a breach of these terms.

7. Switching and leaving (EU Data Act)

These rights come from the EU Data Act (Regulation (EU) 2023/2854). They apply during the beta too.

7.1 Your request

You can ask at any time to switch your apps and data to another provider or to your own systems, or to have your data erased when you leave. If you switch to another provider, tell us which, so that we can help. Send your request by email to support@flybywire.se, the address in section 15.

7.2 Notice period

Switching starts on the date you choose in your request, which can be at most two months after we receive it. If you choose no date, it starts when we receive the request.

7.3 Transition period

From that date you have 30 days to move. During this time the agreement continues, your apps keep running, and we:

• give you, and anyone you authorise, reasonable help with the move, including the information your exit plan needs;
• act with due care to keep your service running as this agreement provides;
• tell you clearly about known risks to its continuity;
• keep your data secure throughout, including while it moves and during the retrieval period.

If 30 days is not technically possible, we tell you within 14 working days of your request, explain why, and give another transition period of at most seven months. You may extend the transition period once, by the time you consider right for your move.

7.4 Retrieving your data

After the transition period, you have at least 30 more days to retrieve your data.

7.5 End and erasure

The agreement ends, and we tell you so, when the switch is complete, or at the end of the notice period if you asked for your data to be erased rather than moved. After the retrieval period we erase all your exportable data and digital assets, and confirm when it is done. Copies of your data in our backups are removed as Annex 2 of the Data Processing Agreement describes. We keep only what the law requires us to keep, such as invoices and copies held under a removal order.

7.6 What you can take with you

This list of your exportable data, with how to take it and in which format, is the register the Data Act asks for. We keep it up to date.

The platform’s own keys (such as the cluster’s sealing key), its internal configuration and its security rules are not part of your exportable data: they belong to how the platform works inside, and handing them out would put other customers at risk.

7.7 No switching charges

We do not charge for switching, nor for the traffic of exporting your data while you switch, and there is no fee or penalty for ending the agreement early. From 12 January 2027 the Data Act forbids switching charges.

8. Where your data is

The servers below hold your data. This is the information the Data Act asks for about the jurisdiction of our infrastructure (Article 28).

The servers that run your apps are subject to the law of Germany and of the EU. Koru’s own servers are subject to the law of Sweden and of the EU.

How we protect your data from authorities outside the EU

• The values of your variables are sealed on your device. Koru’s servers hold only ciphertext.
• The contents of your databases, disks and buckets are encrypted before their backups leave the cluster, so Amazon Web Services holds them only as ciphertext. The cluster’s records of your apps that are backed up with them, such as their names and settings, are protected by Amazon’s own encryption at rest.
• OVHcloud and Hostup are European companies. Amazon Web Services EMEA SARL is in Luxembourg and belongs to a group based in the United States; it holds only backups, with their contents encrypted.
• We give effect to a request from an authority outside the EU only where Article 32 of the Data Act allows it. We hand over no more than the request requires, and we tell you about it unless the law forbids us to.

9. Your content and our software

• What you upload and run stays yours. You give us the rights we need to store, copy, build and run it, only to provide Koru hosting to you.
• Koru, its tools and Koru hosting stay ours. The Koru Terms of Service cover your licence to use the Koru app.
• If you send us ideas or feedback, we may use them without any duty to you.

10. Confidentiality

Each of us keeps the other’s business information that is not public confidential, and uses it only for this agreement, unless the law requires otherwise.

11. Liability

11.1 As it is

During the beta, Koru hosting is provided as it is. We do not promise that it will run without interruption or errors, or that it suits a particular purpose.

11.2 Indirect loss

Neither of us is liable to the other for indirect loss, such as lost profit, lost revenue, lost business, lost data or lost goodwill.

11.3 Our limit

Our total liability under this agreement is limited to the fees you paid for Koru hosting in the 12 months before the event that caused the claim.

11.4 Exceptions

These limits do not apply to loss caused by intent or gross negligence, to personal injury, or to liability that the law does not allow to be limited. They do not limit your duty to pay, nor your indemnity (section 12).

11.5 Events beyond our control

Neither of us is liable for a failure caused by events beyond reasonable control, such as war, natural disasters, epidemics, failures of power or of public networks, strikes, decisions of authorities, or a failure of one of our providers caused by such an event.

12. Your indemnity

You defend us and hold us harmless against claims, fines and costs, including reasonable legal costs, brought by others, our providers and authorities among them, that arise from your apps, your content, your users, or your breach of these terms, the Acceptable Use Policy or the law, as far as the law allows. We tell you promptly of such a claim and let you take part in handling it.

13. Ending the agreement

13.1 By you

You can end the agreement at any time by asking us to switch or erase your data (section 7), or by deleting all your apps and telling us that you want to end it.

13.2 By us, with notice

We can end the agreement with at least 60 days’ notice, for example if we stop offering Koru hosting. Your switching rights in section 7 apply during that time.

13.3 At once

Either of us can end the agreement at once if the other materially breaches it and does not put the breach right within 14 days of a written notice. We can also end it at once for a serious breach of the Acceptable Use Policy, for repeated infringement (section 6.5), for an unpaid invoice (section 5.10), or when the law or an authority requires it.

13.4 Afterwards

You pay for what was used until the end, and we refund the prepaid credit your account has left (5.6). Unless the law prevents it, you have at least 30 days to retrieve your data (section 7.4), and then we erase it (section 7.5). What by its nature should continue after the end, such as payment, liability, the indemnity and confidentiality, continues.

14. Changes to these terms

We may change these terms. We tell you by email and in Koru at least 30 days before a change takes effect, unless the change is required by law or needed for security, in which case it can apply sooner. If you do not accept a change, you can end the agreement before it takes effect, with your switching rights in section 7. If you keep using Koru hosting after a change takes effect, the new terms apply.

15. Notices and contact

We send notices to the email address of your Koru account. You send notices to us at support@flybywire.se.

For abuse, illegal content and authorities, see Abuse, Report illegal content and Contacts for authorities and users.

Fly by wire AB, company registration number 559316-3313, Flädervägen 1 b Lgh 1401, 611 46 Nyköping, Sweden.

16. Law and disputes

Swedish law applies, without its rules on the choice of law. Disputes go to the Swedish courts, with Nyköping District Court (Nyköpings tingsrätt) as the first instance.

17. General

• We may use subcontractors, including the sub-processors listed in the Data Processing Agreement, and we remain responsible for them.
• You may not transfer this agreement without our written consent. We may transfer it to a company that takes over Koru hosting, and we tell you before we do.
• If a part of these terms is invalid, the rest still applies.
• If we do not enforce a right, we have not given it up.
• These terms, with the documents listed in section 1, are the whole agreement about Koru hosting. They are written in English, and the English text applies.