1. The agreement
These Terms are a contract between you and Sink ("Sink", "we", "us"). They apply when you create an account, use the dashboard, call the API, or run the CLI against our hosted service. By doing any of those you accept them.
If you accept on behalf of a company, you confirm you are authorised to bind it, and "you" means that company. Our Privacy Policy and Subprocessors page form part of this agreement.
2. Accounts
- You must be at least 16 and legally able to enter a contract.
- Give accurate account details and keep your email address current — it is how we reach you about security and billing.
- You are responsible for everything done under your account, including by your API keys and by members you invite.
- One human per account. Do not share login credentials; use workspace membership and API keys instead.
- Tell us at [email protected] promptly if you suspect unauthorised access.
3. Workspaces, teams and roles
Sink organises content into workspaces, which contain teams, projects and environments. Members hold roles that determine what they can read and change. Workspace owners and admins can invite and remove members, change roles, and access, modify or delete content within the workspace, including secrets other members created.
If a workspace is created for an organisation, that organisation controls it. We act on the instructions of the workspace owner in any dispute about access, and we are not the arbiter of disagreements between you and your colleagues or employer.
4. Plans, billing and limits
- Plans. Sink offers a free plan and paid plans. Each plan carries limits — on workspaces, seats, projects, environments, secrets and features such as secure sharing. Current limits and prices are on the pricing page, which is incorporated by reference.
- Payment. Paid plans are billed in advance through our payment processor, Bachs, on the cycle shown at checkout. Prices are in US dollars and exclusive of taxes, which we add where required.
- Renewal. Subscriptions renew automatically until cancelled. Cancel any time from the dashboard; cancellation takes effect at the end of the paid period and you keep access until then.
- Refunds. Payments are non-refundable except where the law requires otherwise, or at our discretion. 14 days on first purchase.]
- Failed payment. If a payment fails we may retry, and may downgrade or suspend paid features after notice.
- Downgrades. If you drop to a plan whose limits your usage exceeds, existing content stays readable but you may be blocked from creating more until you are back within the limit.
- Price changes. We will give at least 30 days' notice before a price change affects your renewal.
5. Your content
Everything you put into Sink — secrets, names, descriptions, project structure — stays yours. You grant us only the licence needed to run the service for you: to store, encrypt, transmit, display and back up that content, and to process it as described in the Privacy Policy. We do not use it to train models and we do not sell it.
You are responsible for having the right to store what you store, including credentials that belong to your employer or clients. You are also responsible for keeping your own backups of anything you cannot afford to lose — export is available from the dashboard and CLI.
6. Acceptable use
Do not:
- store credentials you have no right to hold, or use Sink to stage or distribute stolen data;
- break into, probe or disrupt the service, other accounts, or our providers' systems, other than through a good-faith vulnerability report;
- circumvent rate limits, plan limits, entitlement checks or authentication;
- resell the hosted service, or use it to operate a competing secrets product;
- run automated load beyond documented limits, or use the service in a way that degrades it for others;
- upload malware, or use Sink to conduct anything unlawful;
- use the service where doing so would breach sanctions or export control law.
Security research is welcome within the bounds above: test against your own workspace, do not touch other users' data, and report findings to [email protected] before disclosing publicly.
7. API, CLI and API keys
The API and CLI are part of the service and these Terms apply to them. API keys carry the permissions of the account that created them: treat a key as a password, scope it, set an expiry, and revoke it when it is no longer needed. You are responsible for anything done with a key issued from your account, including by CI systems you install it on.
We may change or deprecate API endpoints. For breaking changes to documented endpoints we will give reasonable notice, normally 14 days, through the changelog and by email.
8. Share links
Secure share links let you hand secrets to someone without an account. A link is redeemable by anyone who holds the token, up to the view limit and expiry you set — that is how it works, not a defect. Distribute links over a channel you trust, set the tightest limit and shortest expiry that will do, and treat a leaked link as a leaked secret: revoke and rotate.
9. Third-party integrations
Sink can import environment variables from providers such as Railway, Vercel and Render, and can sign you in via Google or GitHub. When you connect one, you authorise us to use the token or grant you supply to perform the actions you request. Those services are outside our control and governed by their own terms; we are not responsible for their availability, or for what they do with data you hold on them.
10. Availability and support
We aim to keep Sink available and fast, and we perform maintenance with as little disruption as we can. No uptime SLA applies to the free plan.
Support is by email at [email protected], during business hours, on a best-effort basis unless your plan says otherwise.
11. Security responsibilities
We encrypt every secret value with a per-version AES-256-GCM data key that is itself encrypted under a master key held outside the database, enforce role-based access, rate limit sensitive routes, and keep an audit trail. This is not end-to-end encryption: the hosted service can decrypt values in order to serve them to you.
On your side: protect your credentials, use strong authentication, review workspace membership when people leave, rotate secrets on a schedule, and remove access you no longer need.
12. Our intellectual property
The service, the dashboard, the site and the Sink name and marks are ours or our licensors'. These Terms grant you a limited, non-exclusive, non-transferable right to use the service while this agreement is in force, and nothing more. Do not copy, reverse engineer or create derivative works from the hosted service except where the law says you may.
If you send us feedback or suggestions, we may use them freely and without obligation to you.
13. Suspension
We may suspend an account or workspace, with notice where practical and immediately where it is not, if we reasonably believe it is breaching section 6, harming the service or other users, compromised, or in unresolved non-payment. We will restore access once the cause is resolved.
14. Termination
You may stop using Sink and delete your account at any time. We may terminate this agreement on 30 days' notice, or immediately for material breach. On termination your right to use the service ends, and your content is deleted on the schedule in the Privacy Policy. Export anything you need before you delete.
Sections 5, 12, 15, 16, 17, 19 and 20 survive termination.
15. Disclaimers
Except as expressly stated here, the service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service will be uninterrupted, error-free or secure against every attack. Some jurisdictions do not allow these exclusions; where that is so, they apply to the extent permitted, and nothing here limits rights that consumer law gives you and does not allow us to exclude.
16. Limitation of liability
To the fullest extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, however caused.
Our total aggregate liability arising out of or relating to this agreement is limited to the greater of the amounts you paid us in the 12 months before the event giving rise to the claim and [USD 100].
Nothing here excludes liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or anything else that cannot lawfully be excluded.
17. Indemnity
You will defend and indemnify us against third-party claims arising from your content, your use of the service in breach of these Terms, or your violation of law or of another's rights. We will notify you of any such claim and let you control the defence, provided any settlement releases us fully.
18. Changes to these Terms
We may update these Terms. For material changes we will give at least 30 days' notice by email or in the dashboard before they take effect. Continuing to use Sink after that means you accept the new version; if you do not, stop using the service and cancel.
19. Governing law and disputes
These Terms are governed by the laws of Federal Republic of Nigeria, without regard to conflict of law rules, and the courts of Nigeria have exclusive jurisdiction — except that consumers keep the protection of the mandatory law of their country of residence.
Before filing a legal claim, you agree to first contact us at [email protected] and give us a reasonable opportunity to resolve the dispute informally. We believe that most disputes can be resolved more quickly and at lower cost by email than through court proceedings. Nothing in this section limits any mandatory rights or protections you have under the laws of your country or place of residence.
20. General
- Entire agreement. These Terms, the Privacy Policy and the Subprocessors page are the whole agreement on this subject and supersede earlier discussions.
- Severability. If a provision is unenforceable, the rest stands.
- No waiver. Not enforcing a right once does not waive it.
- Assignment. You may not assign without our consent; we may assign to an affiliate or acquirer.
- Force majeure. Neither party is liable for failure caused by events beyond its reasonable control.
- Notices. To you, by email or dashboard notice; to us, at [email protected].
- Independent parties. Nothing here creates a partnership, agency or employment relationship.