Terms of Service

Last updated: 14 October 2026, effective: 3 August 2026

Changes on 14 October 2026: section 4.1 adds classified information and export-controlled technical data to the content we cannot host; that change takes effect 30 days after we notify you by email (section 14.1). Section 5.7 adds a confidentiality undertaking for Customer Data, section 10.4 counts deletion from the termination date (within 90 days after termination, backups within 90 days after that) and adds written confirmation of deletion on request, and section 17.5 points audit rights at the DPA; these apply from this date because they are in your favour.

Changes on 9 October 2026: section 2.1 corrects a statement that hosted CI runners are not available on Solo (they are, with 200 minutes per month). Section 5.4 clarifies that currently only the founder has production access. Section 7.1 adds a note on what the status page measures.

Changes on 25 September 2026: section 3.10 adds terms for SEPA Direct Debit collection when you pay by a bank payment method; that change takes effect 30 days after we notify you by email (section 14.1).

Changes on 21 September 2026: section 10.6 raises our notice to you from 30 to 90 days, and applies from this date because it is in your favour. Section 5.4 now also covers individual contractors bound by the same confidentiality obligations as employees; that change takes effect 30 days after we notify you by email (section 14.1), and until then access stays limited to employees.

These Terms of Service ("Terms") govern your use of the Codebahn service ("Service") operated by Hackerman AB, a Swedish limited company (org. nr. 559079-1918), with its registered office in Gothenburg, Sweden ("Hackerman", "we", "us").

By creating an account you agree to these Terms. If you create an organisation and subscribe on behalf of a company, you agree to these Terms on behalf of that company ("Customer", "you"). If you do not have authority to bind your company, do not proceed.

1. What the Service does

Codebahn is managed Git hosting built on Forgejo. The Service provides private Git repository hosting, issue tracking, pull request management, container and package registries, hosted CI runners, daily encrypted backups, and a web dashboard. All infrastructure runs on EU-based servers operated by EU-incorporated providers.

The Service does not include:

• Consulting, custom development, or migration services beyond the self-service tools in the product.
• Guarantees about the behaviour of third-party GitHub Actions used in CI workflows. Actions are resolved from external sources and run in isolated containers, but their behaviour is outside our control.

2. Accounts

2.1. Personal accounts. Any individual may create a personal account. Personal accounts may subscribe to the Solo plan, which includes 2 GiB of Git storage, 50 GiB of object storage, a container registry, daily encrypted backups, bring-your-own-runner support, and hosted CI with 200 minutes per month. Team features are not available on the Solo plan.

2.2. Organisations. Organisations are shared accounts that require a paid subscription. A personal account can belong to multiple organisations.

2.3. You must provide accurate registration information and keep it current.

2.4. You are responsible for all activity under your account, including actions by anyone you grant access to.

2.5. You must notify us promptly at security@codebahn.net if you believe your account has been compromised.

3. Subscription and payment

3.1. The Service is offered in paid plans (currently Solo and Crew). Pricing, feature limits, and included resources are published at codebahn.net and may change with 30 days' notice. Existing subscriptions are not affected by price increases until their next renewal. The Crew plan is billed per organization member; storage allocations scale with the member count; hosted CI minutes are a fixed monthly pool with optional top-ups.

3.2. Subscriptions are billed monthly or annually in advance. Payments are processed through Mollie B.V., an EU-based payment provider registered in the Netherlands.

3.3. Compute minutes are hard-capped. When your allocation is exhausted, new CI jobs pause until the next billing period or until you purchase a top-up. Running jobs receive a 30-minute grace window to complete. Top-up minutes persist until consumed and do not expire. You may enable automatic top-ups, which authorize us to charge your payment method for the number of top-up packs you choose (1 to 10, each at the listed per-pack price plus VAT) when your remaining compute minutes drop below 60. You set a maximum number of automatic top-ups per calendar month (1 to 10); no charges occur beyond that maximum. Automatic top-ups are off by default, require a valid payment mandate, and are revocable at any time from your billing settings. They are invoiced the same as manual top-ups.

3.4. Storage usage beyond your plan's included allowance is billed as overage at the published rate, invoiced with the following billing cycle. Overages under EUR 1 roll to the next month.

3.5. If payment fails, we will notify you and provide a 14-day grace period. If payment is not resolved within that period, we may restrict the organisation to read-only access. Restriction does not delete your data; see section 10 for data retention.

3.6. All fees are exclusive of VAT or other applicable taxes, which will be added where required by law. If you provide a valid EU VAT number, reverse charge applies where permitted.

3.7. You may cancel your subscription at any time through the dashboard. The subscription remains active until the end of the current billing period. Fees already paid are not refunded for the remaining period, except as required by law or under the guarantee in 3.9.

3.8. If you are a consumer (not acting on behalf of a business) and you subscribe to a paid plan, you have the right to withdraw within 14 days of purchase under the Swedish Distance Contracts Act (distansavtalslagen). To withdraw, email hello@codebahn.net within 14 days. We will refund the subscription fee. If you have actively used the Service during this period, we may deduct a proportional amount for the service already provided.

3.9. 14-day money-back guarantee. In addition to any statutory right under 3.8, we offer a 14-day money-back guarantee on the first subscription taken by an organisation or personal account. If you tell us within 14 days of your first payment that the Service is not right for you, we refund that payment in full, including VAT, with no deduction for usage during the period. To claim, email hello@codebahn.net. No form and no justification is required. We process refunds to the original payment method within 14 days of the request. On refund the subscription ends, and the data retention terms in section 10 apply. This guarantee covers monthly and annual subscriptions, applies once per organisation or personal account, and does not cover CI top-up purchases where minutes have been consumed. It does not limit or replace your rights under 3.8 or under applicable consumer law.

3.10. SEPA Direct Debit. If you pay by a bank payment method (iDEAL, SEPA Direct Debit), we collect subscription fees by SEPA Direct Debit through Mollie. Collection happens on the renewal date, for the agreed subscription amount. You authorize this recurring collection when you add a bank payment method at checkout. Under SEPA rules, you may reverse a collection within 8 weeks through your own bank, with no reason required. Our Creditor Identifier is shown on your mandate confirmation and invoices.

4. Acceptable use

4.1. The Service is for hosting software development projects. You must not use the Service to:

• Store or distribute content that is illegal under Swedish or EU law.
• Host cryptocurrency mining workloads, phishing infrastructure, or malware distribution.
• Circumvent resource limits through automated account creation or other means.
• Interfere with the Service or other customers' use of the Service.
• Store information that a government has classified at any level, for example RESTREINT, NATO RESTRICTED or above. Codebahn is not an accredited system for classified information.
• Store technical data under export controls that require the hosting provider to be unable to read it, such as ITAR or the EAR encryption carve-out. We hold the encryption keys and can technically read Customer Data (section 5.4), so we cannot meet that condition.

4.2. All repositories on Codebahn are private. Public repository hosting is not offered.

Reporting and enforcement

4.3. Anyone may report content they believe to be illegal or in violation of these Terms by emailing abuse@codebahn.net. The full reporting process is described at codebahn.net/abuse.

4.4. When we receive a report, we review it and may inspect the reported content. We decide whether to take no action, remove or restrict the content, issue a warning, suspend the account, or terminate the account. We aim to reach a decision without undue delay.

4.5. Before we restrict or remove content, we notify the affected account holder with: (a) the restriction applied, (b) the facts and legal grounds for the decision, and (c) how to contest it. If a report concerns content that poses immediate risk (active malware, for example), we may restrict access first and notify the account holder afterward.

4.6. Either the reporter or the affected account holder may contest a decision by replying to the notification. We review contested decisions and may reverse, modify, or uphold the original action.

4.7. We do not use automated tools to monitor or filter Customer Data for policy violations. Enforcement is based on reports and, where applicable, lawful orders from authorities.

Law enforcement and authorities

4.8. Our single point of contact for EU member state authorities under the Digital Services Act (Regulation 2022/2065) is legal@codebahn.net. We respond to lawful requests from EU and Swedish authorities that are in writing, cite a legal basis, and identify the content or data at issue.

4.9. When we become aware of content that gives rise to a suspicion of a criminal offence involving a threat to the life or safety of a person, we promptly report it to the relevant law enforcement authority.

5. Your data

5.1. Ownership. Your code, issues, pull requests, CI artifacts, and all other content you upload to the Service ("Customer Data") belong to you. We claim no intellectual property rights over Customer Data.

5.2. License to operate. You grant us the limited right to store, process, transmit, and display Customer Data as necessary to operate the Service. This includes making backups, running CI builds, serving repository content to authorised users, and any other processing required to provide the features you use.

5.3. No selling or mining. We do not sell, license, or use Customer Data for any purpose other than operating the Service. We do not train machine learning models on Customer Data. We do not analyse repository content for advertising or profiling.

5.4. Access. Unlike end-to-end encrypted services, we have technical access to Customer Data as part of operating the infrastructure. Administrative access is limited to Hackerman AB personnel bound by confidentiality obligations and acting only on our instructions. Currently, only the founder has production access. Access is used only for infrastructure operations, debugging, and responding to support requests. We do not access the content of your repositories unless required to investigate a specific support request, security incident, or abuse report.

5.5. Export. You may export your data at any time using Forgejo's standard export functionality. No ticket or approval is required. Your data is in standard Git format; any Git client can clone it.

5.6. Portability. Codebahn runs Forgejo. A Forgejo export from Codebahn can be imported into any other Forgejo or Gitea instance. We do not use proprietary formats or features that create lock-in.

5.7. Confidentiality. We treat Customer Data as confidential. We do not disclose it to anyone other than the sub-processors listed under section 6.3, acting under the DPA, and personnel bound by section 5.4, except where the law requires disclosure, in which case we tell you first unless the law forbids it. This undertaking survives termination for as long as we hold any copy.

6. Data processing and privacy

6.1. Our processing of personal data is governed by our Privacy Policy, which forms part of these Terms.

6.2. By creating an account, you agree to our Data Processing Agreement (codebahn.net/dpa) under GDPR Article 28, which applies to all customers and forms part of these Terms.

6.3. All data is stored on infrastructure operated by EU-incorporated providers. We do not use US-incorporated sub-processors anywhere in the data path. The current list of sub-processors is published at codebahn.net/docs/subprocessors.

7. Service availability

7.1. We target 99.9% monthly uptime for the Service, measured as the percentage of minutes in a calendar month during which the Git API, web interface, and CI runner API respond to authenticated requests. Planned maintenance windows, announced at least 24 hours in advance, are excluded. The public status page currently monitors the health endpoint and SSH availability; it does not yet measure each component listed here individually.

7.2. This is a target, not a contractual SLA with financial remedies. If we consistently miss this target, you may terminate your subscription without penalty.

7.3. We may modify, deprecate, or discontinue features of the Service with reasonable notice. For changes that materially reduce functionality you are actively using, we will provide at least 60 days' notice and allow you to terminate without penalty if you object.

8. Backups and disaster recovery

8.1. We perform daily encrypted backups of all Customer Data. Backups are stored in a separate EU region from the primary infrastructure.

8.2. Backups are for disaster recovery of the Service as a whole. They are not a substitute for your own backup practices. We do not guarantee the ability to restore individual repositories, issues, or other data on request.

8.3. If you accidentally delete data, contact us promptly. We will make reasonable efforts to restore from backup, but cannot guarantee success.

9. Open-source components

9.1. Codebahn is based on Forgejo, which is licensed under the GNU General Public License v3.0 (GPL-3.0). Our modifications to Forgejo are also licensed under GPL-3.0, as required by the license.

9.2. The source code of our Forgejo fork is available in accordance with GPL-3.0 obligations.

9.3. The open-source license governs the software. These Terms govern the hosted Service. You may run the software yourself without a Codebahn subscription; the subscription covers managed hosting, CI runners, backups, support, and infrastructure operations.

10. Term and termination

10.1. These Terms take effect when you create an account and remain in effect until terminated.

10.2. You may terminate at any time by cancelling your subscription through the dashboard or by emailing hello@codebahn.net. The subscription remains active until the end of the current billing period.

10.3. We may terminate or suspend your access if you breach these Terms, fail to pay after the grace period in section 3.5, or if required by law. We will notify you in writing before or at the time of termination, except where prohibited by law.

10.4. Data retention after termination. On termination, your organisation is set to read-only for 30 days. During this period you can clone repositories and export data. We delete Customer Data from live systems within 90 days after termination. Backups containing your data are rotated out within 90 days after deletion, so no copy remains later than 180 days after termination. On request we confirm deletion in writing.

10.5. Switching to another provider. You may switch to another provider, or to your own infrastructure, at any time. We will complete the switch within 30 calendar days of your request. During that period we will provide reasonable assistance, tell you about any risk to continuity that we are aware of, and keep your data secure. Where you ask us to switch while your subscription is still running, the Service stays fully available throughout. Where your subscription has already ended, section 10.4 applies and your organisation is read-only, which is enough to retrieve everything but is not a running service. If a switch cannot be completed within 30 days for technical reasons, we will tell you in writing within 14 working days of your request, explain why, and agree a revised period with you.

10.6. Notice. We do not require notice to cancel. If you ask us to start a switch, no notice period applies to you. Where we terminate for a reason other than your breach of these Terms or non-payment, we will give you at least 90 days' written notice.

10.7. Retrieving your data. Your data remains retrievable for at least 30 days after a switch completes or your subscription ends, whichever is later. Section 10.4 governs deletion after that period.

10.8. No charge for leaving. We do not charge switching, egress, exit or migration fees, and we will not introduce any. This applies to every plan.

10.9. How switching works in practice. The procedure, the formats your data comes out in, what transfers cleanly and what does not, is set out at codebahn.net/leaving. That page forms part of these Terms.

10.10. Personal accounts. Personal accounts (Solo plan) without a paid subscription are retained indefinitely unless you delete your account or we terminate it for cause. We reserve the right to delete inactive personal accounts (no activity for 12 consecutive months) with 30 days' notice.

11. Limitation of liability

11.1. Aggregate cap. Hackerman's total aggregate liability arising out of or related to these Terms, whether in contract, tort, or otherwise, is limited to the fees you paid to Hackerman in the twelve (12) months immediately preceding the event giving rise to the claim. For personal accounts (no fees paid), the aggregate cap is EUR 100.

11.2. Consequential damages exclusion. To the maximum extent permitted by applicable law, Hackerman is not liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to: loss of data, loss of revenue, loss of profits, cost of replacement services, or business interruption, however caused and regardless of theory of liability.

11.3. Data loss. Without limiting section 11.2, Hackerman is not liable for loss of Customer Data beyond making reasonable efforts to restore from backups as described in section 8. The Service is not a substitute for your own backup practices.

11.4. CI execution. Hackerman is not liable for any loss arising from CI workflow failures, including failed builds, incorrect test results, or workflows that produce unintended side effects. CI workflows are defined and maintained by the Customer.

11.5. The limitations in this section apply even if Hackerman has been advised of the possibility of such damages and even if a limited remedy is found to have failed its essential purpose.

11.6. Nothing in these Terms excludes or limits liability for (a) death or personal injury caused by negligence, (b) fraud or fraudulent misrepresentation, or (c) any other liability that cannot be excluded or limited under applicable law.

12. Warranty disclaimer

12.1. The Service is provided "as is" and "as available." To the maximum extent permitted by applicable law, Hackerman disclaims all warranties, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

12.2. We do not warrant that the Service will be uninterrupted, error-free, or secure, or that any defects will be corrected within a specific timeframe.

13. Indemnification

13.1. You agree to indemnify and hold harmless Hackerman, its officers, and employees from any claims, damages, or expenses (including reasonable legal fees) arising from: (a) your use of the Service in violation of these Terms, (b) your breach of applicable law, (c) any third-party claim related to content you host on the Service, or (d) your CI workflows or Actions that cause harm to third parties.

13.2. We will notify you promptly of any such claim and cooperate reasonably in its defense.

14. Changes to these Terms

14.1. We may update these Terms from time to time. We will notify you of material changes at least 30 days before they take effect, by email to the address associated with your account.

14.2. Your continued use of the Service after the effective date of a change constitutes acceptance. If you disagree with a material change, you may terminate your subscription before the change takes effect without penalty.

15. Governing law and dispute resolution

15.1. These Terms are governed by the laws of Sweden, without regard to conflict-of-law principles.

15.2. Any dispute arising out of or in connection with these Terms shall be resolved by the courts of Gothenburg, Sweden.

16. Miscellaneous

16.1. Entire agreement. These Terms, together with the Privacy Policy, DPA (where applicable), and any subscription confirmation, constitute the entire agreement between the parties regarding the Service.

16.2. Severability. If any provision is found unenforceable, the remaining provisions continue in effect.

16.3. Assignment. You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of our assets, with 30 days' notice to you.

16.4. Waiver. Failure to enforce a provision is not a waiver of the right to enforce it later.

16.5. Notices. Notices to us should be sent to legal@codebahn.net. Notices to you will be sent to the email address on your account.

16.6. Force majeure. Neither party is liable for delays or failures caused by events beyond reasonable control, including natural disasters, war, government action, or widespread internet outages.

17. Regulated customers

17.1. Who this is for. If you are subject to DORA (Regulation (EU) 2022/2554), to NIS2 as transposed where you operate, or to comparable sector rules, this section gives you undertakings those rules require you to obtain from your providers. It applies on every plan, and you do not have to ask for it.

17.2. Cooperation with your authorities. We will cooperate fully with your competent authorities and your resolution authorities, and with persons appointed by them, in anything concerning the Service.

17.3. Awareness and resilience training. At your request we will take part in your ICT security awareness programmes and your digital operational resilience training, up to one session per contract year, held remotely, on at least 30 days' notice. Further sessions are agreed in writing in advance.

17.4. Service levels. The service level description is section 7, and section 7.3 sets the notice we give before revising it. Section 7.2 says plainly that it carries no financial remedies, which is a fact for your assessment rather than a gap we are hiding.

17.5. What this section does not do. Your audit rights are those in section 11 of the DPA, which puts documentation first and on-site inspection where that is not sufficient; this section adds no inspection right beyond them, and it does not commit us to take part in threat-led penetration testing. If the function you run on us is a critical or important one, read codebahn.net/dora first, because we are probably the wrong supplier.