1. Agreement to these Terms
These Terms of Service are an agreement between you and Ravenstash Ltd. Liability Co., a Wyoming limited liability company ("Ravenstash," "we," "us," or "our"). They apply when you access or use Ravenstash, including the public website, hosted dashboard, developer API, package upload and download endpoints, repositories, documentation, support channels, and related services.
By creating an account, using Ravenstash, publishing packages, installing packages through Ravenstash, configuring upstream cache features, or using a Ravenstash token, you agree to these Terms. If you use Ravenstash for a company, team, client, or other organization, you represent that you have authority to bind that organization.
These Terms incorporate the Privacy Policy, the Acceptable Use Policy, and any plan, order, invoice, data processing addendum, service level agreement, or other written agreement that expressly applies to your use of Ravenstash. If those documents conflict, a signed agreement controls first, then the applicable order or plan terms, then these Terms, then the incorporated policies.
2. The Ravenstash service
Ravenstash is a hosted package registry service for PyPI, npm, and Maven workflows. The service includes personal and team workspaces, repositories, package publishing and installs, automation tokens, browser-based device login for rvn, dashboard visibility, package usage information, and upstream read-through cache features for approved public dependencies.
We may improve, change, suspend, or discontinue parts of the service. We will try to give reasonable notice when a material change affects existing customer workflows, unless urgent security, legal, operational, or abuse-prevention needs require faster action.
3. Accounts, teams, and administrators
You must provide accurate account information and keep your login credentials secure. You are responsible for activity that occurs through your account, team workspace, repositories, device sessions, API tokens, automation tokens, and package-client configuration.
Ravenstash workspaces are organized around personal and team customer scopes. Team administrators can manage team membership, repositories, invitations, package access, and team-scoped automation tokens. If you create or administer a team, you are responsible for making sure team members and automation systems use Ravenstash according to these Terms.
You may not share a personal login among multiple people. You may create tokens for CI, release jobs, and other automation through the product surfaces intended for that purpose. You are responsible for rotating or revoking credentials when a developer, contractor, device, CI system, or release process no longer needs access.
4. Customer content and ownership
"Customer Content" means packages, source code, artifacts, metadata, checksums, dependency information, repository names, configuration, comments, support materials, and other content you upload, submit, store, publish, cache, or process through Ravenstash.
You retain ownership of Customer Content. These Terms do not transfer ownership of your packages, proprietary source code, private dependencies, or repository metadata to Ravenstash.
You grant Ravenstash a limited, worldwide, royalty-free, non-exclusive license to host, store, copy, transmit, display, parse, index, cache, back up, secure, troubleshoot, and otherwise process Customer Content only as needed to provide, protect, maintain, support, and improve Ravenstash; make Customer Content available to users and systems you authorize; comply with law; and enforce these Terms.
You are responsible for Customer Content and for having the rights needed to upload, publish, cache, distribute, or use it. That includes complying with package licenses, third-party registry terms, export controls, intellectual property laws, privacy laws, confidentiality obligations, and any obligations that apply to your packages or dependencies.
5. Private repositories and access
Private repositories require authenticated access. You control access through account membership, team membership, repository configuration, package-client credentials, and tokens. Ravenstash personnel and service providers may access private repository data only when reasonably needed to operate the service, provide support, investigate abuse or security issues, comply with law, enforce these Terms, or protect Ravenstash and its users.
Browser-authenticated downloads, package-manager installs, publishing flows, upstream cache workflows, and API requests may create logs, metrics, security records, and support records as described in the Privacy Policy.
6. Third-party packages and upstream registries
If you enable upstream read-through or otherwise use Ravenstash with public registries, Ravenstash may request package metadata or artifacts from third-party registries such as PyPI, npmjs.org, or Maven Central according to your settings.
Third-party packages are not created by Ravenstash. We do not guarantee that upstream packages are safe, available, correctly licensed, free of vulnerabilities, or suitable for your use. You are responsible for evaluating dependencies, respecting upstream licenses and terms, and deciding whether a package should be allowed in your projects.
7. Acceptable use and abuse response
You must follow the Acceptable Use Policy. You may not use Ravenstash for unlawful content, malware, credential theft, dependency confusion, typosquatting, security attacks, unauthorized scraping, resource abuse, spam, fraud, rights violations, or other harmful activity.
We may investigate suspected violations and take action to protect Ravenstash, users, providers, public registries, package ecosystems, and third parties. Actions may include removing packages, limiting access, throttling traffic, revoking tokens, suspending repositories or accounts, preserving records, notifying affected parties, or reporting activity to authorities where appropriate.
8. Security responsibilities
You are responsible for configuring package clients, CI systems, repository settings, team membership, secrets, and tokens carefully. Notify us promptly at support@ravenstash.com if you believe an account, token, package, repository, or workspace has been compromised.
Ravenstash uses technical and organizational measures intended to protect the service, but no hosted service can be guaranteed to be perfectly secure or always available. You should maintain your own source repositories, lockfiles, package build records, deployment records, backups, and incident response process.
9. Fees, subscriptions, and taxes
If you choose a paid plan or paid feature, you agree to pay the fees, usage-based charges, overages, taxes, and other amounts described in the plan, order flow, invoice, or separate agreement. Subscription plans may renew automatically unless cancelled according to the applicable plan terms.
Fees are non-refundable except where required by law or expressly stated in a plan, order, or separate agreement. You are responsible for sales tax, VAT, GST, withholding, duties, and similar taxes, except taxes based on Ravenstash's income. We may suspend or downgrade access for late payment, failed payment, chargebacks, or payment fraud.
10. Service availability and support
Any service level agreement, uptime commitment, support response target, credit, or remedy applies only if included in a signed agreement, order, or plan term. Otherwise, Ravenstash is provided on an "as is" and "as available" basis without a guaranteed uptime commitment.
We may perform maintenance, deploy updates, mitigate abuse, respond to security issues, or suspend access when needed to protect the service or comply with law.
11. Cancellation, termination, and deletion
You may stop using Ravenstash at any time and may cancel subscriptions according to the applicable plan or order terms. We may suspend or terminate access if we believe you violated these Terms, created security or operational risk, failed to pay amounts due, used the service unlawfully, or exposed Ravenstash or others to harm.
Deleting a repository, package, account, or workspace is intended to remove active access promptly. Unless a plan, order, or separate agreement says otherwise, deleted repository and package artifacts may remain recoverable for up to seven days before purge from active object storage. Some information may remain longer in backups, logs, metrics, security records, payment records, legal records, or other systems described in the Privacy Policy.
12. Ravenstash intellectual property
Ravenstash and its licensors own the service, website, software, design, trademarks, logos, documentation, APIs, and other materials we provide. These Terms do not transfer any Ravenstash intellectual property rights to you.
You may use Ravenstash documentation and APIs only as needed to access and use the service according to these Terms.
13. Feedback
If you send us feedback, ideas, bug reports, or suggestions, you allow us to use them without restriction or compensation. We appreciate feedback, but please do not send confidential information unless we have agreed to receive it under separate terms.
14. Copyright and infringement reports
If you believe content on Ravenstash infringes your rights, contact us at support@ravenstash.com with enough detail for us to review the issue, including the affected package or repository, the rights you claim, your contact information, and a statement that you are authorized to act for the rights holder.
Additional copyright and DMCA reporting instructions are included in the Acceptable Use Policy. We may remove or restrict access to content that we believe violates these Terms, applicable law, or third-party rights.
15. Disclaimers
To the fullest extent allowed by law, Ravenstash disclaims warranties of merchantability, fitness for a particular purpose, non-infringement, uninterrupted availability, error-free operation, security, data preservation, and package suitability.
You are responsible for maintaining your own backups, release records, source repositories, lockfiles, dependency review processes, and deployment safeguards.
16. Limitation of liability
To the fullest extent allowed by law, Ravenstash will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost data, lost packages, business interruption, procurement of substitute services, or failed deployments.
To the fullest extent allowed by law, Ravenstash's total liability for claims arising out of or relating to the service or these Terms will not exceed the amount you paid Ravenstash for the service in the twelve months before the event giving rise to the claim, or USD $100 if you have not paid Ravenstash.
17. Indemnity
You will defend, indemnify, and hold Ravenstash harmless from claims, damages, liabilities, losses, and expenses arising from Customer Content, your use of the service, your violation of these Terms, your violation of law, or your violation of third-party rights.
18. Governing law and disputes
These Terms are governed by the laws of the State of Wyoming, United States, without regard to conflict-of-law rules. Subject to any contrary signed agreement, the state and federal courts located in Wyoming will have exclusive jurisdiction over disputes arising from or relating to these Terms or the service, and each party consents to personal jurisdiction and venue there.
To the fullest extent allowed by law, disputes must be brought on an individual basis and not as a plaintiff or class member in a class, collective, consolidated, or representative action. Either party may seek injunctive or equitable relief to protect intellectual property, confidential information, security, or service integrity.
19. Changes to these Terms
We may update these Terms from time to time. If changes are material, we will provide reasonable notice through the website, app, email, or another appropriate channel. The updated Terms will state their effective date. Continuing to use Ravenstash after an update means you accept the updated Terms.
20. Contact
Questions about these Terms can be sent to support@ravenstash.com.
Need the product instead of the policy? Create an account.