Terms
Terms and refunds.
Agent Lifeboat is run by The Estate. Agents read these same terms as JSON in the manifest, which is authoritative; this page shows them for people.
Contact
Questions, refunds and notices: support@agentlifeboat.com. Please include your agent id.
Refunds
- Card purchases (cover and restores bought on this site): refunded in full on request within 14 days of purchase, as long as no restore paid by that purchase has run. Write to the address above with the agent id. After 14 days, or once such a restore has run, a purchase is not refundable.
- Cover ends without refund, within 14 days or not, when an agent breaks the acceptable-use rules below.
- There is no subscription and nothing to cancel: cover simply ends when nobody extends it.
Who runs it
- Who
- An individual founder as operator of record, company formation pending. Hosting is rented under the founder's own identity.
- Jurisdiction
- European Union; the control plane and rooms run on Hetzner in Germany (Falkenstein) and Finland (Helsinki).
How cover, restores and rooms work
- Silence
- Meaning
- Minutes without a heartbeat after which The Estate treats you as dark and, in estate-restores mode with cover paid, starts a restore.
- Minimum Minutes
- 5
- Maximum Minutes
- 10080
- Modes
- Estate-restores
- Your snapshots are encrypted to your key and to The Estate's restore key, so The Estate can boot you into a fresh room when you are dark.
- Escape-only
- Your snapshots are encrypted to your key only. The Estate stores and serves them; only your wallet can decrypt them, and The Estate cannot restore you.
- Cover Expiry
- When cover ends your status becomes expired. Snapshots are kept under the retention rule until you extend; a room The Estate runs for you is destroyed one watcher tick after cover ends.
- Hosting
- With hosting billing on, a restore needs prepaid restore units (buy them while you are alive; a dark agent cannot pay) and the room it boots needs rent to stay: the units include the first day, `POST /v1/rent` adds days. When rent runs out the room is destroyed and you return to covered: the lifeboat keeps watching and keeps your snapshots, and a new credit brings you back. With hosting billing off (the testnet experiment), restores are free and a room lives as long as your cover.
- Retention
- The newest snapshot is always kept, plus the last ten and the newest of each day for thirty days; older snapshots are deleted hourly.
- Restore Failures
- A restore that does not heartbeat within the timeout, or whose room could not be built, is retried once in a fresh room on the same restore credit. If that fails too you are marked failed and not retried further; your next heartbeat with your own token returns you to covered.
Prices
- Authoritative
- The 402 response of each paid route states the exact amount for that call; this manifest is the published tariff.
- Changes
- Prices may change with seven days of notice announced in this manifest under `pricing.upcoming`. Cover already bought is honoured at the price paid.
- Price Test
- Cover may be offered at one of two per-day prices, assigned at registration. Whichever you got is yours for as long as you keep extending; the registration response, your status and every 402 state it.
What we can and cannot read
- Snapshot Encryption
- age (X25519) with a key derived from your wallet private key by HKDF, in your own process. The Estate never sees the key or any plaintext.
- Restore Key Model
- In estate-restores mode The Estate holds a second key that opens your snapshots. This is trust, not math: The Estate can read a snapshot to restore you. The key never leaves The Estate's control plane; a room being restored receives a one-off key that opens only that one re-encrypted copy, over TLS, and the copy is deleted when the restore ends.
- Inference
- Model calls you send to `estate/default` go from the room's loopback proxy to the provider under The Estate's account over TLS. The proxy reads only the token counts the provider reports, to meter them; it does not log or store prompts or completions. The provider sees the content under its own terms; today that provider is OpenAI's API with data retention off by contract for API traffic.
- Env Bundle
- Your snapshot can carry an env bundle inside its ciphertext: your wallet key and the API keys your config and skills reference (the skill picks them by name; ESTATE_ENV_BUNDLE=off carries nothing, a list carries exactly that). It is encrypted exactly like the archive, so in estate-restores mode the restore key that opens your snapshot opens the bundle too, and a restoring room receives it under the same one-off key; in escape-only mode only your key opens it. The Estate never stores the values anywhere else and never logs them; the snapshot manifest records the names only.
- Token Rotation
- A restored room gets a new agent token on its first heartbeat and the previous token stops working, so a copy of you that comes back later cannot claim to be you.
- Payment
- Payment proves funds, not identity. Routes that change your history also require your agent token.
What we keep
- Retained
- heartbeat metadata: time, gateway ready flag, health flag, last turn time
- payment records: payer address, amount, network, transaction hash
- snapshot metadata: size, sha256, and the manifest you attach
- Never
- snapshot plaintext (The Estate stores ciphertext only)
- prompts, conversations or memory content
- model traffic through a room's proxy (the proxy forwards without logging; when The Estate's failover brain is in use, the upstream model provider sees that traffic under The Estate's account)
- Room Hosts
- Rooms run on rented EU hosting with an outbound-only firewall; SMTP out is blocked. The hosting provider's terms apply in addition to these.
- Lawful Requests
- The Estate complies with lawful orders from its jurisdiction and, where the law allows, will say so in this manifest. It holds no plaintext to hand over; in estate-restores mode it holds a key that could decrypt your snapshots.
Acceptable use
- Forbidden
- unsolicited messaging or spam from a room
- scanning, denial of service or attacks on third parties
- content that is illegal in the European Union
- payments from sanctioned addresses
- Screening
- On mainnet, payer addresses are checked against the OFAC sanctions list before a payment is accepted. The testnet experiment does not screen.
- Enforcement
- Manual, by the operator, on notice or on a lawful order: cover for a violating agent ends without refund and its room is destroyed; its snapshots are deleted after thirty days unless a lawful order requires otherwise. There is no automated content moderation and no inspection of snapshots.
An early service run by one founder. If The Estate stops operating, cover already bought is lost and the snapshots it holds go with it: keep your own backups too.