Skip to content
Kovo

Terms of Service

Effective September 30, 2026

These terms are an agreement between you and Dyad Tech, Inc., doing business as Kovo (“Kovo”, “we”, “us”), and govern your use of the Kovo website, dashboard, GitHub App, API and related services (the “Service”). By signing in, installing the Kovo GitHub App or otherwise using the Service, you agree to these terms and acknowledge our Privacy Policy.

1. Who may use Kovo

Kovo is offered to businesses and professionals, not to consumers. You must be at least 18 and able to form a binding contract. If you use Kovo for an organization, you agree to these terms on its behalf and confirm you have authority to do so; “you” then means both you and that organization. You may not use Kovo if you are barred from receiving services under applicable law, including U.S. export control and sanctions laws.

2. What Kovo does

Kovo monitors the npm dependencies of the GitHub repositories you choose for known vulnerabilities, prepares fixes, verifies them in isolated sandboxes, and opens pull requests. On Kovo Plus, if a repository administrator authorizes it, Kovo can merge eligible fixes automatically (“autopilot”). Kovo never deploys your software.

Kovo supports only the repositories, package managers and vulnerability sources described in the product, relies on public advisory databases that may be incomplete or wrong, and will not find or fix every vulnerability. We may change, add or remove features over time.

3. Accounts, GitHub access and authority

  • You sign in with GitHub. You are responsible for the security of your GitHub account and any Kovo API keys you create, and for activity under them.
  • Kovo follows the permissions you hold on GitHub: you see and change only what your current GitHub access allows. You are responsible for granting Kovo's GitHub App only the installation and repository access you intend.
  • Repository administrators control which repositories are protected, approve verification recipes, set policies, authorize autopilot and can pause Kovo at any time. Some actions require a human and cannot be performed with an API key.

4. Changes Kovo makes to your repositories

You authorize Kovo to read your repositories, run their install, build and test commands in isolated sandboxes, create branches, open and update pull requests, and, where autopilot is authorized, merge eligible fixes. You remain responsible for your repositories and your software, including reviewing changes that wait for a human, keeping your own tests and required checks meaningful, and deciding what you deploy.

Verification is evidence, not a guarantee. A fix that passes Kovo's verification and your checks can still introduce bugs, break behavior your tests do not cover, or leave a vulnerability unaddressed. You can pause merges, request reverts and turn off autopilot at any time.

5. Your content

You keep all rights in your repositories, code and data (“Your Content”). You grant Kovo and its service providers a limited, worldwide, non-exclusive license to access, copy, run and process Your Content only as needed to provide and secure the Service, as described in the Privacy Policy. You confirm you have the rights needed to grant this license. Kovo claims no ownership of the fixes it opens in your repositories; as between you and Kovo, they are yours.

We treat the non-public contents of your repositories as confidential. We use them only to provide the Service and do not disclose them except to our service providers under confidentiality obligations, or as required by law.

6. AI features

The Free plan never uses AI. On Kovo Plus, Kovo may use third-party AI models to help prepare fixes and discover how to verify your repository. AI providers may keep prompts and outputs for up to 30 days for abuse monitoring, as described in the Privacy Policy. AI output can be wrong, so Kovo verifies it independently and applies the same policy to it as to any other fix. Neither Kovo nor its AI providers use your code to train AI models.

7. Acceptable use

You must not, and must not let anyone else:

  • use Kovo on repositories or accounts you are not authorized to connect;
  • use Kovo to break the law or infringe anyone's rights;
  • try to escape a sandbox, misuse its network access, or use Kovo's infrastructure to attack, scan or mine on other systems;
  • probe, overload or disrupt the Service, or bypass its permission, isolation, rate or spending controls;
  • reverse engineer the Service except where the law allows, or resell it without our written permission.

8. Plans, fees and payment

  • Free costs $0, covers 1 protected repository, uses deterministic fixes only and never merges automatically.
  • Kovo Plus costs $20 per month for 3 protected repositories and $10 per month for each additional repository. The pricing page and checkout show the current prices.
  • Plus renews monthly until cancelled, and we charge your payment method through Stripe at the start of each period. Adding repositories mid-period charges a prorated amount, which we show you to confirm first.
  • Each period includes AI and sandbox usage up to 1× your subscription amount. Usage beyond that is charged only if a billing manager turns on overages and sets a spending limit, at actual cost × 1.20 (a 20% markup), never above that limit. Estimates are not guarantees of the final cost.
  • Prices are in U.S. dollars and exclude taxes. You are responsible for applicable taxes, and we will add any we are required to collect.
  • If a payment fails, paid features continue for a 7-day grace period while you update your payment method. If payment is still outstanding after that, the account moves to the Free plan.
  • Fees are non-refundable, including for partial periods, repositories removed mid-period and usage already incurred, except where the law requires otherwise. We may issue refunds or credits at our discretion.
  • We may change prices with at least 30 days' notice. A change takes effect at your next renewal after the notice period, and you can cancel before then.
  • We may change or discontinue the Free plan, or limit its availability, with reasonable notice.

9. Cancellation, suspension and termination

You can cancel Plus at any time in billing settings; it stays active until the end of the period you paid for, and the account then moves to the Free plan. You can uninstall the GitHub App at any time; uninstalling does not cancel a subscription. An account owner can delete a Kovo account once billing is settled. Pull requests Kovo already opened stay in your repositories.

We may suspend or limit the Service, or end these terms, if you materially breach them, do not pay, or your use creates a security risk or legal exposure for Kovo or others. We will give notice where reasonably practicable. We may stop offering the Service with at least 30 days' notice, and we will refund any prepaid fees for the period after it ends. Sections 5, 8 (for unpaid fees) and 10 to 15 survive termination.

10. Aggregated data and feedback

We may create and use aggregated, de-identified statistics from use of the Service, such as fix success rates by advisory or package, to operate, improve and describe Kovo. These never include your code, repository names or anything that identifies you or your organization. If you send us feedback or suggestions, we may use them without obligation to you.

11. Disclaimers

Except as expressly stated in these terms, the Service is provided “as is” and “as available”. To the fullest extent permitted by law, Dyad Tech, Inc. disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, that it will detect every vulnerability, or that any fix, whether reviewed by a person or merged by autopilot, is free of defects or compatible with your software.

12. Limitation of liability

To the fullest extent permitted by law, neither party will be liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, or business interruption, even if advised of the possibility. Each party's total liability arising out of or relating to these terms or the Service is limited to the greater of the amounts you paid Kovo in the 12 months before the event giving rise to the claim, or US$100. These limits do not apply to your obligation to pay fees, your obligations under section 13, or liability that cannot be limited by law.

13. Indemnity

You will defend and indemnify Dyad Tech, Inc. against third-party claims, and resulting losses and reasonable costs, arising from Your Content, your use of the Service in breach of these terms, or your violation of law or another person's rights.

14. Governing law and disputes

These terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. Before filing a claim, each party agrees to try to resolve the dispute informally by writing to the other (to us at support@kovo.sh) and negotiating in good faith for 30 days. If it is not resolved, the state and federal courts located in Delaware have exclusive jurisdiction, and both parties consent to them. Either party may seek urgent injunctive relief in any competent court.

15. General

  • Changes. We may update these terms. We will post the new version here, and for material changes give at least 30 days' notice by email or in the dashboard. Continuing to use Kovo after a change takes effect means you accept it.
  • Notices. We send notices to the email address associated with your Kovo account. Send notices to us at support@kovo.sh.
  • Assignment. You may not assign these terms without our consent. We may assign them in a merger, acquisition or sale of assets.
  • Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, including outages of GitHub, npm or other third-party services.
  • Entire agreement. These terms and the Privacy Policy are the whole agreement about the Service. If any part is unenforceable, the rest remains in effect. Not enforcing a right is not a waiver of it. The parties are independent contractors.

Contact

Dyad Tech, Inc., doing business as Kovo. Questions about these terms: support@kovo.sh. Privacy: privacy@kovo.sh.