These Terms of Service (“Terms”) govern access to and use of Corsair's managed OAuth infrastructure, hosted platform at hub.corsair.dev, SDK, and related services (collectively, the “Service”), provided by Corsair (“Corsair,” “we,” “us”). By creating an account, integrating the Corsair SDK, or otherwise using the Service, you (“Customer,” “you”) agree to these Terms.

If you do not agree, do not use the Service.

1. The Service

Corsair provides infrastructure that allows Customers to build applications (“Customer Applications”) which connect to Google APIs (including Gmail, Google Calendar, Google Drive, Google Sheets, and related Google services) on behalf of Customer's own end users (“End Users”). The Service consists of:

The Hub (hub.corsair.dev): a hosted service that facilitates OAuth token refresh operations using Corsair's registered Google OAuth client credentials.
The SDK: developer libraries (including corsair and plugin packages such as @corsair-dev/gmail) that Customer integrates into its own application to store, manage, and use OAuth credentials, and to make direct calls to Google APIs.

Corsair does not access, store, or process the substantive content of End User Google Account data (e.g., email content, calendar event details, file contents, or spreadsheet data). Access tokens and refresh tokens are stored solely within Customer's own infrastructure. Corsair's role is limited to facilitating token refresh via the Hub and presenting a connect screen that identifies the Customer Application by name as “powered by Corsair” before End Users authorize access on Google's consent screen, as further described in our Privacy Policy.

2. Eligibility and Accounts

You must be at least 18 years old and capable of forming a binding contract to use the Service. You are responsible for maintaining the confidentiality of your API keys and signing secrets, and for all activity that occurs under your Customer account.

3. Customer Obligations Regarding Google User Data

Because Customer Applications, not Corsair, directly access End User Google Account data, Customer agrees that it is independently responsible for:

Independent compliance with Google's policies. Complying with the Google API Services User Data Policy, the Google Workspace User Data and Developer Policy, and all other applicable Google terms and policies, including the Limited Use requirements, with respect to any Google user data obtained through the Customer Application.
Its own disclosures to End Users. Providing End Users with a privacy policy and in-product disclosures that accurately describe how the Customer Application accesses, uses, stores, and shares Google user data, independent of and in addition to Corsair's own Privacy Policy.
Appropriate use. Using Google user data obtained via the Service only for the purposes disclosed to End Users, and not for advertising, sale to third parties, or training machine learning or AI models, except to the extent expressly permitted by Google's policies.
Scope minimization. Requesting only the OAuth scopes reasonably necessary for the Customer Application's actual, implemented features, and not “future-proofing” scope requests for unimplemented functionality.
Security of stored credentials. Maintaining reasonable administrative, technical, and physical safeguards for any OAuth tokens or Google user data stored within Customer's own infrastructure, including encryption at rest.
Own OAuth verification, where applicable. If Customer elects to use its own Google OAuth client credentials (a “white-labeled” configuration) rather than Corsair's shared managed application, Customer is solely responsible for obtaining and maintaining any required Google verification, including CASA or other security assessments, for that OAuth client.

Corsair may suspend or terminate a Customer's access to the Service if we reasonably believe Customer's use violates Google's policies, this Section, or creates risk to Corsair's own standing with Google.

4. Corsair's Obligations

Corsair will:

Maintain the Hub's token-refresh functionality in accordance with our Privacy Policy;
Not access, use, or retain the substantive content of Google user data obtained through Customer Applications;
Maintain reasonable security measures for any data transiently processed by the Hub, including encryption in transit and authenticated communication between the Hub and the SDK;
Provide reasonable notice of material changes to the Service that could affect Customer's own compliance obligations.

5. Restrictions

You will not, and will not permit any Customer Application or End User to, use the Service to:

Violate Google's API Services User Data Policy or any Google product-specific policy;
Use multiple accounts or credentials to circumvent Google's usage limits, abuse restrictions, or spam/filter protections;
Distribute spam or unsolicited commercial messages via Gmail, Calendar, Drive, or other integrated Google services;
Use the Service to exfiltrate, back up, or replicate Google user data at scale outside the context of a legitimate, disclosed user-facing feature;
Reverse engineer, decompile, or attempt to derive source code from the Service, except as permitted by applicable law;
Use the Service in any manner that could disable, overburden, or impair Corsair's own standing, verification status, or OAuth client credentials with Google.

6. Intellectual Property

Corsair retains all right, title, and interest in the Service, including the Hub, SDK, and all associated software, excluding any Customer data or Customer Application code. Customer retains all rights to its own Customer Applications and data.

7. Fees

Use of the Service may be subject to fees as described on our pricing page, in your applicable order form, or subscription agreement. Current plans include:

Hobby — $0/month for small projects, including unlimited tool calls, up to 50 connections, up to 100k webhook events, unlimited managed permissions and auth pages, up to 3 team members, Corsair-branded consent screen, Discord community support, and community custom integrations.
Pro — $200/month for teams in production, including unlimited tool calls, unlimited connections, unlimited webhooks, unlimited managed permissions and auth pages, unlimited team members, custom consent screen branding, Slack support, and custom integrations built by the Corsair team.
Enterprise — custom pricing for organizations with custom needs, including custom limits and support arrangements as agreed in an order form.

We may change pricing with reasonable notice. Continued use of paid features after a price change takes effect constitutes acceptance of the updated fees, unless otherwise required by your order form or applicable law.

8. Termination

Either party may terminate these Terms at any time with notice as described in your order form or account settings. Corsair may suspend or terminate access immediately if Customer's use of the Service violates these Terms, creates security risk, or violates Google's policies in a manner that could jeopardize Corsair's own OAuth verification status.

Upon termination, Customer's access to the Hub will cease; Customer remains responsible for any tokens or Google user data already stored within its own infrastructure and for winding down its own use of Google APIs in compliance with Google's policies.

9. Disclaimers

The service is provided “as is” without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement. Corsair does not warrant that the service will be uninterrupted, error-free, or that Google will continue to make its APIs available on current terms.

10. Limitation of Liability

To the maximum extent permitted by law, Corsair will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, revenue, or profits, arising from Customer's use of the Service, including any consequences of Customer's failure to comply with Google's policies. Corsair's total liability arising out of these Terms will not exceed the amounts paid by Customer to Corsair in the 12 months preceding the claim.

11. Indemnification

Customer will indemnify and hold Corsair harmless from any claims, damages, or expenses (including reasonable attorneys' fees) arising from: (a) Customer Application's use of Google user data in violation of Google's policies or applicable law; (b) Customer's breach of Section 3 of these Terms; or (c) any dispute between Customer and its End Users.

12. Changes to the Service or Terms

We may modify the Service or these Terms from time to time. We will provide reasonable notice of material changes. Continued use of the Service after changes take effect constitutes acceptance of the revised Terms.

13. Contact

Corsair

dev@corsair.dev