Terms of Service

1. Service and operator

StackSnack is operated by GHOST TECHNICAL WORKS LLC, a Texas limited liability company, 200 N Kimball Ave Suite 221, Southlake, TX 76092, United States (“we,” “us,” or “our”). These terms govern our website, scanner, reports, suggested fixes, optional member accounts and monitoring subscriptions (the “Service”). Contact support@stacksnack.io with questions.

You must be at least 18 and legally able to enter an agreement. If you use the Service for an organization, you must have authority to act for it, and “you” includes that organization. Read these terms before requesting a scan, creating an account or buying a plan. If you do not agree, do not use the Service.

In these terms, a “consumer” is an individual using the Service mainly for purposes outside their trade, business, craft or profession, and a “business customer” is anyone else, including an organization or an individual acting for business purposes. Where a provision applies differently to consumers, it says so.

Read our Responsible Use policy, Privacy Policy and cookie notice, and newsletter privacy notice. Account creation, permission to scan, purchase authorization and newsletter consent are separate choices.

These terms, the Responsible Use policy and the plan, price and renewal details you accept at checkout make up the agreement between you and us. If the checkout details you accepted for a purchase differ from these terms, the checkout details govern that purchase. The Privacy Policy explains how we handle personal information.

2. You must have permission

Before every scan, verification or rescan, you must own the systems being tested or have explicit permission from someone authorized to grant it. Permission must cover the targets, methods, connected services and timing. Follow the owner’s conditions, applicable laws and hosting-provider rules. Stop testing if permission is withdrawn.

A public URL, exposed key or accessible database is not permission. Website verification permits deeper website-file checks; database, authentication and storage probes require separate operator approval of backend ownership. A website verification token does not prove control of every connected service. Our permission checkbox records your confirmation; it does not independently establish ownership.

When you enable recurring monitoring, you authorize repeated checks within the verified website scope while monitoring is enabled and your plan permits it. You must maintain permission throughout that time. We recheck website ownership proof before each scheduled run and pause checks if proof cannot be confirmed. Turn monitoring off or archive the project promptly if permission ends. Buying a plan does not extend your testing authorization to another website or backend.

Each time you confirm permission, you represent that your confirmation is true and will remain true while the checks you requested run. We rely on that confirmation when we send requests to a target. We may ask for reasonable evidence of ownership or permission, and we may decline, pause or stop any scan or monitoring if evidence is not provided, if a site owner or hosting provider raises a credible objection, or if we reasonably believe authorization is missing.

If you monitor websites for clients, including through Agency client workspaces, you must obtain each client’s permission under this section before adding its website, keep a record of that permission, and remove the website promptly if the client withdraws permission.

3. Responsible use

Do not use the Service for unauthorized access, exploitation, disruption, surveillance, harassment, collecting other people’s information or any unlawful purpose. Do not use stolen credentials, bypass access controls or verification, evade quotas, overwhelm systems or use findings to attack a third party.

Submit only the information needed for an authorized scan. Do not put passwords, private tokens or personal information in target URL query strings or support messages. We may reject targets, limit requests or suspend access when reasonably necessary to address abuse, security, legal requirements or withdrawn authorization.

You may not use or buy the Service if you are located in, or ordinarily resident in, a country or region subject to comprehensive U.S. sanctions, or if you appear on a U.S. government restricted-party list, and you may not use the Service on behalf of such a person. We may refuse or cancel a purchase where necessary to comply with sanctions or export-control law.

4. What a scan can and cannot tell you

Surface checks inspect supported public web files, security headers, exposed credentials and identifiable library versions. Additional checks depend on verification, separate backend approval, availability and request budgets. Review warnings, skipped checks and incomplete results.

Automated checks can miss vulnerabilities, produce false positives or become outdated. A clean result or high score is not a security guarantee, compliance certification, complete penetration test or substitute for a broader professional assessment. Signed-in workflows, every user role, tenant isolation and every connected resource are not comprehensively tested. Weekly monitoring is not real-time monitoring. No alert does not mean that nothing changed or that the website is secure.

Checks are designed to avoid writing, updating or deleting target data. Read requests still consume resources and may trigger logs, alerts, rate limits or application behavior. We cannot promise zero operational impact. Maintain backups and choose suitable testing times.

Fix suggestions and builder prompts require your review. Test changes before deploying and seek qualified help where needed. StackSnack does not automatically fix your app or provide emergency incident response.

Agency handover reports and client summaries are produced from the same automated checks and carry the same limits. You are responsible for how you describe them to your clients.

5. Your content and private reports

You retain your rights in material you submit. You permit us to retrieve the specified target’s public resources and approved backend responses, process and store findings and operational records, and use service providers as needed to provide, secure and support the requested Service. This permission does not authorize testing outside your approved scope or unrelated use of your content.

Manual scan reports are private to the creating browser by default. A report link alone does not grant access; the browser’s report-access cookie is required. Saving a manual report to a member project does not remove this browser requirement. Reports generated by account monitoring are available only to the signed-in account that owns them. Clearing that cookie or changing browsers can remove access even while a report remains stored. Keep copies you need and protect exports and screenshots, which are outside our browser access controls.

Cookie expiry does not mean stored reports have been deleted. Scheduled cleanup removes unlinked manual reports after 90 days without an update, unless an active project or monitor retains them. Accounts with no sign-in for 12 months and no active paid plan are eligible for cleanup with their projects and account reports; a recent subscription update postpones that cleanup. Deletion runs periodically rather than at an exact expiry time. We do not promise permanent storage. Contact support about data handling or deletion requests, and do not send credentials or sensitive findings in an initial email.

Reports may contain sensitive security information even when detected secret evidence is masked. Share only with authorized recipients and use responsible disclosure for third-party concerns.

6. Optional member accounts

You can scan and read full manual reports without an account. An optional free account provides a workspace for one website project; an account is required for a monitoring subscription. Sign in using the methods offered on our sign-in page. Available methods may include a password, a single-use email link or a connected Google or GitHub account. An authenticator may be required when enabled. Keep your email account, passwords, connected accounts and recovery codes secure. Tell support promptly if you suspect unauthorized account access.

A website project represents one origin: scheme, hostname and port. Subdomains count separately. You are responsible for account activity and accurate project ownership information. Do not use multiple accounts to evade plan limits. Creating an account does not prove scan authorization, enroll you in a newsletter or start a paid subscription.

We process account, project, authentication and billing information as described in our Privacy Policy. To close your account or request deletion, email support@stacksnack.io from the address on the account. If the account has an active subscription, we will cancel its renewal as part of closure unless you ask us not to, and we will confirm the date paid access ends. Closing an account does not by itself entitle you to a refund, except as section 8 provides. Records required by law may be retained.

7. Free scans and monitoring plans

Scans, full reports and fix prompts are always free. Free scanning requires no account or payment card and never converts automatically into a subscription. A paid plan is available to buy only when our pricing page and checkout offer it. Paid plans are currently offered only to customers with a United States billing address; free scans and free accounts may be available more widely. A plan or feature labeled “coming soon” is a preview without a promised release date. The subscription provisions below apply when you purchase a plan.

Included monitoring

When offered for purchase, Builder covers up to three ownership-verified websites, weekly checks, email alerts for new or worsening confirmed high or critical findings, and 90 days of monitoring report history. Pro provides the same monitoring for up to ten ownership-verified websites and 365 days of monitoring report history. Agency, when offered for purchase, includes the Pro monitoring and history features for up to thirty websites across up to thirty owner-managed client workspaces, text and color branded HTML handover reports, and calendar-month client summaries to export and send manually. Client workspaces do not provide client logins or invitations. Website limits apply across the account.

If you use Agency or otherwise use the Service for clients, your clients are not parties to these terms and do not receive accounts from us. You are responsible for your agreements with your clients, for what you tell them about StackSnack results, and for sharing reports only with people entitled to see them. Branded reports must not suggest that we have certified, audited or guaranteed a client’s security.

Monitoring is periodic, not continuous surveillance or incident response. Runs and email delivery can be delayed or fail because of outages, target rate limits, lost ownership proof or other operational problems. An initial check may alert on qualifying existing findings; later alerts depend on qualifying new or worsening findings and your triage settings. A completed run does not always produce an email. Review the latest report and any warnings rather than relying on email alone.

Website ownership and backend approval remain separate. These monitoring plans do not include scheduled database or two-account tests, deploy blocking, Slack, API or MCP integrations. Any feature or plan labeled planned remains a preview until offered for purchase. Deploy checks are planned for Builder. If we release them, they will be included in Builder at no extra cost for Builder subscriptions active at that time. We have not set a release date and do not promise one.

History and downgrades

A plan’s history window describes the monitoring history included with that plan. Scheduled cleanup removes monitoring reports outside the included window. A 30-day export grace period can preserve history from a previous paid plan after a downgrade; cleanup is periodic. Manual browser-owned reports keep their separate access and retention rules in section 5. If you change or end a plan, export copies you need; report storage remains subject to section 5 and any more specific retention or export period disclosed before purchase or confirmation of a plan change.

On a downgrade, the oldest non-archived websites within the new limit remain usable; extra website projects become read-only and their monitoring pauses. You can archive projects to free spaces. The downgrade itself does not delete a project, but report and account retention rules continue to apply.

8. Prices, billing and cancellation

Prices and the Builder launch offer

All listed prices are in United States dollars, before applicable tax. Builder is $19 per month or $190 per year. Pro is $49 per month or $490 per year. Agency is $149 per month or $1,490 per year when offered for purchase. Checkout shows the plan, currency, amount, billing period, applicable tax and any offer before you authorize payment.

The Builder launch price is $9 per month or $90 per year for qualifying subscriptions started before January 1, 2027 at 12:00 a.m. America/Chicago (U.S. Central) time, only when that offer is shown and accepted in checkout. A subscriber keeps that launch price while the same Builder subscription remains active without interruption on the same billing interval. Scheduling cancellation and resuming before the paid period ends does not itself end the offer. A lapse followed by a new subscription, switching away from Builder or changing billing intervals ends eligibility for the previous launch price. This is a subscription price commitment, not a promise that the Service will operate for a subscriber’s lifetime.

Automatic renewal and payment

Paid plans are subscriptions billed in advance. Monthly plans renew monthly and yearly plans charge the entire annual amount in advance and renew yearly until canceled. A monthly equivalent shown for an annual plan is informational, not a monthly installment option. Before you pay, checkout shows the renewal terms next to the payment button and asks you to agree to automatic renewal separately from these terms. By giving that agreement, you authorize recurring charges at the disclosed price and billing interval, plus applicable tax, until you cancel. Scanning or creating an account alone does not authorize payment.

After you subscribe, we email you a confirmation of the plan, price, billing interval, renewal date, cancellation policy and how to cancel. For yearly plans, we email a reminder no less than 25 and no more than 30 days before each renewal. For every plan, we remind you of your renewal terms at least once a year.

Stripe processes payments and receives payment details. We do not receive or store your full card number. Keep payment information current. We will email you notice of a price increase no less than 25 and no more than 30 days before it applies to your subscription, with instructions for canceling. You may cancel before it takes effect. The qualifying Builder launch price remains subject to the price commitment above.

Where we must collect sales tax, VAT or a similar tax, checkout shows it before you pay. Business customers that provide a valid tax registration number may have tax handled under applicable reverse-charge or exemption rules.

Plan changes

Use your account’s “Manage billing” control to review invoices, update payment details, or request an available plan change. Available changes, their effective date, and any prorated charge or credit are shown in the billing flow before confirmation. Some changes or billing intervals may not be available online; contact support for help. A credit may apply to later invoices rather than being a cash refund. Review the details before confirming. Do not start a second subscription to resolve a payment issue.

Cancellation

You can stop renewal online at any time using “Manage billing” in your account. No phone call, survey or support approval is required. Cancellation takes effect at the end of the current paid period, as confirmed in billing; paid access continues until then. Cancel before the next renewal to stop that renewal. If available, you may resume a scheduled cancellation before the end date. If you cannot use the billing controls, email support@stacksnack.io to request cancellation. We will email you confirmation of the cancellation and the date paid access ends; a technical problem does not require you to keep unwanted renewal active.

When paid access ends, monitoring stops and Free limits apply. Free scans remain available. Project access and report history then follow section 7. Turning monitoring off for a website or archiving a project does not by itself cancel the subscription.

First purchase refunds

If you are not satisfied, email support@stacksnack.io within seven days of your first subscription payment and we will refund that payment in full. This offer applies once per customer and covers the first purchase, not renewals or later plan changes. Except for this offer, the material-change or service-ending remedies in these terms, or rights required by law, we do not provide refunds or credits for unused portions of a paid period. We will investigate duplicate, incorrect or unauthorized charges. Mandatory cancellation, withdrawal, refund and other consumer rights continue to apply, including those described below.

Consumers in the EEA and the United Kingdom

Paid plans are not currently offered in the European Economic Area or the United Kingdom. When they are, this subsection applies. If you are a consumer in the European Economic Area or the United Kingdom, you may withdraw from a new subscription within 14 days after the day the contract is made, without giving a reason. Paid features start as soon as you subscribe, so checkout asks you to request immediate access. If you withdraw after making that request, we will refund your payment less an amount proportionate to the service provided up to the time you told us you were withdrawing. If you withdraw within seven days of your first payment, the first purchase refund above gives you a full refund instead.

To withdraw, use the “Withdraw from contract” function in Manage billing, send us the model form in the Schedule, or email support@stacksnack.io with a clear statement of your decision. We will confirm receipt by email without undue delay and refund any amount due within 14 days, using the original payment method.

Nothing in these terms limits other mandatory rights you have under the law of the country where you live.

Failed payments

If a renewal fails and the subscription is past due, paid access continues for up to seven days while you resolve payment. After the grace period, monitoring pauses and Free limits apply. Other subscription states, such as an ended or unpaid subscription, may also end paid access. Update or resolve the existing subscription through billing instead of creating another. A canceled renewal remains canceled even if you are working with support on a payment or refund.

9. Materials and third parties

We and our licensors retain rights in StackSnack’s software, branding and original site content. You may use and share reports and suggested fixes for your authorized security work. This does not transfer ownership of the platform or grant rights in third-party materials. Linked providers have their own terms; references to app builders and backend platforms do not imply endorsement. Payment services are provided by Stripe under its applicable terms. If you send us suggestions or feedback, we may use them without any obligation to you.

10. Availability, suspension and ending service

Features may be interrupted or discontinued. You may stop using the Service at any time and cancel a subscription as described in section 8. We may limit or suspend access or pause monitoring when reasonably necessary for material misuse, unauthorized testing, non-payment, security or legal requirements.

If we remove a material feature of a plan you are paying for, we will email at least 30 days in advance. You may cancel because of that removal and receive a refund for the unused portion of the current paid period. If we end your paid plan for reasons other than your breach of these terms, we will refund the unused prepaid portion. A temporary security or legal restriction may require immediate action; if so, we will tell you what happened as soon as reasonably possible, unless the law or a security need prevents it.

11. Warranties

To the extent permitted by applicable law, the Service is provided “as is” and “as available,” without warranties of merchantability, fitness for a particular purpose or non-infringement. We do not warrant uninterrupted, error-free or complete results, or that the Service will identify or prevent every vulnerability or incident. Nothing in these terms excludes a warranty, remedy, liability or obligation that the law does not allow us to exclude. If you are a consumer, you may have statutory rights, such as the right to services performed with reasonable care and skill, that these terms do not affect.

12. Liability and unauthorized testing

To the extent permitted by applicable law, we are not liable for indirect, incidental, special, consequential or punitive damages, or lost profits, revenue, data or goodwill arising from the Service, including security incidents the Service did not detect. To that same extent, our total liability for claims related to the Service is limited to the greater of US $50 or the amount you paid us for the Service in the 12 months before the event giving rise to the claim.

These limits do not apply to liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, gross negligence or willful misconduct, or any other liability that cannot be limited or excluded by law. If you are a consumer in the EEA or the United Kingdom, we are responsible for loss you suffer that is a foreseeable result of our breach of these terms or our failure to use reasonable care and skill, and the exclusion of indirect loss above applies only to loss that was not foreseeable.

If you are a business customer, you will defend and reimburse us for reasonable losses and costs, including reasonable attorneys’ fees, arising from third-party claims caused by scans or recurring checks you requested without the permission required by section 2, or by reports you share with your clients. If you are a consumer, you are responsible for loss caused by your breach of section 2 to the extent applicable law allows. Neither obligation applies to the extent a claim results from our own breach or negligence. We will tell you promptly about any claim for which we seek reimbursement.

13. Changes, applicable law and disputes

We will publish updated terms with a version and effective date and provide notice or obtain agreement where required. For material changes affecting paid plans, we will email account holders at least 30 days before the change takes effect so they can cancel before it applies. A change to paid-plan terms applies to an existing subscription from its next renewal after that notice period, unless the change is required by law or is in your favor. New terms will not apply retroactively to an existing dispute. If a provision is unenforceable, the remaining provisions apply to the extent permitted by law.

Texas law governs these terms, without regard to conflict-of-law rules, subject to mandatory protections that apply to you. This does not remove any mandatory right to your local law or courts.

Before starting a court claim, the party with the claim will send the other a written description of it, and both will try in good faith to resolve it within 30 days. Send notices to us at the address in section 15 and to support@stacksnack.io. This step does not prevent either party from seeking urgent relief, filing in small claims court, or acting to meet a filing deadline.

If you are a business customer, the state and federal courts located in Tarrant County, Texas, have exclusive jurisdiction over disputes about these terms or the Service. If you are a consumer, you may bring proceedings in those courts or in the courts where you live.

14. General

These terms are the entire agreement between you and us about the Service and replace earlier versions for use after their effective date. We may transfer these terms to a successor in a merger, acquisition or sale of the Service, and we will tell you if we do; a transfer will not reduce your rights. You may not transfer these terms without our written consent.

Neither party is responsible for delay or failure caused by events beyond its reasonable control, such as outages of upstream providers, but this does not excuse payments due or our refund obligations. If we do not enforce a provision, we have not waived it.

We send notices to the email address on your account, and you send notices to support@stacksnack.io. These terms are written in English; any translation is for convenience, and the English version controls to the extent the law allows. Sections 5, 9, 11, 12, 13 and 14 survive the end of your use of the Service.

15. Contact

GHOST TECHNICAL WORKS LLC
200 N Kimball Ave Suite 221
Southlake, TX 76092
United States
support@stacksnack.io

For service, billing, account closure or security questions, contact support or use the feedback form. Keep private report contents and credentials out of public posts.

Schedule: Model withdrawal form

Complete and return this form only if you are a consumer in the EEA or the United Kingdom and wish to withdraw from your contract.

To: GHOST TECHNICAL WORKS LLC (StackSnack), 200 N Kimball Ave Suite 221, Southlake, TX 76092, United States; support@stacksnack.io

I hereby give notice that I withdraw from my contract for the provision of the following service: StackSnack [Builder / Pro / Agency] subscription

Ordered on: _______________

Name of consumer: _______________

Account email address: _______________

Address of consumer: _______________

Signature of consumer (only if this form is sent on paper): _______________

Date: _______________