User agreement
This is the contract between you and [TO BE COMPLETED], which operates Pebble Labs. Please read it. It sets out who we are, what the service is, what you may and may not do with it, and the limits of what we are responsible for.
How this agreement works
Three documents govern your relationship with us. Each does a different job, and all three apply.
- This user agreement. Who we are, what the service is, how you get access and pay for it, who owns what, and liability.
- The acceptable use policy. The rules for using the labs: what is in scope for attack, what is not, and what happens if you cross the line.
- The privacy policy. What personal data we collect, why, and who processes it for us.
The refund and cancellation policy governs refunds and sits under the payment section below. Where this agreement and another document conflict on a subject that other document covers specifically, the specific one wins for that subject.
Who we are
[TO BE COMPLETED], registered at [TO BE COMPLETED]. In this document “we”, “us” and “our” mean that company, and “you” means the person using the service or browsing the site.
Agreeing to this contract
You enter into this contract when you create an account, deploy a lab, or use the service, including where you sign in with a Google or GitHub account, or with a code we email you, rather than with credentials we issued. If you do not agree to it, do not create an account and do not use the service.
You can end the contract at any time by closing your account.
Eligibility
To use the service, all of the following must be true.
Age
You are at least 18. If you are under 18, a parent or guardian who is at least 18 must accept this agreement for you and takes responsibility for your use of the service and your compliance with the acceptable use policy.
We set the bar at 18 rather than at the data protection minimum because a subscription is a contract, and in most places a minor can walk away from one while we stay bound to it. We do not verify your age. This is a term you are accepting rather than a check we run, and telling us a false age is itself a breach of this agreement.
Sanctions and restrictions
You are not barred from using the service where you live, and you are not resident in, a national of, or personally subject to sanctions imposed by the United States, the United Kingdom, the European Union, or the United Nations. This is a training platform for offensive security technique, so this is not boilerplate.
Accuracy
The account details you give us are accurate, and you keep them that way. We may ask you to verify your identity, and may suspend an account that will not.
Your account
One account per person
Your account is for you alone. Do not share it, and do not let another person work labs under your subscription. You are responsible for everything done under your account unless you tell us it has been taken over.
Security
We hold no password for you. You sign in with a Google account, a GitHub account, or a single-use code we send to your email address, so whoever controls that account or that mailbox controls your access here. Keep it secure, and tell us as soon as you suspect anything has gone wrong with it.
Closing your account
You can close your account at any time by writing to pebblepwns@gmail.com. We may suspend or close an account for breach of this agreement or the acceptable use policy, for non-payment, or where the law requires it.
What the service is, and how labs live and die
The service
Pebble Labs is training. You pick a lab, we build a private network of virtual machines for you in our cloud account, and you attack it over your own VPN connection. Some labs are free. The rest need an active subscription or a one-time course purchase.
Everything here is for education and skills assessment inside environments we own and have authorised you to attack. What you learn is yours to use lawfully. Using it against a system you do not own or have written permission to test is your responsibility alone, and nothing in this agreement authorises it.
Availability
We do not promise the service will be available without interruption. Labs run on third-party cloud infrastructure, provisioning takes minutes rather than seconds, and both can fail. We do not offer a service level agreement.
Lab lifecycle
Lab environments are temporary by design and the platform reclaims them on its own. Treat anything inside a lab as disposable.
- A lab with no VPN traffic for two hours is suspended. Its disks, your progress, and your VPN profile survive, and you can resume it in one click.
- A lab left untouched for long enough after that is torn down completely. What was on those machines is gone and cannot be recovered.
- A lab may also be suspended when its credit allowance runs out, when your subscription lapses, or by us for operational reasons. The lab page says which of these happened.
- There is a limit on how many labs you can run at once. Deploying another may require tearing one down.
Credits
Where a lab has a credit allowance, credits cap what that lab may spend on compute and model usage. They are a spending limit, not a currency: you do not buy them, they have no cash value, and they are not refundable or transferable. We may change how credits are priced or allocated, and a change does not claw back an allowance already granted.
Payment and subscriptions
Price and access
The price and the billing period are shown before you order, and the amount you will be charged appears again on the checkout page. Prices are in US dollars and exclude any tax we must collect. Because the service is digital, access starts as soon as payment succeeds.
Automatic renewal
Subscriptions renew automatically at the end of each period, monthly or yearly depending on the plan, and you authorise us to charge your payment method at the start of each new one. Your renewal date is shown in the billing portal, which you can open from your account page at any time. We will tell you at least 30 days before any price increase takes effect, and a price change never affects a period you have already paid for.
Cancelling
Cancel at any time from your account page, which opens Stripe's billing portal. Cancelling stops the next renewal and leaves your access running to the end of the period you have paid for. Refunds are governed by the refund and cancellation policy.
Suspension for non-payment or breach
We may suspend access to paid features if a fee goes unpaid, if you breach this agreement or the acceptable use policy, if your use breaks the law, or if we believe in good faith that the service is under attack or otherwise at immediate risk. Free features may be limited or withdrawn at any time.
Who owns what
Our content
The labs, courses, machine images, network designs, written material, and the platform itself belong to us. Your subscription is a personal, non-transferable, revocable permission to use them for your own training while it is active. It grants nothing else.
What you must not do with it
You must not:
- copy, republish, redistribute, or make our content available to anyone else, whether modified or not;
- extract, export, or reverse-engineer the machine images or the provisioning system;
- resell access, or run the labs as a service for other people;
- use our content to build or improve a competing product, or to benchmark one; or
- use our content to train, fine-tune, evaluate, or benchmark any machine learning model, or to build a dataset for that purpose, or help anyone else do so.
These restrictions apply however the content was obtained and whether or not the use is commercial.
Your work
What you produce while working a lab, your notes, your scripts, and your write-ups within the limits of the acceptable use policy, is yours. If you send us feedback or a suggestion, we may act on it without owing you anything for it.
Third-party content and links
We do not control third-party sites we link to and are not responsible for them. A link is not an endorsement, and your use of a linked site is governed by that site's own terms.
Warranties
The service is provided as it is. To the extent the law allows, we exclude all warranties and conditions, whether express, implied, or statutory. In particular we do not warrant that a lab is free of defects, that it models any real system correctly, that it will be available without interruption, or that working it will produce any particular outcome for your career or your competence.
Limitation of liability
Indirect loss
To the extent the law allows, we are not liable for indirect or consequential loss, including lost profits, lost opportunity, lost reputation, or lost data. That includes data on a lab machine that was suspended, reset, or torn down, whether by you, by us, or automatically.
Cap
Where we are liable, our total liability arising from the service or this agreement, on any cause of action including negligence, is capped at the greater of what you paid us in the twelve months before the claim, or one hundred US dollars.
What is never limited
Nothing here limits liability that cannot be limited by law, including for fraud or for death or personal injury caused by our negligence.
Changes
To the service
We may change, add to, or withdraw parts of the service. Where a change materially affects a paid feature during a period you have paid for, we will give reasonable notice and may refund the unused part.
To this agreement
We may update this agreement. For a material change we will tell you by email or in the app, and the change takes effect 30 days after we post it. Changes are not retroactive. If you do not accept the new version, close your account before it takes effect. Continuing to use the service afterwards means you accept it.
Termination
By you
Close your account at any time. Your right to use the service ends with it, and running labs are torn down.
By us
We may suspend or close your account and end this agreement if you breach it or the acceptable use policy, if your use breaks the law, or if you misuse the service. Where there is an immediate risk to the platform or to other customers, we may act first and tell you afterwards.
Survival
Ending this agreement does not affect rights or obligations either of us had already accrued. The sections on ownership, limitation of liability, and governing law continue to apply afterwards.
General
Assignment
You may not transfer your rights or obligations under this agreement without our written consent. We may transfer ours to another business, and will tell you if we do.
Severability and waiver
If any part of this agreement is found unenforceable, the rest continues to apply. If we do not act immediately on a breach, we keep the right to act on it later.
Events beyond our control
Neither of us is liable for a failure caused by something outside our reasonable control, including cloud provider outages, network failures, cyberattacks on infrastructure we do not operate, government action, or natural disaster. Where such an event materially affects a paid feature for more than 30 consecutive days, either of us may end the affected subscription and we will refund the unused part.
Notices
Notices to us go to [TO BE COMPLETED]. Notices to you go to the email address on your account. Keep it current.
Entire agreement
This agreement, together with the documents named in section 1, is the whole agreement between us about the service and replaces anything said before it.
Law and jurisdiction
This agreement and any dispute arising from it are governed by the law of [TO BE COMPLETED], whose courts have exclusive jurisdiction. If consumer protection law where you live gives you stronger rights, those rights still apply.
Contact
Legal notices: [TO BE COMPLETED]. Privacy: [TO BE COMPLETED]. Security reports: [TO BE COMPLETED]. Everything else: pebblepwns@gmail.com.