Terms of Service

Kursal is an open-source, decentralized, peer-to-peer messaging application. No company or organization controls the Kursal network, and no central authority can moderate, intercept, or shut down what travels across it.

Kursal is maintained by one independent developer, Kubik, who operates a small part of the surrounding infrastructure: this website, the download server, the newsletter and policy update lists, the crash report endpoint, and some of the public nodes. Others have contributed to the project, but Kubik alone is responsible for these services and is the person these terms bind. What those services can and cannot see is described in our Privacy Policy. Every other node on the network is run by the community.

These terms are an agreement between you and the maintainer of Kursal. They cover only the services we actually operate:

• ▸ This website
• ▸ The download server and the installer scripts we host
• ▸ The API documentation service
• ▸ The newsletter and policy update mailing lists
• ▸ The crash report endpoint
• ▸ The network nodes we run ourselves

You accept them by using any of those services.

These terms do not govern the Kursal software itself. The software is licensed to you under the GNU Affero General Public License, version 3 (AGPL-3.0), and nothing here adds conditions to that license, restricts the rights it grants you, or applies to copies of Kursal you build, modify, or run yourself. Where these terms and the AGPL-3.0 disagree about the software, the AGPL-3.0 wins.

By design, Kursal operates without central servers or control. This means:

• ✗ We cannot moderate, filter, or censor messages
• ✗ We cannot recover lost accounts or encryption keys
• ✗ We cannot access or read your communications
• ✗ We cannot delete or modify your data

You are solely responsible for your use of the software and for backing up your encryption keys.

Two different rules apply, because they answer different questions.

• ▸ To hand us any data at all, meaning our mailing lists and crash reports, you must meet the age of digital consent where you live. That is 13 to 16 depending on the country, and 15 in France.
• ▸ To agree to these terms, you must be old enough to enter an agreement where you live, which is usually 18. If you are younger, a parent or legal guardian has to be involved.

We do not knowingly collect anything from anyone below the age of digital consent. The Kursal software itself is licensed under the AGPL-3.0 and is not subject to either rule.

The Kursal software is yours to use freely under the AGPL-3.0. The commitments below apply to the services we operate, and to your own conduct under the law:

• ▸ Comply with all applicable laws in your jurisdiction
• ▸ Do not use our nodes to transmit or store content that is illegal where you or the recipient are
• ▸ Do not attack, overload, or attempt to compromise our services
• ▸ Do not use our services to send unsolicited bulk messages (spam)
• ▸ Safeguard your encryption keys and credentials
• ▸ Understand that lost keys cannot be recovered

We may stop serving a peer that is attacking or overloading our own nodes, and where we are actually able to identify one, we will stop serving anyone who repeatedly uses our services to infringe copyright. Both are limited to the services we run: we cannot remove anyone from the Kursal network itself, and we do not have that power by design.

The nodes we run do two different things, and the law treats them differently, so it is worth separating them.

Forwarding. Most of what a node does is relay traffic between two people who are both online. In that role it is a mere conduit within the meaning of Article 4 of the Digital Services Act (Regulation (EU) 2022/2065). We do not initiate transmissions, do not select who receives them, and do not select or modify what they contain. Nothing is retained: the traffic is forwarded and gone.

Storage. Two things are stored, both encrypted, in the distributed hash table carried by volunteer nodes, which includes some of ours. Messages for a contact who is offline wait there until that contact collects them, and expire on their own after at most 3 weeks. First-contact rendezvous bundles wait there for 10 minutes. In that role a node is a hosting service under Article 6 of the same regulation.

In both roles a node holds an opaque, random-looking key and a block of ciphertext. It cannot decrypt a record, tell whose it is, link two records to the same conversation, or work out who published one. That is a property of the design, not a policy we could change on request.

If you believe a record stored by a node we run is illegal, write to [email protected] with everything you can give us: what the content is, why you believe it is illegal, where it is, and how to reach you. We accept notices in English and French, by email, from anyone. We confirm receipt, and we tell you what we decided and why.

Be aware of what we can honestly promise. A stored record is ciphertext under a key derived from a secret only two people share. We cannot read it, search for it, or identify it as the one you are describing, so in almost every case the only true answer we can give you is that the record cannot be found or acted on, and that it expires by itself within 3 weeks. Where a notice does identify something we can act on, we act on it. This is the notice and action mechanism required by Article 16 of the Digital Services Act, and the same address is our point of contact for users and for authorities under Articles 11 and 12.

Kursal is released under the GNU Affero General Public License, version 3 (AGPL-3.0-only). You are free to use, modify, and distribute the software according to the terms of that license. The full license text is available in our GitHub repository.

The Kursal name, logo, and visual assets are not covered by that license and remain the property of their author. The AGPL expressly allows this in its section 7(e). See our Legal Notice for what you may and may not do with them.

Sections 15 and 16 of the GNU Affero General Public License, version 3.

The services we operate are provided free of charge, without any guarantee of availability, and may change or shut down at any time.

This disclaimer applies only as far as the law allows.

Because Kursal is decentralized and we have no control over the network or user activities, and to the fullest extent permitted by law, we are not liable for:

• ▸ Any content transmitted through the network
• ▸ Loss of data or encryption keys
• ▸ Service interruptions or unavailability
• ▸ Any actions taken by other users

Nothing in these terms limits our liability for wilful misconduct, gross negligence, death or personal injury, or for anything else that the law applying to you does not permit us to limit.

We may update these terms when the software or the services we operate change, when the law changes, or to fix mistakes and make things clearer. The date at the top of this page always reflects the current version. Significant changes are announced here before they take effect, shown to you in the app, and emailed to anyone subscribed to policy updates. Continuing to use our services after a change means you accept the updated terms. If you do not, you can decline by staying on a previous version of the software, or you can stop using our services entirely. The software itself remains yours under the AGPL-3.0 regardless.

These terms are governed by French law. If you are a consumer, this choice does not deprive you of the protection of the mandatory rules of the country where you live, and you keep the right to bring proceedings before the courts of that country.

Before going to court, we would much rather talk. Email us at [email protected] and we will do our best to sort it out.

If any provision of these terms is held invalid or unenforceable, it is limited or removed to the minimum extent necessary, and the remaining provisions stay in full force.