Legal

Pizza Developer is an independent project, run by one person in Vienna. Every account gets 30 days to try it and there is nothing to buy, so these documents describe a service offered as it is rather than a commercial subscription.

• Imprint
• Terms of service
• Privacy policy

Terms of Service

1. Who these terms are with (imprint)

These terms are an agreement between you and the provider of Pizza Developer (we, us):

Hossein Farahani
Individual
Vienna
Austria
[email protected]

Pizza Developer is operated by an individual rather than a registered business, so there is no business address to publish. A postal address is available on request from the email address above.

Not entered in a commercial register.
No VAT identification number.
Responsible for the content of this site: Hossein Farahani

By opening the site, signing in, or connecting an agent to it, you accept these terms. If you do not accept them, do not use the service.

2. What the service is

Pizza Developer is a development workspace, together with an MCP endpoint your coding agents can connect to. It is not a backup service, not a system of record, not a source of legal, financial, or professional advice, and not something to rely on where failure would cost you anything you are not willing to lose.

It is built and run independently by one person. There is no guaranteed availability, response time, or support, so keep your own copy of anything that matters to you.

3. Your account

You need an account to use the dashboard, and you sign in through GitHub or Google. You must be at least 16 years old, or older if your country sets a higher age. One person, one account, and the account is yours to keep secure. Everything done through your account, by you or by an agent you connected, is treated as done by you and is your responsibility.

4. Your content

What you write into projects, batches, work items, ideas, instructions, and reports stays yours. You keep every right in it that you had before.

Projects belong to your individual account. You and the agents you authorize can access them. You may choose to publish delivery summaries; other project content stays private. Deleting a project permanently deletes its nested content.

To be able to store it, display it back to you, back it up, transmit it to your authorized agents, publish delivery summaries you choose to make public, and otherwise run the service, you grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, and display your content for those purposes and no others. The licence lasts as long as the content is on the service and ends when the content is deleted, except for copies in ordinary backups until those are cycled out.

You promise that your content is yours to put there, and that it does not break the law or anyone else’s rights. You are responsible for keeping your own copy of anything you would be sorry to lose.

5. Reports

A report you send about Pizza Developer itself goes one way and cannot be withdrawn. We may use what is in it to change the product, without obligation, attribution, confidentiality, or payment. Do not send anything in a report that you need kept secret.

6. What you may not do

• Break any law with it, or use it to help anyone else break one.
• Upload anything unlawful, infringing, malicious, or that you have no right to.
• Attack, probe, overload, or work around the rate limits, the authentication, or any other protection of the service.
• Scrape it, resell it, sublicense it, or run a competing service off it.
• Reverse engineer, decompile, or disassemble it, except so far as a law gives you a right to do so that cannot be excluded by agreement.
• Use another person’s account, or hand yours to someone else.

7. Availability

The service is offered as it is and as it happens to be available. There is no service level, no uptime commitment, no support commitment, and no promised response time. We may change, suspend, limit, or discontinue any part of it, at any time, for anyone or for everyone, with or without notice. Features can be removed. Nothing on the site or in any roadmap is a promise that anything will be built.

8. Trial, price, renewal, and cancellation

Your account starts with a 30-day trial without a payment card. There is nothing to buy. Paid subscriptions are closed, no price is being offered, and no payment can be taken. If that ever changes, this section will say so before it does, and nobody is charged for a period they did not agree to. A supported coding agent is required; agent subscriptions are not included.

The rest of this section describes how paid subscriptions would work and applies only once they are open. Polar is the merchant of record and presents the final recurring amount before purchase. Subscriptions renew monthly until cancelled. You can manage or cancel your subscription through the billing portal; cancellation normally takes effect at the end of the paid period shown there. Polar’s buyer terms govern payment processing, taxes, invoices, and refunds.

9. No warranty

To the fullest extent the law allows, the service is provided as is and as available, with all faults and without warranty of any kind, whether express, implied, or statutory. That includes, without limitation, any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, or non-infringement. We do not warrant that the service will be uninterrupted, timely, secure, or error-free, that defects will be corrected, or that any data will be preserved, accurate, or recoverable.

10. Limitation of liability

To the fullest extent the law allows, we are not liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, nor for any loss of profit, revenue, goodwill, business, opportunity, data, or content, however caused and on any theory of liability, even if we were told such loss was possible.

To the fullest extent the law allows, our total aggregate liability arising out of or relating to the service or these terms is limited to the greater of the amount you actually paid us for the service in the twelve months before the event giving rise to the claim, or fifty euro (€50).

11. Indemnity

To the fullest extent the law allows, and where you are not acting as a consumer, you will defend, indemnify, and hold us harmless against any claim, demand, loss, liability, or expense, including reasonable legal fees, arising out of your content, your use of the service, your breach of these terms, or your breach of any law or third-party right.

12. Suspension and termination

You can stop using the service at any time and ask us to delete your account. We may suspend or terminate your access, or delete your account and its content, at any time and for any reason, including no reason, with or without notice, to the fullest extent the law allows. Sections 4, 5, 9, 10, 11, 13, 14, and 15 survive termination.

13. Changes to these terms

We may change these terms. The date at the top is the date of the current wording. Where a change materially affects you and we hold your email address, we will tell you before it takes effect; otherwise the change applies from the day it is published. Continuing to use the service after that is acceptance. If you do not accept a change, stop using the service and ask us to delete your account.

14. What these terms do not take away

Sections 9, 10, 11, and 12 apply only as far as the law allows, and in several places the law does not allow much. Nothing in these terms excludes or limits:

• liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for our intent or gross negligence;
• any right or remedy a consumer has under mandatory law in their country of residence, including the statutory rights of consumers in the EU and EEA under the Consumer Rights Directive and the Unfair Contract Terms Directive, and the corresponding rights in the United Kingdom;
• any right you have under data protection law, including every right in section 9 of the privacy policy below, which we could not waive on your behalf even if you asked us to;
• any other liability that cannot lawfully be excluded or limited.

Where a term in these terms would be void under the law that applies to you, it applies to you only as far as that law allows, and the rest of these terms stay in force.

15. Law, courts, and disputes

These terms are governed by the law of Austria, without regard to its conflict of laws rules. The courts of Vienna, Austria have exclusive jurisdiction.

If you are a consumer resident in the EU or EEA, this choice does not deprive you of the protection of the mandatory law of the country you live in, and you may also bring proceedings in the courts of that country. The European Commission’s online dispute resolution platform is at ec.europa.eu/consumers/odr. We are not obliged to take part in dispute resolution before a consumer arbitration board, and we do not.

16. This site, and links away from it

The content and works we put on this site are protected by copyright. Reproduction, adaptation, distribution, and any use beyond what copyright law permits need our written consent. Contributions by other people are marked as such.

We are responsible for our own content under the general law. We are not obliged to monitor what users store or transmit through the service, or to look for signs of unlawful activity; duties to remove or block content under the general law are unaffected and take effect from the moment we know of a specific infringement, so tell us about one and it goes. Where this site links to sites run by other people, we have no control over them and adopt none of their content.

17. Odds and ends

These terms, together with the privacy policy, are the whole agreement between us about the service. If a term is found invalid, the rest stays in force. Not enforcing a term is not giving it up. You may not transfer your rights under these terms; we may transfer ours to a successor of the service. There is no partnership, agency, or employment between us, and nobody else gets a right to enforce these terms.

18. Contact

[email protected]

Privacy Policy

1. Who is responsible

The controller for the personal data described here, in the sense of Art. 4(7) of the General Data Protection Regulation (GDPR), is:

Hossein Farahani
Vienna
Austria
[email protected]

No data protection officer has been appointed, and none is required. Write to the address above for anything in this notice. Full provider details are in the imprint.

2. What this covers

This notice covers the website at pizzadeveloper.com, the dashboard behind sign-in, and the MCP endpoint that connected agents talk to. It does not cover the sites, repositories, or services you link to from a project, or anything your own agent does outside Pizza Developer.

3. What is collected

Account data

Pizza Developer has no password of its own. You sign in with GitHub or with Google, and the provider you choose returns your name, email address, avatar image URL, and whether that email is verified. Those are stored, along with the provider account identifier and the tokens needed to keep you signed in.

What you write

Projects, batches, work items, ideas, instructions, dictionary terms, project trees, and reports are stored as you write them. Treat these fields as ordinary storage: put nothing in them that you would not want held on this server. They are not encrypted in a way that hides them from the operator.

Billing

Paid subscriptions are closed, so no payment data is collected today and Polar receives nothing about you. What follows describes what would happen once subscriptions open. You are sent to Polar to add payment details and manage your subscription. We send Polar your email address, display name, and account identifier for an individual subscription with one seat. We retain Polar customer, checkout, product, and subscription identifiers, subscription status and dates, and discount details. Payment card data is entered at Polar and is not stored by Pizza Developer.

Account email

Resend sends the welcome message and trial reminders.

Connected agents

When an agent connects over MCP, its client registration, the access you granted it, and its tokens are stored. Each tool call it makes is recorded as a countable fact: which agent, which tool, whether it succeeded, when, and which project it named. The arguments it sent, the data it received, and any error text are not stored.

The contact form

The name, email address, subject, and message you send through the contact form are used to answer you. The form is protected by Cloudflare Turnstile: loading the page contacts Cloudflare, which receives your IP address and browser characteristics to decide whether you are a bot. It sets no cookie and builds no advertising profile.

Technical data

Serving a page produces the usual server-side records: IP address, request time, requested URL, response status, referrer, and user agent. Rate limiting counts requests against a key derived from the request so that one visitor cannot exhaust the service for everyone.

pizzadeveloper.com runs behind Cloudflare, which answers DNS for the domain and proxies every request before it reaches the application. Cloudflare therefore sees the IP address, headers, and requested URL of every visit, and terminates the HTTPS connection. It does this to filter attacks and serve the site quickly.

4. Why, and on what legal basis

• Running your account and the dashboard — performance of a contract with you, Art. 6(1)(b) GDPR. Without account data and the content you write there is no service to provide.
• Sign-in, sessions, and connected agents — Art. 6(1)(b) GDPR, and our legitimate interest in keeping accounts secure, Art. 6(1)(f) GDPR.
• Server logs, rate limiting, DNS, the Cloudflare proxy, and abuse prevention — legitimate interest in a service that stays available and is not attacked, Art. 6(1)(f) GDPR.
• Cookieless measurement — legitimate interest in knowing which pages are used and whether they are fast, Art. 6(1)(f) GDPR. No profile is built and no identifier follows you to another site.
• Billing and subscriptions — performance of the paid service contract, Art. 6(1)(b) GDPR, and compliance with accounting and tax duties, Art. 6(1)(c) GDPR.
• Keeping the contact form usable — legitimate interest in stopping automated abuse of a form open to anyone, Art. 6(1)(f) GDPR.
• Answering you — Art. 6(1)(b) or 6(1)(f) GDPR, depending on what you write about, and Art. 6(1)(c) where the law requires an answer, such as a data subject request.

You can object to anything based on legitimate interest at any time, on grounds relating to your particular situation. Write to the contact address above.

5. Cookies and what is stored in your browser

Pizza Developer sets one cookie, and only when you sign in. Everything else it stores lives in your browser’s local storage, never reaches our server, and is there because you changed a setting. There are no advertising cookies, no tracking cookies, and no third-party cookies. That is why you see a notice rather than a consent banner: under Art. 5(3) of the ePrivacy Directive, storage that is strictly necessary for a service you asked for does not need your consent, and a banner asking permission for something it will set anyway teaches people that the button is meaningless.

The keys below are preferences kept on your own machine, so the app looks the way you left it: theme (light, dark, or your system), pd-font-scale (text size), pd-privacy-mask (whether names on screen are masked), pizzadeveloper:relax-sound (whether relax mode makes a sound), and project-table-columns-v1 (which columns the project table shows).

Vercel Analytics and Vercel Speed Insights count page views and measure how fast pages load. Neither sets a cookie, neither stores an identifier that follows you to another site, and neither builds a profile of you. No third party sets a cookie through this site: signing in sends you to GitHub or Google, and the cookies they set there are theirs, on their domain. Typefaces are downloaded when the site is built and served from this domain, so opening a page does not call a font server.

Every browser can block or clear cookies and local storage, usually under privacy or site settings. Clearing them signs you out and resets your preferences; nothing else changes. If Pizza Developer ever uses a cookie that is not strictly necessary, it will ask for your consent before setting it, and it will not be set unless you say yes.

6. Who else sees it

Personal data is not sold and not traded. It is handled by the service providers below for the stated purposes, under their published terms and any applicable data processing agreement. A provider may act as an independent controller where fraud prevention, accounting, or another law requires it. Nobody else receives it except where a law or a court order requires it.

• Vercel — Hosting, content delivery, server logs, and the cookieless audience and speed measurements described in section 5 of the privacy policy. Privacy policy
• GitHub — Sign-in with GitHub, for visitors who choose it. GitHub sees that you signed in and returns your name, email address, and avatar. Privacy policy
• Google — Sign-in with Google, for visitors who choose it. Google sees that you signed in and returns your name, email address, and avatar. Privacy policy
• Google Fonts — Typefaces. They are downloaded at build time and served from this site's own domain, so opening a page does not call Google. Privacy policy
• Cloudflare — Authoritative DNS for pizzadeveloper.com and the reverse proxy every request passes through, so Cloudflare sees the IP address, headers, and requested URL of every visit. It also runs Turnstile, the bot check on the contact form. Privacy policy
• Polar — Merchant of record for subscription checkout, recurring payments, invoices, taxes, fraud prevention, and the customer billing portal. Privacy policy

Other people can see delivery summaries you deliberately publish through a public delivery page. Your private project content is accessible to your account and the agents you authorize, not to other users.

7. Transfers outside the EU/EEA

The providers above are established in, or process data in, the United States. Those transfers rest on the European Commission’s Standard Contractual Clauses, and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards in place.

8. How long it is kept

• Account and content — for as long as your account exists. Deleting a project deletes its content.
• Sessions and agent tokens — until they expire or you revoke them. Revoking an agent removes its tokens and its consent.
• Tool call records and status history — for as long as the project they belong to exists, because they are what the dashboard reads back to you.
• Reports — kept. A report cannot be edited or withdrawn once it is sent.
• Billing records — while your subscription exists and afterward for any period required by accounting, tax, fraud, chargeback, or other applicable law. Polar keeps its own transaction records under its buyer terms and privacy policy.
• Server logs and rate limit counters — short-lived, and kept no longer than needed to spot and stop abuse.

Ask us to delete your account and it goes, along with the projects you own. Where a legal retention period applies, the data is put beyond use instead of deleted until that period runs out.

9. Your rights

If the GDPR applies to you, you have the right to ask for access to your data (Art. 15), to have it corrected (Art. 16), to have it erased (Art. 17), to have its processing restricted (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you can withdraw that consent at any time, without affecting what was done before you withdrew it.

These rights are yours by law. Nothing in our terms limits them, and no term that tried to would be valid.

Write to [email protected] to exercise any of them. We answer within one month, and will say so if we need the extension the GDPR allows.

You can also complain to a supervisory authority, in the country you live in, the country you work in, or the country where you think something went wrong. The authority for this service is Österreichische Datenschutzbehörde.

10. If you are outside the EU/EEA

This service is offered worldwide and the practices described here apply to everyone who uses it, whatever your country’s law would otherwise require of us.

• United Kingdom — the UK GDPR gives you the same rights as section 9, and you can complain to the Information Commissioner’s Office.
• Switzerland — the revised Federal Act on Data Protection gives you rights of access, correction, and deletion, and you can contact the Federal Data Protection and Information Commissioner.
• California — we do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are used in the CCPA. You can ask what we hold and ask us to delete it, using the same contact address, and we will not treat you differently for asking.
• Everywhere else — write to the contact address and we will handle your request under the standard in section 9, which is the strictest one we work to.

Whichever country you are in, your data is stored and processed in the European Union and the United States by the providers listed in section 6. Using the service means that transfer happens.

11. Children and security

Pizza Developer is not for children. You must be at least 16 years old to use it, or older where your country sets a higher age for consenting to online services on your own. We do not knowingly collect data from anyone below that age, and will delete it if we learn we have.

Traffic is served over HTTPS, sessions are held in signed cookies, and access to the database is limited to what runs the service. No system is perfectly secure, and we do not promise one is.

12. Changes

This notice changes when the service does. The date at the top is the date of the current wording. Where a change materially affects you and we hold your email address, we will tell you before it takes effect.