Acceptance
These Terms of Use ("Terms") are an agreement between you and Ondrej Dvorak ("we", "us", "our"), who operates Nacodex. They cover the Nacodex code audit service at nacodex.help (the "Service") and the Nacodex Android app (the "App"), however you obtained it. By signing in, ordering an audit, sending a contribution, or installing or using the App, you accept these Terms. If you do not agree, do not use the Service or the App.
Our Privacy Policy explains how we handle your data and forms part of these Terms.
What Nacodex does
Nacodex reviews source code you submit against its own private rule set, built from real debugging work, and returns a written report: findings ranked by severity, an explanation of each, suggested fixes and a Compliance Score. The review is performed with AI on our server and is overseen by us.
The App and the website are gateways: they let you sign in with your wallet, prepare and send code, pay, follow your orders, read reports, and send contributions. The review itself runs on our server, never on your device.
Nacodex does not hold your funds, does not trade tokens and never moves funds without your explicit approval in your own wallet.
Licence to use the app
We grant you a personal, non-exclusive, non-transferable, revocable licence to install and use the App on devices you own or control, and to use the website, for the purposes described in these Terms.
You may not copy, modify, resell, rent or redistribute the App or the Service, or decompile, disassemble or reverse-engineer them, except where the law allows it regardless of this term. All rights not expressly granted are reserved.
Wallet and sign-in
Your Solana wallet is your account. You sign in by signing a one-time message in your wallet; the signature proves you control the wallet and moves no funds. We store your public wallet address to link your orders, payments, contributions and rewards to you.
- You are responsible for your wallet, its keys and its recovery phrase. We never ask for them and cannot recover access to a wallet you lose.
- Anyone who controls your wallet can sign in as you. Tell us at once if you believe your wallet was compromised.
- Wallet apps (such as Seed Vault, Phantom, Solflare, Backpack or Jupiter) are third-party software with their own terms. We are not responsible for them.
Prices, payment and refunds
- Price. The Service sets the price of each audit from the areas, the depth and the size of the code you choose, and shows it before you pay. The amount locks when you confirm the payment. Very large codebases are quoted by hand.
- Payment. You pay from your own wallet in USDC, SOL or SKR on the Solana blockchain. Your wallet shows the exact transfer before you approve it. A payment is credited only when the Service has verified it on the blockchain.
- Network fees. Solana network fees are paid by you and are not part of the price.
- Refunds. If we cannot deliver an audit you paid for, we refund the amount you paid to the wallet that paid, and tell you when the refund is sent. Refunds are made by hand.
Token values change. The amounts in SOL and SKR are calculated from a USD price at the time of the quote; we make no promise about the value of any token.
Your code
- You keep all rights to the code you submit. You confirm that you are allowed to submit it for review.
- You give us the right to store and process your code, including with the AI provider named in the Privacy Policy, for the sole purpose of performing the audit you ordered. We do not sell or publish your code.
- Remove secrets (keys, passwords, tokens, personal data) before you submit. The App and the website scan a ZIP for secrets before upload and block the ones they detect, but no scan finds everything.
- When you link a public GitHub repository, you confirm that you own or control it; you prove this by adding the ownership file we ask for.
- Uploaded code archives are deleted automatically 7 days after the order is finished.
Audit reports
A report is advisory. It describes what the review found and suggests fixes. It may miss defects and may contain findings that do not apply to your code. It does not guarantee that your code is free of defects or vulnerabilities, and it is not a security certification or an audit opinion for any regulatory purpose.
You decide what to change and you remain responsible for your software. Reports are delivered for your own use.
Reports explain each finding in plain words. They do not disclose the Nacodex rule set, which stays confidential.
Contributions
You can send a contribution: a written lesson about a failure you found and fixed. When you send one, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use, adapt and include its content in the Nacodex rule set and the Service.
- Send only material you are entitled to share. Do not include personal data of others, your employer's confidential information, or secrets.
- We evaluate every contribution and decide at our discretion whether to accept it. A contribution that is not accepted earns nothing.
- We do not show you how an accepted contribution is filed in the rule set.
$Nacodex rewards
During the current staging phase you can earn $Nacodex for accepted contributions, when rules built from your contributions find issues in paid audits, when your audit discovers a new kind of issue, and for audit orders. Some rewards are calculated by reference to the price of the audits concerned.
- Rewards are recorded for your wallet. They cannot yet be claimed, transferred, sold, withdrawn or used to pay for audits, and they have no cash value.
- We may later make them claimable as a Solana token and usable inside the Service. We do not promise that this will happen, when, or at what value. Reward amounts and rules may change.
- We may withhold or reverse rewards obtained through abuse, duplicate submissions or manipulation.
Acceptable use
You agree not to:
- submit malware, code you have no right to submit, or code intended to attack the Service or others;
- try to extract, reconstruct or publish the Nacodex rule set or other non-public parts of the Service, including by probing reports systematically;
- forge, replay or manipulate payments, sign-ins, ownership proofs or reward claims;
- overload the Service, bypass its limits, or use many wallets to get around them;
- use modified versions of the App to bypass its checks;
- use the Service in breach of the law or of anyone else's rights.
If you break these rules we may refuse orders or contributions, withhold rewards and suspend your access (section 13).
Disclaimers
To the extent the law allows, the Service and the App are provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement.
We do not guarantee that the Service will always be available, uninterrupted or error-free. We may maintain, change or discontinue parts of it. We are not responsible for outages or changes of the Solana network, wallet apps, GitHub or other third-party services the Service depends on.
Limitation of liability
To the extent the law allows, we are not liable for indirect, incidental, special or consequential damages, including lost profits, lost data or business interruption, arising from your use of the Service or the App.
To the extent the law allows, our total liability for any claim connected with the Service is limited to the amount you paid for the audit concerned.
Nothing in these Terms limits liability that cannot be limited by law, including liability for intent or gross negligence, or your mandatory rights as a consumer.
Suspension and ending use
You can stop using the Service at any time and ask us to delete your account, as described in the Privacy Policy.
We may suspend or end your access if you break these Terms, act fraudulently or abuse the Service. We may also discontinue the Service; if we do, we will announce it on nacodex.help and refund audits that were paid for but not delivered. $Nacodex rewards have no guaranteed value if the Service ends.
Changes to these terms
We may update these Terms when the Service, the law or our practices change. We will change the "Last updated" date above and, for material changes, announce them on nacodex.help or in the App. A change never affects an order you already paid for. If you continue to use the Service after a change, the updated Terms apply; if you do not agree, stop using the Service.
Governing law
These Terms are governed by the law of the Czech Republic (Czechia), without regard to its conflict-of-law rules. Disputes go to the courts of the Czech Republic.
If you are a consumer in the European Union, you keep the protection of the mandatory consumer law of your country of residence, and you may also bring proceedings in the courts there. Nothing in these Terms limits your statutory rights.
Copyright and intellectual property
Nacodex, the App, the Nacodex logo, the Nacodex rule set, the report format and the content of nacodex.help belong to Ondrej Dvorak and are protected by copyright. Open-source components in the App are used under their own licences. Details: Copyright.
Contact
Questions, complaints and legal notices about these Terms: