What happens if a payment fails, how to choose who approves, and what the log actually records. None of this is hidden behind a conversation.
No auto-approval, no loosened expiry, no weaker encryption. A billing problem restricts what is new; it never withdraws what already runs — until suspension, which we name below rather than leave you to discover.
| day 0 | The payment fails. We tell you. | Nothing changes. |
| days 1–14 | Grace. | Nothing changes. |
| days 15–45 | Restricted. No new apps, secrets, enrolments or re-keys. | Existing apps keep being armed. |
| day 46 | Suspended. | Arming stops, so apps no longer start. |
| day 90 | The earliest we delete anything, and never within 30 days of last contact with you. | Export still works. |
Payment failed? You have fourteen days before restrictions begin. Your export stays available, suspension included.
You can leave whenever you choose. Export your secrets and decrypt them offline with your recovery kit, even if your subscription is suspended.
That backup was issued before your first secret existed, and before we took a card. It is the ordinary way out, not a contingency.
If your phone and your computer sign in to the same Apple or Google account, they share one passkey. Enrol a separate device, such as a security key.
You can enrol additional devices at no extra charge.
On Solo, only you can approve a release. If you are unavailable, new starts wait.
Every release records who approved it. Included on every plan.
Every release writes one row. This is a real example of the shape — the values are made up, the fields are not.
Fourteen secrets, sealed to one process, released at 03:02:14 to the launcher on 185.199.108.153.
The chain is why the row matters: each record carries the hash of the one before it, so a missing or altered entry is detectable rather than merely unlikely.