Terms of Service
These Terms govern your use of Drawer (drawer.so), a publishing platform for artifacts callable by humans and AI agents. Drawer is operated by Basis Lab Development LLC ("we", "us", "Drawer").
1. Acceptance of Terms
By creating an account, signing in, or using Drawer, you agree to these Terms. If you are using Drawer on behalf of an organization, you represent that you have authority to bind that organization to these Terms. If you do not agree, do not use Drawer.
2. What Drawer Is
Drawer is a publishing platform for artifacts (HTML, Markdown, PDFs, images, and similar files). Artifacts get stable URLs that can be opened by anyone with the link, and updated, versioned, and rolled back. Drawer is callable from a web dashboard, a CLI, a REST API, and an MCP server intended for AI agents.
Drawer is in active development (v0.x). Features may change, break, or be removed. We reserve the right to deprecate or shut down features with reasonable notice.
3. Accounts
Sign-up requires authentication via GitHub or Google OAuth. You are responsible for everything that happens under your account, including activity from your API keys and from AI agents acting on your behalf.
- You may share Drawer's outputs freely, but you remain responsible for your account.
- One person per account. Do not create accounts to impersonate others.
- You must be at least 13 years old to use Drawer (COPPA).
- Keep your linked OAuth credentials, API keys, and session secure.
4. Acceptable Use
You may not use Drawer for, and you may not publish content that:
- Is illegal under applicable law, including child sexual abuse material (CSAM), content supporting terrorism, or content that violates sanctions;
- Phishes, distributes malware, performs credential theft, doxxes individuals, harasses, or directs hate at protected classes;
- Infringes third-party intellectual property, including pirated software or media;
- Constitutes spam, or mass-scale automated content generation intended to deceive readers about authorship or origin;
- Hosts cryptomining workloads, botnet command-and-control, or other unauthorized infrastructure;
- Attempts to circumvent quota limits, rate limits, or workspace-secret allowed-host boundaries;
- Attempts to reverse-engineer Drawer's encryption, probe for vulnerabilities outside an approved security disclosure, or otherwise gain unauthorized access.
We reserve the right to remove content and terminate accounts at our sole discretion for violations of this section. Notice is appreciated but not required where harm is ongoing.
5. User Content (Artifacts)
You retain all ownership of artifacts you publish. You do not give us your copyright. We only need a limited license to operate the service.
You grant Drawer a worldwide, non-exclusive, royalty-free license to host, store, serve, cache, transmit, and display your content as necessary to operate the service — including through Cloudflare's edge network, R2 object storage, and viewer subdomains.
- Public artifacts — by setting visibility to "public," you allow the world to view them. They may be indexed by search engines, cached by third parties, or copied. We do not control downstream copies.
- Unlisted artifacts — still accessible to anyone who has the URL. Unlisted is a privacy preference, not a security boundary.
- Password-protected artifacts — the password provides minimal access friction, not encryption. Treat sensitive content accordingly, and consider whether truly sensitive content belongs on any hosting platform.
You represent that you have all rights, licenses, and consents necessary to publish the content you upload.
6. AI Agent and MCP Access
Drawer exposes MCP tools (publish_artifact, update_artifact, list_artifacts, and others) that AI agents can call on your behalf.
- Actions taken by an AI agent using your API key or OAuth grant are your actions. You are responsible for the prompts, outputs, and resulting content the same as if you typed them yourself.
- We may rate-limit, scope-limit, or revoke agent access without notice to protect platform stability.
- Scoped API keys are available. Use the minimum scope required.
7. Workspace Secrets
Workspace secrets let you store third-party API keys (e.g. OpenAI, Anthropic, Stripe) and use drawer.fetch() from inside an artifact to call those services without exposing the key in client-side code.
- Secret values are encrypted at rest with AES-GCM under a per-user derived key. We cannot show you the stored value back; if you lose it, rotate it at the upstream provider and re-store.
- Drawer's role is server-side injection only. We proxy your request through
/api/proxy, attach your key per the configured header template, and stream the response back. We do not inspect or modify the request body beyond what the proxy template requires. - You are responsible for upstream spending, abuse, rate-limits, and compliance with the third-party provider's terms. Drawer does not cap upstream spend, monitor usage, or enforce upstream rate limits beyond per-IP throttling on our side.
- Allowed-hosts is a security boundary to prevent exfiltration to attacker-controlled domains. It is not a spending control.
- If you publish a workspace-secret-using artifact as public, anyone visiting it can trigger upstream calls. That is the cost of that decision.
- Drawer disclaims liability for charges incurred against your third-party accounts. Set spending caps and alerts directly with each provider.
8. API Keys and OAuth Tokens
Protect your API keys. Rotate them immediately if compromised. Actions taken with your keys are billed to and attributed to your account. We may revoke keys at any time to mitigate abuse.
9. Plans, Billing, and Subscriptions
- Free tier — 5 private/password-protected artifacts, 1 API key, 25 MB per file, 100 MB per artifact, 1 GB total storage. "Made with drawer.so" footer on HTML and Markdown artifacts.
- Pro — $20/month or $180/year, unlimited private/password-protected artifacts, unlimited named API keys, 250 MB per file, 1 GB per artifact, 25 GB total storage, no footer.
Subscriptions auto-renew monthly until you cancel. You can cancel any time via the Stripe billing portal; cancellation takes effect at the end of the current billing period.
No partial-month refunds. If you cancel mid-cycle, you keep Pro features through the end of the cycle, then revert to Free.
Pricing and limits may change with 30 days' notice posted on the pricing page. Existing subscribers will be honored at their current rate for at least the remainder of their current billing period (monthly or annual).
If a payment fails, your account enters a 7-day grace period. After grace, your account downgrades to Free; artifacts above the Free cap remain accessible (read-only) but cannot be updated until billing is resolved.
10. Quotas and Rate Limits
We may rate-limit API and MCP calls per key, per session, and per IP. Specific limits documented at any time are approximate and may change without notice to protect platform stability or respond to abuse.
11. Termination
Either party may terminate at any time. We may suspend or delete accounts for violations of these Terms, especially of the Acceptable Use section. On termination:
- You may export your artifacts via the CLI or API during a 30-day grace period.
- After 30 days, we may delete your account data and content.
- Provisions that should reasonably survive termination (intellectual property, disclaimers, limitation of liability, indemnification, governing law) survive.
12. Disclaimers
Drawer is provided "AS IS" and "AS AVAILABLE," without warranty of any kind, express or implied, including without limitation warranties of merchantability, fitness for a particular purpose, non-infringement, uninterrupted service, error-free operation, or freedom from data loss. Beta status means features may change, break, or be removed.
13. Limitation of Liability
To the maximum extent permitted by law, Drawer and Basis Lab Development LLC are not liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to lost profits, lost data, business interruption, or any third-party spending charges incurred via workspace secrets or otherwise. We are not liable for content moderation decisions.
Our maximum aggregate liability arising out of or related to these Terms or your use of Drawer is capped at the greater of (a) one hundred US dollars ($100) or (b) the fees you paid to Drawer in the twelve (12) months preceding the claim.
14. Indemnification
You agree to indemnify, defend, and hold harmless Basis Lab Development LLC, its officers, directors, employees, and agents from any claims, damages, liabilities, costs, or expenses (including reasonable attorneys' fees) arising from:
- Content you publish on Drawer;
- Actions taken by your account (including AI agents acting on your behalf);
- Your violation of these Terms or applicable law;
- Your violation of any third-party right, including intellectual property and privacy rights.
15. Changes to These Terms
We may update these Terms. Material changes will be announced via email to your registered address and posted on this page with at least 30 days' notice before they take effect. Continued use after the effective date constitutes acceptance.
16. Governing Law and Disputes
These Terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws principles. The exclusive venue for any claim not subject to arbitration (see below) is the state or federal courts located in Dallas County, Texas, and the parties consent to the personal jurisdiction of those courts.
16.1 Arbitration and Class Action Waiver
Except for small claims under $10,000 and actions seeking injunctive relief for intellectual-property violations, any dispute arising out of or relating to these Terms or Drawer will be resolved by binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules. Arbitration will be held in Dallas, Texas, or by remote means. The arbitrator's decision is final and may be entered as a judgment in any court of competent jurisdiction.
CLASS ACTION WAIVER. You and Drawer each waive any right to bring or participate in a class action, collective action, or class arbitration. The arbitrator may not consolidate more than one person's claims.
16.2 Arbitration Opt-Out
You may opt out of the arbitration agreement in Section 16.1 by emailing legal@drawer.so within 30 days of (a) creating your account or (b) the effective date of this Section, whichever is later, with a clear statement that you wish to opt out of arbitration. Opting out does not affect any other provision of these Terms.
17. Severability and Entire Agreement
If any provision of these Terms is found unenforceable, the remaining provisions remain in full effect. These Terms, together with the Privacy Policy and DMCA Policy, constitute the entire agreement between you and Drawer regarding the service and supersede any prior agreements.
18. Contact
All questions — legal, privacy, DMCA, account, billing, security: legal@drawer.so.