Draft prepared for attorney review. These documents are first drafts: they are not legal advice and have not been adopted by Varrock Inc. Points awaiting a business decision are marked [DECISION: …] and points for counsel [COUNSEL: …]; nothing here is in force.

End User License Agreement — OasisGUI, Oasis Mobile, oasis-runner and OasisNet

Draft prepared for review by counsel, dated 2026-10-06. This is a first draft for attorney review, not legal advice, and has not been adopted by Varrock Inc. Business decisions are marked [DECISION: …], questions for counsel [COUNSEL: …]; all are collected under "Open decisions" at the end.

Related documents: Acceptable Use Policy (forms part of this Agreement) · Third-Party Notices · Privacy Policy · Vulnerability Disclosure Policy · Website Terms of Use [DECISION: the file is terms-of-service.md while its title is "Website Terms of Use"; rename one set-wide (README 5.3).]

1. Parties and acceptance#

1.1 This End User License Agreement (the "Agreement") is between you and Varrock Inc., a Delaware (USA) corporation ("Varrock", "we"), whose registered agent is LegalInc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA. [DECISION: licensing/notices mailbox — only sales@oasisgui.com exists today.]

1.2 By downloading, installing, copying or using the Software you accept this Agreement, including the Acceptable Use Policy. If you do not accept it, do not install or use the Software and delete any copies. [DECISION: where acceptance is shown; no acceptance step exists in the code today.]

1.3 If you accept for an organization, you confirm you may bind it, and "you" means that organization.

1.4 Apple-distributed copies. If you obtained the Mobile App through Apple (TestFlight today; the App Store if and when it is listed there): (a) this Agreement is between you and Varrock only, not Apple, and Varrock alone is responsible for the Mobile App and its content; (b) the licence in Section 3 is limited to use on Apple-branded devices you own or control, as the Usage Rules in Apple's App Store Terms of Service permit; (c) Apple has no obligation to furnish maintenance or support for the Mobile App; (d) if the Mobile App fails to conform to any applicable warranty, you may notify Apple and Apple will refund you the purchase price (zero); to the maximum extent permitted by law Apple has no other warranty obligation; (e) Varrock, not Apple, is responsible for addressing any claim by you or a third party relating to the Mobile App or your possession or use of it, including product-liability claims, claims that it fails to conform to a legal or regulatory requirement, and consumer-protection or similar claims; (f) Varrock, not Apple, is responsible for the investigation, defence, settlement and discharge of any third-party claim that the Mobile App infringes intellectual-property rights; (g) you must comply with applicable third-party terms when using the Mobile App; (h) Apple and its subsidiaries are third-party beneficiaries of this Agreement and may enforce it against you; (i) questions and complaints about the Mobile App go to [DECISION: contact mailbox] or the address in Section 1.1; (j) you make the representation in Section 16.2. TestFlight builds are pre-release software provided for testing under Apple's TestFlight terms. [COUNSEL: conform this Section to the current Apple "Instructions for Minimum Terms of Developer's End-User License Agreement"; without them Apple's standard EULA applies instead of this one.] [DECISION: whether and how Oasis Mobile is distributed to customers — the repository shows only direct install and internal TestFlight (OasisMobile/TESTFLIGHT.md), no App Store release.]

2. Definitions#

  • "Desktop App": the OasisGUI desktop application for macOS, Linux and Windows, including the binaries it bundles.
  • "Mobile App": Oasis Mobile, the native iOS application.
  • "Runner": the oasis-runner daemon the Desktop App installs on the machines you connect to (and on the local machine).
  • "VM Helper": the oasis-vmhelper process the Desktop App runs on macOS to host local virtual machines.
  • "Mesh Daemon": the OasisNet daemon (oasisnet), the WireGuard-based mesh service.
  • "Software": the Desktop App, Mobile App, Runner, VM Helper and Mesh Daemon in object-code form, with documentation and updates, excluding Third-Party Components as stated in Section 6.
  • "Third-Party Components": third-party software, firmware, fonts and data included with or delivered alongside the Software, as listed in the Third-Party Notices.
  • "Third-Party Services": services, software and content the Software can connect to or launch but that we do not provide, such as AI coding agents, model and voice APIs, package repositories and cloud storage.
  • "Your Infrastructure": the computers, virtual machines, containers, mobile devices, networks, coordinator and relay hosts, and accounts you own or are authorized to administer.
  • "Consumer": an individual acting for purposes outside their trade, business, craft or profession. "Business User": anyone else, including a person acting for an organization.
  • "Personal Use": use by an individual for their own purposes outside any trade, business, craft or profession, on devices and infrastructure they own or personally control. "Business Use": any other use — including use by or for a company, organization or public body, use by an employee, contractor or agent in the course of work, and use on infrastructure an organization owns or administers.
  • "Enterprise Licence Agreement": a written agreement signed by Varrock that licenses the Software for Business Use by a named organization, including any order form, support, seat, price and term provisions it contains.
  • "Acceptable Use Policy": the Acceptable Use Policy, which forms part of this Agreement.

3. License grant#

3.1 Grant. Subject to this Agreement, Varrock grants you a non-exclusive, non-transferable, revocable licence to (a) install and run the Desktop App (with the VM Helper) on computers, and the Mobile App on iOS devices, within Your Infrastructure; (b) install, copy and run the Runner and Mesh Daemon on any number of machines within Your Infrastructure, including deploying them from the Desktop App over your own SSH connections; and (c) keep reasonable backup copies. For Personal Use this licence is granted by this Agreement alone and is royalty-free. For Business Use this licence is granted only under, and for the term and scope of, an Enterprise Licence Agreement (Section 3.2).

3.2 Personal Use is free; Business Use requires an Enterprise Licence. (a) The Software is free of charge for Personal Use, with no accounts, licence keys, metering or seat limits. (b) Business Use requires an Enterprise Licence Agreement with Varrock; contact sales@oasisgui.com. The Enterprise Licence Agreement sets the licensed organization, scope, term, fees and any support, maintenance or rollout services; this Agreement provides none of those services by itself. (c) Evaluation. Before an Enterprise Licence Agreement is in force, a Business User may install and run the Software solely to evaluate it, on a reasonable number of machines, for up to [DECISION: evaluation period — e.g. 30 days from first installation, renewable only by written consent]. Any other Business Use without an Enterprise Licence Agreement in force is outside the licence granted by this Agreement and is a material breach (Section 17.2). (d) No technical enforcement. The Software contains no licence keys, metering or feature entitlement; the obligation to hold an Enterprise Licence Agreement for Business Use is contractual, and Varrock may rely on it without having technically prevented the use. [COUNSEL: enforceability of a contractual-only business-use restriction in a free, unmetered download; whether the evaluation right should be framed as a limited licence or a covenant not to sue.] [DECISION: standard terms of the Enterprise Licence Agreement — price, seats or machines, term, support and SLA, if any; a template is to be drafted.]

3.3 Users. You may let people you authorize use the Software on Your Infrastructure and remain responsible for their use. You must be at least 18, or the age of majority where you live if higher, to accept this Agreement. If you are younger, a parent or guardian must accept for you. [COUNSEL: harmonise the age floor with the Terms of Service §4.1 (18); GDPR Art. 8 digital-consent age governs consent to information-society services, not capacity to contract.]

3.4 Redistribution and service providers. Copying the Runner and Mesh Daemon within Your Infrastructure is normal use. You may not otherwise redistribute, sell, rent, sublicense or host the Software for third parties, except where Section 6 gives broader rights in a Third-Party Component. Operating the Software for the benefit of other organizations, including as a managed-service or outsourcing provider, is Business Use and requires an Enterprise Licence Agreement that expressly permits it.

4. Restrictions#

4.1 You must not, and must not let others: (a) reverse engineer, decompile or disassemble the Software, except as applicable law expressly permits despite this restriction (Section 4.2); (b) modify or create derivative works of it, except Third-Party Components whose licences allow it; (c) remove or obscure proprietary or licence notices; (d) bypass the signature verification the updater performs on update packages, or feed it a package not signed by Varrock (you may stop receiving updates under Section 7); (e) use the Software for unauthorized access to any computer, network, account or data, or to intercept communications you are not entitled to; or (f) use the Software in violation of law or of the Acceptable Use Policy, including Section 16.

4.2 Rights that cannot be excluded. Nothing here limits rights you have under mandatory law. In the EU and EEA, Directive 2009/24/EC gives you rights this Agreement does not restrict: to make a necessary backup copy (Article 5(2)); to observe, study and test the Software's functioning to determine its underlying ideas and principles (Article 5(3)); and to decompile it to the extent indispensable for the interoperability of an independently created program, on the conditions in Article 6. Comparable UK rights: Copyright, Designs and Patents Act 1988, sections 50A–50C. Before decompiling for interoperability you may request the information from us at [DECISION: contact mailbox]. [COUNSEL: confirm 4.1(a) and (d) do not purport to override Articles 5–6.]

5. Ownership#

5.1 The Software is licensed, not sold. Varrock and its licensors retain all intellectual-property rights in it; rights not expressly granted are reserved.

5.2 Your data. You own everything you process with the Software — transcripts, files, virtual-machine images, mesh configuration, chat messages, credentials. It is stored on Your Infrastructure and, except for the cases in Section 11.2 (notification text passing through a push gateway you enable, and mesh peers' endpoint addresses sent to a geolocation service for country flags), Varrock does not receive it.

6. Third-party and open-source components#

6.1 The Software contains and ships with Third-Party Components, each licensed to you under its own terms as identified in the Third-Party Notices. For each Third-Party Component its own licence prevails over this Agreement, and nothing here restricts rights that licence grants you.

6.2 LGPL and GPL components. As of this draft: (a) the Mesh Daemon binary statically links wireguard-control (LGPL-2.1-or-later); you may modify that library and relink the Mesh Daemon for your own use, and Varrock will make the library's source, the materials needed to modify and relink the Mesh Daemon, and the LGPL text available by the route stated in the Third-Party Notices [COUNSEL: LGPL-2.1 §6 route for the static link — source plus relink materials, dynamic linking, or replacing the crate; and the written-offer wording; nothing ships today] [DECISION: nothing is published and no written offer exists today — choose the LGPL-2.1 §6 route before release and state the actual mechanism here]; (b) the Desktop App's interface bundles the spice-html5 client (LGPL-3.0-or-later) [COUNSEL: LGPL-3.0 §4 route for a minified bundle]; (c) the Desktop App ships crun as a separate, unlinked executable (GPL-2.0-or-later) [COUNSEL: GPL-2.0 §3 — source alongside, written offer, or drop crun]. The Third-Party Notices identify where each licence text and any written offer will be made available; Sections 3 and 4 do not limit those rights. [DECISION: ship THIRD-PARTY-NOTICES.txt, COPYING.LESSER, COPYING and the source or written offer before this Agreement is published; this Section must not go live while the Third-Party Notices §1.4 and §9 gaps are open.]

6.3 Proprietary third-party binaries. On Windows the Mesh Daemon uses the WireGuardNT prebuilt driver from WireGuard LLC under its "Prebuilt Binaries License", and the installer embeds Microsoft's Edge WebView2 bootstrapper, each under its owner's terms as reproduced in the Third-Party Notices; this Agreement grants no further rights in them. [COUNSEL: WireGuardNT licence — renamed DLL, §3(e) naming limits; WebView2 terms to be quoted.] WireGuard is a registered trademark of Jason A. Donenfeld.

6.4 Software fetched at runtime. On your instruction the Software can install software Varrock does not redistribute (Chromium from your OS package manager, Ubuntu or Alpine images, Android container images, AI coding-agent installers), each licensed by its own publisher on terms you are responsible for accepting.

7. Updates#

7.1 Update check. The Desktop App fetches a release manifest from https://oasisgui.com/downloads/latest.json at launch, every ten minutes while running, and when you choose "Check for updates". The request carries no account, version, machine identifier or telemetry; like any HTTPS request it reveals your network address and the updater's user-agent to our web server (Privacy Policy).

7.2 Signed, never silent. Every update package is signed with Varrock's release key; the Desktop App downloads the package named in the manifest and refuses to install it unless its signature verifies against the public key built into the app. The manifest itself, fetched over HTTPS, lists the current version, release notes and each package's signature; it is not separately signed. The app shows the version and release notes and installs only when you choose "Update & Restart". [DECISION: Windows wording — the installer then runs in "passive" mode, progress shown, no further prompts.]

7.3 Disabling updates. You may turn off the periodic check in Settings; the launch check and manual check remain. Package-manager installs (for example Nix) disable the in-app updater. The Runner and Mesh Daemon are updated from the Desktop App over your own connections; the Mobile App through Apple (TestFlight or the App Store, Section 1.4).

7.4 No obligation; support period. Varrock may release updates at its discretion and has no obligation to provide any update or fix except as mandatory law requires and as Section 7.5 states. [DECISION: state a support period and security-update commitment; Regulation (EU) 2024/2847 (Cyber Resilience Act) requires both for products made available in the EU from 11 December 2027, and its vulnerability-reporting duties already apply since 11 September 2026.] [COUNSEL: whether Directive (EU) 2019/770 applies to a free download whose only data flow is the update check; assumed not.]

7.5 Security updates and vulnerability reports. Security fixes are delivered as updates under this Section. Varrock will provide security updates for the Software for [DECISION: support period — CRA Art. 13(8) expects at least five years or the expected product lifetime] from [DECISION: start date], and will publish the end of that period on oasisgui.com. Report suspected vulnerabilities as described in the Vulnerability Disclosure Policy [DECISION: security mailbox]. [COUNSEL: CRA Annex II items to carry in user-facing documentation — single point of contact for vulnerability reporting, support-period end date, update instructions, SBOM access — and whether this Agreement or the documentation is the right carrier.]

8. AI agents and other Third-Party Services#

8.1 The Software can launch, display and orchestrate AI coding agents (such as Claude Code, Codex and Kimi Code), which talk to their own providers (Anthropic, OpenAI, Moonshot) with your accounts; and the Software itself can send requests to services you configure — Anthropic (account sign-in and usage), OpenRouter (orchestration agents) and ElevenLabs (voice) — using your own accounts, API keys and subscriptions. Varrock does not provide those services, is not party to your agreement with their providers, receives none of that traffic, and stores no keys outside Your Infrastructure. Each service's own terms, pricing and privacy policy govern; you are responsible for complying with them, for their charges, and for data you send them. Varrock may change or remove an integration at any time.

8.2 AI output. Code, commands, edits and replies produced by agents and models come from the Third-Party Service, not Varrock, and may be inaccurate, insecure, infringing or harmful. Features that let an agent act autonomously (supervisors, overseers, browser and device automation) carry out the agent's instructions on your machines. You are responsible for reviewing AI output before relying on it and for the actions agents take on Your Infrastructure, and you decide what permissions and credentials they get. [COUNSEL: whether Varrock-authored orchestration (Supervisor, Commander, Overseer) is an "AI system" under Regulation (EU) 2024/1689; Article 50 wording.]

9. Virtual machines, containers and host software you provision#

The Software can create and manage virtual machines, containers, emulators and browser instances on Your Infrastructure using bundled components (Firecracker, Cloud Hypervisor, UEFI firmware, crun, skopeo, umoci, the VM Helper) and images fetched on your instruction. You are responsible for what you provision, the guest software you run and its licences, and securing and backing up those environments. Varrock does not commit that any hardware, hypervisor, GPU, operating system or image is supported or that guest–host isolation is complete; do not rely on the Software as the sole security boundary for untrusted workloads.

10. Mesh networking (OasisNet)#

10.1 OasisNet creates an encrypted WireGuard-based private network between machines you enrol. Its coordinators, relays, chat hubs, exit nodes and SSH certificate authorities run on hosts you choose and operate; the Software ships with no Varrock-operated coordinator or relay, and Varrock has no access to your mesh, keys, members or traffic.

10.2 You operate your mesh: you are responsible for whom you admit, the roles and grants you assign, the exit-node and DNS settings you enable, the traffic your exit nodes carry, and the laws that apply to operating a network. The Mesh Daemon runs with elevated privileges because it configures interfaces and routes; installing it is your decision as administrator.

11. Privacy#

11.1 The Software has no user accounts and no analytics, telemetry or crash reporting. The Desktop App's only default contact with Varrock-operated infrastructure is the update check in Section 7. The Mesh Daemon and the Mobile App do not contact Varrock. The Runner contacts Varrock only if you enable mobile push notifications and keep the default push gateway (Section 11.2(b)); otherwise it never does. Building a virtual machine from the bundled "inference" template fetches the Mesh Daemon binary from a Varrock-operated host, as the Privacy Policy describes. Everything else stays on Your Infrastructure or goes directly to Third-Party Services you configured or to the public services listed in Section 11.2.

11.2 The following involve third parties: (a) by default, the Desktop App's Mesh views look up the country of each mesh peer's public endpoint address with a third-party geolocation service to display a flag; (b) if you enable mobile push notifications, your Runner sends notification text — an excerpt of the terminal pane that triggered the event, which may contain whatever the agent printed — to a push gateway, by default one operated by Varrock, forwarding to Apple; this gateway is currently not in service; and (c) some features make short-lived requests to public services without asking you to pick a provider — for example public-IP and time-zone look-ups when you check port reachability or provision a virtual machine, and public DNS resolvers while an exit node is engaged. The Privacy Policy lists each one and which are on by default. [DECISION: off switch for the flag lookup; whether the Varrock push gateway stays the default when push goes live.] Details, including what our web server may record when serving the manifest and downloads, are in the Privacy Policy.

12. Warranty disclaimer#

12.1 To the fullest extent permitted by law, the Software is provided "as is" and "as available", without warranty of any kind. Varrock and its licensors disclaim all express, implied and statutory warranties, including merchantability, fitness for a particular purpose, title and non-infringement, and do not warrant that the Software will meet your requirements, run without interruption or error, or be secure.

12.2 The Software is not designed or licensed for any use where failure could lead to death, personal injury or severe physical or environmental damage.

13. Limitation of liability#

13.1 To the fullest extent permitted by law, Varrock and its officers, employees, contractors and licensors are not liable for indirect, incidental, special, consequential, exemplary or punitive damages, for loss of profits, revenue, business, goodwill or data (including corrupted or deleted transcripts, virtual machines or configuration), or for any act or omission of a Third-Party Service or AI agent, however caused.

13.2 Cap. To the fullest extent permitted by law, Varrock's total liability relating to this Agreement or the Software will not exceed the greater of (a) what you paid Varrock for the Software in the twelve months before the claim arose (zero for the free download) and (b) [DECISION: USD 50 or USD 100 — one figure, which must match Terms of Service §14.2]. This cap is aggregate across this Agreement and the Website Terms of Use.

13.3 Exceptions. Nothing in this Agreement excludes or limits liability (a) for death or personal injury caused by negligence; (b) for fraud; (c) for intentional misconduct or gross negligence where law does not allow a limit; (d) under mandatory product-liability law (for EU, EEA and UK Consumers, see Section 15.2(c)); or (e) otherwise to the extent law does not permit.

14. Indemnity (Business Users)#

If you are a Business User, you will defend and indemnify Varrock and its officers, employees, contractors and licensors against third-party claims, and the reasonable costs and damages finally awarded or agreed in settlement, to the extent arising from (a) your breach of this Agreement or the Acceptable Use Policy; (b) your operation of a mesh, machines, networks or data you administer with the Software, including claims by a person whose machine or data you accessed; (c) actions taken by AI agents you authorize; or (d) your violation of law or a third party's rights. Varrock will give prompt notice of the claim, let you control the defence and settlement (no settlement may admit fault on Varrock's behalf without its consent), and reasonably cooperate at your cost. [COUNSEL: whether to keep an indemnity in a free licence; mutual IP indemnity.]

15. Consumers in the EU, EEA and UK#

15.1 This Section applies if you are a Consumer habitually resident in the EU, EEA or UK, and prevails over Sections 12, 13, 14 and 19 where they conflict. Nothing in this Agreement limits any right or remedy under the mandatory consumer law of the country where you live, including legal guarantees of conformity and Directive 93/13/EEC on unfair terms as implemented there.

15.2 Liability. In addition to Section 13.3, Varrock does not exclude or limit liability to you (a) for damage caused intentionally or by gross negligence; (b) for breach of an obligation essential to this Agreement, except that for ordinary negligence such liability is limited to foreseeable, typical damage; (c) under the national laws implementing Directive 85/374/EEC and, for products placed on the market after its transposition date, Directive (EU) 2024/2853 on liability for defective products; or (d) for total non-performance. [COUNSEL: follows German "cardinal duties" practice (BGB §§ 276(3), 309 No. 7) as an EU-wide floor; confirm.]

15.3 Free digital content. Because the Software is free and the only data you provide is what is technically necessary for updates, Varrock's position is that Directive (EU) 2019/770 and Directive 2011/83/EU do not apply; if a court finds otherwise, you have the rights those Directives give you. [COUNSEL: confirm the Article 3(1) analysis.]

15.4 Jurisdiction and language. You may bring a claim against Varrock in the courts of the country where you live, and Varrock will bring a claim against you only there. Where Regulation (EU) 1215/2012 (Articles 17–19) or, in the UK, sections 15B–15E of the Civil Jurisdiction and Judgments Act 1982 apply, nothing here reduces those rights. The Delaware choice of law in Section 19 does not deprive you of protections that cannot be derogated from under the law of the country where you live (Regulation (EC) 593/2008, Article 6(2), where it applies; in the UK, the Consumer Rights Act 2015). This Agreement is offered in English only. [COUNSEL: whether Varrock "directs activities" to EU/UK consumers under Brussels I bis Art. 17(1)(c) and Rome I Art. 6(1)(b) — the research sheet calls targeting arguable for an English-only site with no EU pricing; Swiss consumers under the Lugano Convention; Member State language requirements.]

15.5 Varrock does not undertake to take part in consumer arbitration-board proceedings. [DECISION: whether to offer alternative dispute resolution voluntarily.]

16. Export and sanctions compliance#

16.1 The Software contains encryption (WireGuard, TLS and SSH implementations) and is subject to US export-control law, including the Export Administration Regulations (15 C.F.R. Parts 730–774), and may be subject to EU law (Regulation (EU) 2021/821) and other laws. [COUNSEL: confirm classification — the research assumes ECCN 5D002, mass-market, License Exception ENC § 740.17(b)(1) with annual self-classification — and whether coordinator, relay or exit-node functions change that; the iOS project sets ITSAppUsesNonExemptEncryption = NO (OasisMobile/TESTFLIGHT.md, project.pbxproj) while the Mobile App embeds userspace WireGuard; confirm the App Store export-compliance answer.]

16.2 You represent that you are not (a) located in, organized under the laws of, or ordinarily resident in a country or region that is the target of comprehensive US, EU or UK sanctions or a US arms embargo, or to which US law restricts the export of encryption items [COUNSEL: confirm and date the current list — Cuba, Iran, North Korea, the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine; Syria's status after the 2025 US sanctions changes; Russia and Belarus under 15 C.F.R. §746.8 and Regulation (EU) 833/2014]; (b) listed on, or owned or controlled by a person listed on, any US, EU or UK restricted-party list; or (c) using the Software for any prohibited end use, including weapons of mass destruction.

16.3 You must not export, re-export or transfer the Software, or deploy the Runner or Mesh Daemon onto machines, in violation of those laws. [DECISION: geo-block downloads and update manifests for embargoed regions, since anonymous free downloads cannot be list-screened; who maintains the block list.]

17. Term and termination#

17.1 This Agreement takes effect on acceptance and continues until terminated. You may terminate it at any time by uninstalling and deleting all copies of the Software on every machine.

17.2 Varrock may terminate this Agreement, with notice where reasonably possible, if you materially breach it (including the Acceptable Use Policy, and including Business Use without an Enterprise Licence Agreement in force beyond the evaluation right in Section 3.2(c)) and do not cure within thirty days of notice, or immediately for an incurable breach or one involving Section 4.1(e), 4.1(f) or 16. Varrock may stop distributing or supporting the Software at any time; this does not end licences for versions you already installed, except as mandatory law requires. [COUNSEL: survival of a free revocable licence after end-of-distribution; interaction with §7.4 and §7.5.]

17.3 On termination the licence in Section 3 ends and you must stop using and delete the Software. Your rights in Third-Party Components under their own licences are unaffected. Sections 5, 6 and 11 to 20 survive.

18. Changes to this Agreement#

Varrock may update this Agreement for future versions. Material changes will be announced in the updater's release notes or on oasisgui.com before they take effect; the version delivered or linked with a release governs it. Installing a new version after its effective date is acceptance of the updated Agreement for that version; if you disagree, do not install it. [COUNSEL: enforceability of acceptance-by-installation against EU consumers; in-app acceptance step.]

19. Governing law and disputes#

19.1 This Agreement and any dispute relating to it or the Software are governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws rules; the UN Convention on Contracts for the International Sale of Goods does not apply. Section 15 prevails for EU, EEA and UK Consumers.

19.2 Forum. Subject to Section 15, any claim relating to this Agreement or the Software will be brought exclusively in the state or federal courts located in [DECISION: New Castle County, Delaware], and each party submits to their personal jurisdiction; Varrock may seek injunctive relief for infringement of its intellectual-property rights in any competent court. [COUNSEL: confirm venue; whether to add an arbitration clause and class-action waiver for US users (and the consumer-opt-out and mass-arbitration consequences if so); none is drafted.]

20. General#

20.1 This Agreement, the Acceptable Use Policy, which forms part of it, the Third-Party Notices and any separate written services or business licence agreement are the entire agreement about the Software and supersede prior terms. The Privacy Policy describes how Varrock handles personal data and is not a contract term. The Website Terms of Use govern oasisgui.com. Where an Enterprise Licence Agreement is in force, it governs Business Use by the organization it names and prevails over this Agreement to the extent of any conflict; this Agreement continues to apply to everything the Enterprise Licence Agreement does not address.

20.2 If a provision is held unenforceable it is enforced to the maximum extent permitted and the rest remains in effect. Failure to enforce a provision is not a waiver.

20.3 Notices. To Varrock: [DECISION: contact mailbox — only sales@oasisgui.com exists today], or by post c/o the registered agent named in Section 1.1. To you: through the Software's update prompt or on oasisgui.com.

Open decisions#

Every marker in this draft, in order (full text in the section cited):

  1. Related documents [DECISION: terms-of-service.md filename vs "Website Terms of Use" title.]
  2. §1.1 [DECISION: licensing/notices mailbox.]
  3. §1.2 [DECISION: where acceptance is shown.]
  4. §1.4(i) [DECISION: contact mailbox for Mobile App complaints.]
  5. §1.4 [COUNSEL: conform to Apple's Minimum Terms of Developer's EULA.]
  6. §1.4 [DECISION: Oasis Mobile distribution channel — no App Store release today.]
  7. §3.2 [DECISION: evaluation period for Business Users before an Enterprise Licence Agreement.] (Resolved 2026-10-07: Business Use requires an Enterprise Licence Agreement; Personal Use stays free.)
  8. §3.2 [COUNSEL: enforceability of the contractual-only business-use restriction.] [DECISION: standard terms of the Enterprise Licence Agreement — price, seats or machines, term, support/SLA; template to be drafted.]
  9. §3.3 [COUNSEL: age floor harmonised with Terms of Service.]
  10. §3.4 (Resolved 2026-10-07: managed-service providers need an Enterprise Licence Agreement that expressly permits it.)
  11. §4.2 [DECISION: interoperability-request mailbox.]
  12. §4.2 [COUNSEL: §4.1(a)/(d) vs Directive 2009/24/EC.]
  13. §6.2(a) [COUNSEL: LGPL-2.1 route and written-offer wording for wireguard-control.]
  14. §6.2(a) [DECISION: choose the LGPL-2.1 §6 route before release; nothing published today.]
  15. §6.2(b) [COUNSEL: LGPL-3.0 route for spice-html5.]
  16. §6.2(c) [COUNSEL: GPL-2.0 route for crun.]
  17. §6.2 [DECISION: ship notice file, licence texts and source/offer before publication; §6.2 must not go live while Notices §1.4 and §9 gaps are open.]
  18. §6.3 [COUNSEL: WireGuardNT and WebView2 terms.]
  19. §7.2 [DECISION: Windows passive-install wording.]
  20. §7.4 [DECISION: support period and security-update commitment (CRA).]
  21. §7.4 [COUNSEL: Directive 2019/770 applicability.]
  22. §7.5 [DECISION: security-update support period.]
  23. §7.5 [DECISION: support-period start date.]
  24. §7.5 [DECISION: security mailbox.]
  25. §7.5 [COUNSEL: CRA Annex II user-information items and their carrier.]
  26. §8.2 [COUNSEL: AI Act status; Art. 50 wording.]
  27. §11.2 [DECISION: flag-lookup switch; push gateway default.]
  28. §13.2 [DECISION: liability floor — USD 50 or USD 100, matching Terms of Service §14.2.]
  29. §14 [COUNSEL: indemnity in a free licence; mutual IP indemnity.]
  30. §15.2 [COUNSEL: EU consumer liability wording.]
  31. §15.3 [COUNSEL: Directive 2019/770 Art. 3(1).]
  32. §15.4 [COUNSEL: directing activities under Brussels I bis / Rome I; Swiss consumers; local-language requirements.]
  33. §15.5 [DECISION: voluntary ADR.]
  34. §16.1 [COUNSEL: export classification; iOS ITSAppUsesNonExemptEncryption answer.]
  35. §16.2 [COUNSEL: confirm and date the embargoed-country and encryption-restricted list.]
  36. §16.3 [DECISION: geo-blocking downloads.]
  37. §17.2 [COUNSEL: licence survival after end-of-distribution.]
  38. §18 [COUNSEL: acceptance-by-installation for EU consumers.]
  39. §19.2 [DECISION: forum venue.]
  40. §19.2 [COUNSEL: confirm venue; arbitration and class-action waiver.]
  41. §20.3 [DECISION: notices mailbox.]

Source: docs/legal/eula.md in the repository · draft for attorney review · 43 [DECISION] markers and 41 [COUNSEL] markers on this page.