decoy terms of service

welcome to decoy

thanks for using decoy. these terms of service ("terms") govern your use of our platform and services. by using decoy, you agree to these terms and our privacy policy.

the short version: be cool, don't break the law, and use decoy as intended. we're here to help you reclaim your privacy and enjoy perks—not to enable fraud or abuse.

1. about decoy

what we do

decoy is operated by WhosAt LLC ("WhosAt LLC," "Decoy," "we," "us," or "our"). decoy is a privacy and credential-management service. current features may include a password vault, passkeys, time-based one-time passwords (TOTP), autofill information, disposable email addresses, and tools that let you authorize software agents to act on your behalf. decoy allows you to:

access free trials without unwanted recurring charges
enjoy new customer benefits repeatedly
eliminate spam and protect your real identity
store and use login credentials, passkeys, TOTP secrets, and autofill information
authorize selected devices or agents to use specific information
control your digital footprint

features described as "coming soon," including phone numbers or payment cards, are not part of the services until we make them generally available. additional terms may apply when they launch.

who can use decoy

you must be at least 18 years old (or the age of majority in your jurisdiction)
you must provide accurate information when creating an account
you must comply with all applicable laws and regulations
one person = one account (no sharing or reselling)

2. your account

creating an account

use a supported sign-in method and keep access to your authorized devices secure
keep recovery secrets and any account-access credentials confidential
you're responsible for all activity under your account

account security

notify us immediately of any unauthorized access at [email protected]
don't share your account with others
review connected devices, agents, and grants and revoke access you no longer recognize or need

account termination

you can delete your account anytime through your settings
we may suspend or terminate accounts that violate these terms
account-linked data is handled according to the deletion and retention rules in our privacy policy
you remain responsible for any charges incurred before termination

3. using decoy services

what you can do

create temporary decoys for legitimate personal use
use decoys to access trials, discounts, and promotions
protect your privacy from spam and unwanted communications
delete decoys when you no longer need them

discounts, trials, and promotional offers are set by merchants, not decoy. some offers distinguish customers using email addresses or other identifiers. you are responsible for determining whether you are eligible for an offer and for complying with the merchant terms that apply to you.

what you cannot do

fraud or illegal activity: don't use decoy to defraud merchants, evade legitimate debts, or engage in illegal activities
third-party rights: don't use decoy to impersonate another person, misrepresent material facts, or violate third-party rights
chargebacks abuse: don't use decoy to initiate fraudulent chargebacks or disputes
account sharing/resale: don't sell, rent, or share your decoy account
automated abuse: don't use bots, scrapers, or automated tools without permission
system interference: don't attempt to hack, disrupt, or compromise our systems
impersonation: don't pretend to be someone else or misrepresent your relationship with decoy
spam or harassment: don't use decoy to send spam or harass others

fair use

decoy is for personal use unless we agree otherwise. we may limit or suspend activity that threatens the security, availability, reputation, or lawful operation of the services or other users.

4. vault, passkeys, TOTP, and autofill

encrypted vault

supported vault content is encrypted before it is stored by decoy's backend
decoy's backend does not hold the unwrapped vault key needed to decrypt supported vault content
authorized devices and agents may receive encrypted content or key material wrapped to them and may decrypt the information they are authorized to access
some operational metadata, including identifiers, timestamps, routing information, and access records, may not be end-to-end encrypted

recovery

decoy cannot restore your vault merely because you forgot a master password or lost all decryption keys
recovery requires a recovery key or another authorized device that retains the necessary key material
you are responsible for securely storing any recovery key made available to you

passkeys and TOTP

passkeys and TOTP secrets are sensitive credentials
availability and compatibility depend on the device, browser, operating system, and third-party service
you remain responsible for maintaining another recovery method for third-party accounts

5. disposable email and authorized agents

email services

emails forward to your real address (you control forwarding)
decoy emails may be rejected by some services
email must be processed in readable form when it is received, filtered, forwarded, sent, or otherwise delivered
stored message content may be encrypted, but headers, routing data, abuse-prevention data, and temporary processing copies may remain available as needed to operate the service
deleting a decoy stops all email forwarding immediately

authorized agents and connected apps

you may authorize an agent or connected app to access selected accounts, inboxes, identity information, or actions for a stated period
by approving a grant, you instruct decoy to make the covered information or capability available to that agent. if the grant covers a password, TOTP code, message, passkey operation, identity field, or other secret, the agent may receive or locally decrypt and use it
an authorized agent is a trusted recipient for the information covered by its grant. once information is available in the agent's environment, the agent may be able to display, submit, transmit, retain, or log it, and decoy cannot control the agent's handling of that information
a standing grant is continuing authorization, not approval of only the immediate task. it may be used without another prompt until it expires or you revoke it, subject to any additional confirmation decoy expressly requires
agents can receive malicious or misleading instructions from websites, messages, documents, tools, or other content. those instructions may cause an agent to use granted access in a way you did not intend
you are responsible for choosing agents you trust and reviewing their requested scopes, selected resources, permitted actions, duration, security, and privacy practices. use the narrowest access and shortest duration appropriate for the task, and revoke access you no longer need
decoy remains responsible for enforcing the grant recorded by the services and for decoy's own security obligations. your authorization does not permit decoy or an agent to exceed that grant

data retention

email and metadata retention are described in our privacy policy
deleting a decoy disables that address, but operational backups, security records, and legally required records may age out under separate retention schedules

6. fees and payment

if decoy offers a paid plan, the price, billing period, renewal terms, cancellation method, and any refund right will be shown before purchase or supplied by the app store or payment provider handling the transaction. those purchase-specific terms control over this section if they conflict. do not rely on statements about future pricing, plans, or features as a promise that they will be released.

7. intellectual property

our content

decoy's name, logo, design, and content are protected by copyright and trademark
you can't use our branding without written permission
you can't copy, modify, or distribute our platform or content

your content

you retain ownership of any content you provide
you grant us a limited license to operate our services
we don't claim ownership of your personal information

third-party content

some features may include third-party content or links
we're not responsible for third-party content
third-party services have their own terms and privacy policies

8. privacy and data

our commitment

we store supported vault data without receiving a readable copy and minimize the identifiable service data we retain
we never sell your personal information
we don't track you across the web
read our privacy policy at decoys.me/privacy

your data rights

exercise applicable access, correction, and deletion rights as described in our privacy policy
request a copy of eligible account data; available formats and feature coverage may vary until a documented vault-export format is published
control communication preferences
lodge complaints with relevant authorities

data security

we use TLS to protect data in transit and encryption controls appropriate to the type of stored data
vault encryption does not prevent an authorized device or agent from accessing information included in its grant
no system is 100% secure—use strong passwords
report security issues to [email protected]
we handle security incidents and any legally required notifications in accordance with applicable law

9. disclaimers and limitations

service availability

decoy is provided "as is" without warranties
we don't guarantee uninterrupted service
features may change, be limited, or be discontinued
compatible devices, current software, internet access, and third-party services may be required

no warranty

we don't warrant that decoy will meet your specific needs
we don't guarantee decoys will work with all merchants
some services may block or detect temporary identities
we're not responsible for merchant policies or practices

limitation of liability

to the maximum extent permitted by law:

our total liability is limited to fees paid in the last 12 months
we're not liable for indirect, incidental, or consequential damages
we're not liable for losses due to merchant actions
we're not liable for third-party service failures

merchant relationships

we're not affiliated with merchants you transact with
disputes with merchants are between you and them
we don't control merchant terms, policies, or practices
some merchants may prohibit use of temporary identities

10. legal compliance

your obligations

comply with all applicable laws and regulations
don't engage in fraud, money laundering, or other crimes
respect applicable third-party terms and rights

our rights

we may report illegal activity to authorities
we may suspend accounts pending investigation
we may cooperate with law enforcement as required
we may preserve data as required by law

jurisdictional issues

decoy is based in new york, usa
these terms are governed by new york law
some features may not be available in all jurisdictions
you're responsible for compliance with local laws

11. dispute resolution

informal resolution

before filing any claim, contact us at [email protected] to try to resolve the issue informally. we'll work in good faith to find a solution.

arbitration agreement (us users)

most disputes will be resolved through binding arbitration
arbitration is conducted by jams under their rules
you waive the right to a jury trial
class action waivers apply
small claims court remains available for qualifying claims

exceptions to arbitration

claims related to intellectual property
claims seeking injunctive relief
claims filed in small claims court

international users

users outside the us may have additional rights
contact your local consumer protection agency

12. changes to terms

updates

we may modify these terms with reasonable notice
material changes will be communicated via email or platform notification
continued use after changes constitutes acceptance
if you disagree, discontinue use and contact us about account closure

previous versions

archived versions available upon request
changes don't apply retroactively to past disputes
your relationship with decoy is governed by terms in effect at that time

13. termination

by you

delete your account anytime through settings
any refund depends on the purchase-specific terms and the payment provider that processed it
data is handled according to our privacy policy after account deletion

by us

we may suspend or terminate for terms violations
we may terminate with 30 days notice for any reason
immediate termination for fraud, abuse, or illegal activity
we may also act immediately where necessary to protect users, the services, or third parties

effect of termination

all decoys are immediately deactivated
subscription access ends
data is deleted per our retention policy
sections that should survive (liability, disputes) remain in effect

14. general terms

entire agreement

these terms and our privacy policy constitute the entire agreement between you and decoy.

severability

if any provision is found unenforceable, the rest remains in effect.

no waiver

our failure to enforce a right doesn't waive that right.

assignment

you can't transfer your rights under these terms without our consent. we may transfer these terms as part of a merger, reorganization, financing, or sale of the business, subject to applicable law.

force majeure

we're not liable for delays due to circumstances beyond our control.

contact information

notices should be sent to [email protected]. we will publish a mailing address here before requiring notices by postal mail.

15. contact us

questions about these terms?

emergency security issues

email: [email protected]

our promise

we built decoy because we believe privacy should be easy. these terms are necessary for legal protection, but they don't change our commitment to you:

✓ we protect your privacy
✓ we never sell your data
✓ we're transparent about how we operate
✓ we give you control over your information
✓ we're here to help, not to hassle you

last updated: august 11, 2026