CROSSFYRE WORKBENCH END USER LICENCE AGREEMENT

Clickswave Labs Private Limited ("we", "us") licenses Crossfyre Workbench (the
"Software") to you on these terms. Installing or running the Software means you accept
them. If you do not accept them, do not install or run it.

1. Who may use it

Anyone may use the Software at no charge and without an account, except for the
features a paid plan unlocks. Today those are writing a scope, replaying a request as
another identity, and writing findings up. The paid features are licensed to one named
person: the individual whose Crossfyre account holds the plan or is covered by an
organisation's plan. They may not be shared with anyone else or used through another
person's account.

2. Installations

The licensee may install and run the Software on as many machines as they use. There
is no per-machine limit, and the Software reads no hardware identifier.

3. What you may not do

You may not modify, decompile, disassemble or reverse engineer the Software, except
where the law allows it regardless of this term; remove or change its notices; get
around the check that gates the paid features; or sell, rent or sublicense the
Software, apart from the redistribution section 4 allows. This section does not apply
to the open source components section 7 describes.

4. Redistribution

You may redistribute unmodified copies of the Software, as we publish them, in an
operating system distribution, a package repository or a mirror of either (for
example Kali Linux, Parrot OS, Exegol or nixpkgs), as long as this licence and the
THIRD-PARTY-NOTICES file go with every copy and you charge nothing for the Software
itself. Repackaging it into another package format is not a modification if the
binary and those two files are left unchanged.

5. Authorised testing only

The Software intercepts, changes and replays network traffic. Use it only against
systems you own or have explicit written permission to test, and stay within that
permission. Our Acceptable Use Policy (https://crossfyre.io/acceptable-use) applies to
the Software as it does to the rest of Crossfyre. Confirming that you are authorised
is your responsibility, not ours.

6. What it sends, and working offline

Your projects, the traffic you capture and the Software's certificate authority stay
on your machine. The Software does not upload them.

The Software contacts crossfyre.io when you sign in, and to check your plan: when it
starts, if you are signed in, and when you ask it to. Signing in sends the name of
your operating system, the Software's version, your machine's host name, and that
the request comes from the Software.

When it starts, the Software also reads the list of published versions from
bins.crossfyre.io, at most once a day, so that it can tell you when a newer one is
out. That request carries nothing about you or your projects. The Software never
downloads or installs an update itself.

You can switch off both checks at start in the Software's Account panel. With them
off, the Software contacts crossfyre.io only when you sign in or ask it to check your
plan, and bins.crossfyre.io only when you ask it to look for a newer version.

When you sign in, and whenever it checks your plan, it receives a signed statement of
the plan and keeps it on your machine for the period that statement gives, which is
at most 30 days, or 60 days for a perpetual licence, and ends sooner when a paid
period is about to end. During that period the paid features work with no network
connection. If the period ends without a fresh check, the paid features lock until
the Software can check again. The free features and your projects are not affected,
and a scope you have already written is still enforced.

7. Open source components

The Software includes open source components. Each is licensed to you under its own
open source licence, which applies to that component in place of this licence. Nothing
in this licence limits the rights those licences give you. The THIRD-PARTY-NOTICES file
installed with the Software lists the components and their licences.

Where the Software is distributed as an AppImage, it also contains libraries from
Debian 12, among them GTK and WebKitGTK, and the AppImage runtime that starts it. The
THIRD-PARTY-NOTICES-APPIMAGE file beside THIRD-PARTY-NOTICES in the AppImage lists them
by the Debian package each came from, and the Debian copyright file of each package,
which gives its licences, is in the AppImage under usr/share/doc. They are open source
components in the sense of this section.

8. No warranty

The Software is provided "as is", without warranty of any kind, express or implied,
including any warranty of fitness for a particular purpose or of non-infringement. To
the extent the law allows, we are not liable for any loss arising from its use,
including lost data, damage to systems you test, and the consequences of testing
without authorisation.

9. Ending the licence

This licence ends automatically if you break it, and you must then stop using the
Software and delete your copies. The paid features last as long as the signed
statement of your plan that the Software holds (section 6). A statement fetched
while the plan was active stays valid until it runs out or the Software checks your
plan again, so the paid features can keep working after the plan or licence covering
them ends, for up to 30 days, or up to 60 days for a perpetual licence.

10. Law

These terms are governed by the laws of India.

Copyright 2026 Clickswave Labs Private Limited.