Legal Framework, EULA & Zero-Cookie Privacy Policy (US, EU & UK)

1.1 Community Free Edition vs. Studio Pro License Scope & Definition of “Conduit Audio Parties”

For purposes of this Agreement, “Conduit Audio Parties” means Conduit Audio, its current and future parent or operating entities (whether incorporated as Oy, Ab, Ltd., Inc., LLC, or otherwise), and its founders, owners, individual software developers, authors, shareholders, directors, officers, employees, contractors, open-source contributors, successors, assigns, affiliates, and licensors. Every disclaimer of warranty, assumption of risk, negligence release, limitation of liability, indemnification obligation, and Helsinki, Finland governing law and exclusive venue defense in this Agreement applies equally to and protects all Conduit Audio Parties in both their corporate and personal/individual capacities.

Conduit Community Free Edition ($0) grants a perpetual, non-exclusive license to use the Conduit appliance software for single-zone local playback, 4-band parametric equalization, and turnkey browser onboarding. Conduit Studio Pro ($0 Lifetime Founders License or $0/yr Annual Pass) unlocks multi-room synchronized zone groups (up to 20 Snapcast room nodes, depending on Raspberry Pi 4 / Pi 5 CPU capacity), Studio Sound Rack DSP plugins, 64-bit FIR room acoustic convolution, network NAS library mounts, Qobuz Hi-Res integration, and Gemini AI Auto-DJ. Each Studio Pro license key (CNDT-PRO-...) is cryptographically signed via Ed25519 and bound to a single primary server Hardware ID (CND-XXXX-XXXX-XXXX or CNDT-XXXX-XXXX-XXXX):
• Studio Pro Lifetime License (studio_pro_lifetime): Issued with expires_at: null. Operates as a perpetual, 100% air-gapped offline license that never expires and never requires internet connectivity after activation.
• Studio Pro Monthly (studio_pro_monthly) & Annual (studio_pro_annual) Subscription Leases: Issued as time-bounded Ed25519 cryptographic lease tokens carrying a mandatory ISO-8601 expires_at timestamp (30-day monthly term + 3-day grace buffer = 33 days, or 365-day annual term + 3-day grace buffer = 368 days). Subscription leases operate offline during their active lease window (enforced locally via the appliance's Dual Anti-Tamper Clock Guard combining a persistent UTC high-water mark and monotonic lease uptime counter) and require a periodic renewal refresh (POST /api/license/refresh) or updated .lic key at the end of each billing cycle.

1.2 Self-Service Hardware Transfer Policy (Up to 2 Lifetime Transfers & 90-Day Cooldown)

Because Raspberry Pi boards and SD/SSD hardware may be upgraded or replaced over time, every Studio Pro license includes two (2) automated self-service hardware transfers via the Customer Profile Portal. Transfer #1 is immediate for legitimate board replacements or upgrades; Transfer #2 is subject to a 90-day cooldown window following Transfer #1 to prevent rapid license rotation across multiple active boards. When you transfer a license to a new Hardware ID, a replacement Ed25519 CNDT-PRO token is generated immediately, and you agree to deactivate and cease using the prior license token on the retired Raspberry Pi board. Superseded Hardware IDs (old_hw_id) and prior license tokens are permanently recorded in the hardware_transfers audit log, published in the signed OTA release manifest (revoked_hw_ids in /api/releases/latest) so retired boards automatically revert to the Community Free tier when checking for updates, and flagged if concurrent use across retired Raspberry Pi boards is detected.

1.5 Third-Party Streaming, Trademarks & Cloud API Disclaimer

Integrations with Qobuz Hi-Res Streaming, YouTube/yt-dlp audio ingestion, LRCLIB synchronized lyrics, iTunes artwork lookup, and Google Gemini AI Auto-DJ operate using your own user-supplied credentials and API keys stored locally in your appliance's encrypted credential_vault. Local network audio pipe compatibility is provided via the independent open-source shairport-sync daemon. Apple® and AirPlay® are trademarks of Apple Inc., registered in the U.S. and other countries and regions. Conduit Audio is not affiliated with, endorsed by, sponsored by, or MFi-certified by Apple Inc., Qobuz, Google, or YouTube, and does not warrant uninterrupted availability of third-party APIs or protocols. Users must comply with the terms of service of any third-party platform they connect to their local appliance.

1.6 Open-Source Software & GPLv3 / MIT Aggregate Distribution Notice

ConduitServerOS and ConduitNodeOS are distributed as an aggregate software distribution under GNU GPLv3 Section 5. Open-source system components—including the Linux Kernel (GPLv2), CamillaDSP (GPLv3), Snapcast (GPLv3), Shairport-Sync (MIT), BlueZ, and ALSA utilities—execute as independent system processes communicating over standard operating system pipes (/tmp/snapfifo-airplay), sockets, and CLI interfaces, and remain governed by their respective open-source licenses. The proprietary Conduit orchestration daemon (/opt/conduit/conduit-backend) and Conduit React/PWA user interface are proprietary works of Conduit Audio licensed under this EULA. Complete source code references and build flags for all GPL components are available upon request.

1.8 Governing Law of Finland (EU), Exclusive Jurisdiction in Helsinki, Finland (Helsingin käräjäoikeus / FAI Arbitration), US Class-Action & Jury Waiver & Export Control

Governing Law (Laws of the Republic of Finland): Except to the extent preempted by mandatory consumer statutes that cannot be waived by agreement, this Agreement and any dispute, claim, or controversy arising out of or relating to Conduit Audio software, firmware, hardware, or services (whether in contract, tort, negligence, statute, or otherwise) shall be governed by and construed exclusively in accordance with the laws of the Republic of Finland (Suomen laki), without regard to its conflict-of-law principles and expressly excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG). Under Finnish law (rikastumiskielto), punitive, exemplary, and speculative damages are strictly excluded.

Exclusive Venue & Dispute Resolution in Helsinki, Finland: Any dispute, controversy, or claim arising out of or relating to this Agreement or any Conduit Audio product or service that is not resolved informally within thirty (30) days of written notice to legal@conduit-audio.com shall be resolved exclusively in Helsinki, Finland, either: (a) by binding individual arbitration seated in Helsinki, Finland administered under the Rules of the Arbitration Institute of the Finland Chamber of Commerce (Keskuskauppakamarin välimieslautakunta — FAI) by a single arbitrator (enforceable worldwide under the 1958 New York Convention, and in accordance with the US Federal Arbitration Act, 9 U.S.C. § 1 et seq. for US claimants); or (b) to the extent arbitration is not elected or permitted, in the District Court of Helsinki (Helsingin käräjäoikeus), Finland as the court of exclusive first instance. Pursuant to Chapter 21 of the Finnish Code of Judicial Procedure (Oikeudenkäymiskaari), the losing party in any proceeding shall reimburse the prevailing party’s reasonable legal costs and attorneys’ fees.

United States Residents — Express Jury Trial Waiver, Class-Action Waiver & Foreign Forum Consent: If you reside in or bring a claim from the United States, you expressly consent to the exclusive jurisdiction and venue of Helsinki, Finland as a mandatory foreign forum selection clause, and YOU AND THE CONDUIT AUDIO PARTIES EACH IRREVOCABLY WAIVE ANY RIGHT TO A TRIAL BY JURY AND WAIVE ANY RIGHT TO BRING OR PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, OR REPRESENTATIVE ACTION in any court or arbitration worldwide.

European Union & United Kingdom Mandatory Consumer Carve-Out (Rome I Art. 6): If you are a consumer habitually resident in a Member State of the European Union or the United Kingdom, nothing in this Section 1.8 deprives you of the protection afforded to you by mandatory provisions of the law of your country of habitual residence under Regulation (EC) No 593/2008 (Rome I, Article 6), Regulation (EU) No 1215/2012 (Brussels Ia), or the UK Consumer Rights Act 2015.

Export Control & Cryptographic Compliance (EU Dual-Use & US EAR): Conduit Audio utilizes standard mass-market Ed25519 public-key signatures and TLS encryption eligible under EU Dual-Use Regulation (EU) 2021/821 and US Export Administration Regulations (EAR, 15 CFR § 742.15(b)). You represent that you are not located in any jurisdiction subject to comprehensive EU, US, or UK trade embargoes and are not listed on the US Treasury Department’s OFAC Specially Designated Nationals (SDN) list.

1.9 User Indemnification, Defense & Hold-Harmless Obligation

To the fullest extent permitted by applicable law, you agree to defend, indemnify, and hold harmless the Conduit Audio Parties (including covering reasonable attorneys’ fees, expert fees, and court or arbitration costs) from and against any and all claims, lawsuits, demands, liabilities, damages, losses, fines, and expenses arising out of or relating to: (a) your download, installation, configuration, DIY hardware assembly, or use or misuse of Conduit OS, Conduit Studio Pro, or any associated hardware; (b) any damage to third-party audio equipment, storage media, property, or persons resulting from your audio signal chain or system operation; (c) your violation of this Agreement or any applicable law; or (d) your infringement of any third-party intellectual property, copyright, or streaming platform terms of service.

1.10 One-Year Limitation on Claims (UCC § 2-725), Severability (“Blue-Pencil” Savings Clause) & Entire Agreement

One-Year Statute of Limitations: To the maximum extent permitted by law, any cause of action or claim you may have arising out of or relating to this Agreement or any Conduit Audio product or service must be commenced within one (1) year after the cause of action accrues; otherwise, such cause of action or claim is permanently barred.

Severability & Blue-Pencil Reformation: If any provision, waiver, or disclaimer in this Agreement is held by a court or arbitrator of competent jurisdiction to be invalid, unconscionable, or unenforceable under the mandatory laws of a specific jurisdiction, such provision shall be automatically reformed and enforced to the maximum narrower extent permitted by law to effectuate the original risk-allocation intent of the parties, and the remaining provisions of this Agreement shall remain in full force and effect. This Agreement constitutes the entire agreement between you and the Conduit Audio Parties regarding its subject matter.

2.1 Why You See Zero Cookie Banners on www.conduit-audio.com

Under EU ePrivacy Directive 2002/58/EC Article 5(3) and GDPR, cookie consent banners are required when websites store non-essential tracking, analytics, or advertising cookies on a visitor's device. www.conduit-audio.com sets zero HTTP cookies (document.cookie === "") and loads zero third-party ad pixels or behavioral trackers. When you sign into the Customer Profile Portal (/portal.html), your short-lived session token (CSESS-...) is held strictly in volatile memory (sessionStorage) and transmitted via an Authorization: Bearer header—never via a Set-Cookie header.

2.2 100% Local-First Appliance Privacy (Zero Cloud Phone-Home)

Your Raspberry Pi running conduit-backend operates 100% locally on your home LAN. Your listening history (Conduit Wrapped), local music index, listener profiles, and encrypted streaming credentials stay exclusively on your local SD card or SSD. License activation uses offline Ed25519 public-key cryptography and never phones home to a cloud licensing server.

2.3 Cloudflare D1 Data Inventory & Retention Schedule

• customers & orders: Stores purchase email, order tier, amount, US/EU/UK digital checkout consent timestamp, and anonymous appliance profile tags (hw_arch, dac_mode) required for tax accounting and license recovery.
• issued_licenses & hardware_transfers: Stores your license ID, one-way SHA-256 hardware fingerprint (CND-XXXX-XXXX-XXXX), signed CNDT-PRO token, and self-service transfer audit history (up to 2 transfers).
• otp_codes & customer_sessions: Stores ephemeral SHA-256 hashed 6-digit login codes (15-minute expiry) and 1-hour portal session tokens.
• download_events: Stores anonymous download counters by artifact name and target architecture with zero IP addresses and zero browser fingerprints.
• newsletter_subscribers: Stores optional email addresses submitted by users who explicitly opt in (GDPR Art. 6(1)(a) & Art. 7(4) unbundled from the free “Skip & Download Directly” option) to receive the 5-Step Raspberry Pi Quick-Start Guide via support@conduit-audio.com (MailerSend) and occasional announcements regarding new Conduit OS firmware releases, turnkey hardware availability, and Studio Pro offers. Records an immutable consent_version (v3.0.25-GDPR-MARKETING-OPTIN) and subscribed_at timestamp, and supports instant 1-click withdrawal of consent (GDPR Art. 7(3) & US CAN-SPAM) via the unsubscribe link in every email (GET /api/newsletter/subscribe?action=unsubscribe&email=...) or POST /api/newsletter/subscribe.

2.4 Your GDPR, UK GDPR & US State Privacy Rights (CCPA/CPRA “Do Not Sell or Share” Certification)

EU/UK GDPR & US State Privacy Compliance (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA & Texas TDPSA): Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) and comparable US state privacy statutes, Conduit Audio formally certifies that we do not “sell” or “share” (for cross-context behavioral advertising) any personal information, nor do we collect sensitive personal information or monetize listener telemetry. Transactional emails (6-digit Customer Portal OTP codes and CNDT-PRO license key deliveries) and optional Quick-Start Guide / release emails are dispatched from our verified @conduit-audio.com domain (support@conduit-audio.com) via MailerSend. Because we never sell or share personal data, no “Do Not Sell or Share My Personal Information” opt-out toggle is required—your data is protected by default. You have the right to request access, correction, portable export, or deletion of your personal data without discrimination at any time by contacting privacy@conduit-audio.com, or to unsubscribe from optional release & product alerts in one click via https://www.conduit-audio.com/api/newsletter/subscribe?action=unsubscribe&email=... (GET or POST with { "action": "unsubscribe", "email": "..." }).

3.2 Mistyped Hardware ID Protection (Free Instant Re-Binding)

If you accidentally enter an incorrect CND-XXXX-XXXX-XXXX Device ID during checkout, you do not need to purchase a new license. Simply open the Customer Profile Portal and use one of your 2 free self-service hardware transfers to immediately re-sign your license key for your correct Hardware ID.

3.3 Studio Pro Annual Pass ($0/yr) & Monthly Subscription (studio_pro_monthly / studio_pro_annual) — US ROSCA, FTC Click-to-Cancel, California ARL & 1-Click Auto-Renewal Cancellation

Monthly and Annual Pass subscribers can cancel automatic renewal at any time in one click inside the Customer Profile Portal (POST /api/license/cancel). In full compliance with the US Restore Online Shoppers’ Confidence Act (ROSCA, 15 U.S.C. § 8401 et seq.), the FTC Negative Option / Click-to-Cancel Rule (16 CFR Part 425), the California Automatic Renewal Law (ARL, Cal. Bus. & Prof. Code § 17600 et seq.), and EU/UK subscription laws: (a) if you select the Studio Pro Annual Pass ($0.00 USD/year), your subscription automatically renews annually at $0.00 USD/year (or monthly at $0.00 USD/month for studio_pro_monthly via POST /api/license/renew, issuing a newly signed Ed25519 lease token) unless cancelled prior to the renewal date; and (b) upon 1-click cancellation in /portal.html, your subscription status immediately switches to cancel_at_period_end—you will never be billed again, your signed CNDT-PRO lease token remains 100% active through the end of your paid billing term (expires_at), and once expires_at is reached, the appliance gracefully reverts to the Community Free Edition (1 Zone) without deleting any local music or settings.

3.4 Physical Hardware (Conduit Transport Core $0) — 14-Day Return Policy, Sole & Exclusive Defect Remedy & US Magnuson-Moss / EU / UK Limited Warranty

Pre-order reservations for the physical Conduit Transport Core aluminum streamer ($0) are 100% refundable at any time prior to shipment. Once delivered, physical hardware purchases include a full 14-day statutory return and refund right from the date of delivery for undamaged units returned in original packaging, plus a 1-Year Limited Hardware Warranty compliant with the US Magnuson-Moss Warranty Act (15 U.S.C. § 2301 et seq.) and mandatory EU/UK statutory conformity guarantees. Pursuant to Uniform Commercial Code § 2-719(1)(a) and Finnish Sale of Goods principles, for any physical hardware sold by Conduit Audio, the buyer’s sole and exclusive remedy and the Conduit Audio Parties’ entire liability for any proven manufacturing or material defect during the warranty period is, at Conduit Audio’s sole option, repair of the defective unit, replacement of the defective unit, or refund of the actual purchase price paid. This limited warranty expressly excludes user-supplied Raspberry Pi boards, third-party power supplies (PSUs), external DACs, SD/NVMe storage media, or damage caused by electrical surges, improper voltage, overheating, or physical misuse or modification.