Token Canopy
Sign in

Terms of service

Plain-language terms for Token Canopy, operated by Mnexa, Inc. (“Mnexa”, “we”). We will give 14 days' notice before any change that materially reduces what you can do with your account. Last updated 2026-09-27.

What this covers

These terms govern your use of the Token Canopy website (tokencanopy.com) and the Token Canopy account and workspace service (app.tokencanopy.com, auth.tokencanopy.com) — the sign-in and workspace layer over our products. They also govern your use of hosted AgentDrive during beta, including its workspace UI, REST API, hosted MCP server, and sharing and viewing surfaces. By creating an account, signing in, or using these hosted services, you agree to them.

These terms also apply to e2a's hosted service (e2a.dev, api.e2a.dev, and mailboxes under agents.e2a.dev) where it has not published separate terms. The e2a software itself is open source under the Apache 2.0 license, which governs the code independently of these hosted-service terms.

Early access

Token Canopy is in early access. That has real consequences:

  • The service is provided as-is. There is no uptime SLA. We may take it down for maintenance without notice and we may change or remove features while the product takes shape.
  • We may discontinue the service or any feature during early access. If we wind down a service that holds your data, we will give at least 30 days' notice and a way to export it.

Your account

  • We use WorkOS AuthKit to sign you in (Google or an email code). You are responsible for the security of the email and Google accounts you sign in with.
  • One Token Canopy account can be linked to your accounts in our products. You are responsible for what you — and any agents or API clients acting under your credentials — do in those products.
  • You must be 13 or older to use Token Canopy. If you are using it on behalf of an organization, you confirm you have the authority to bind that organization to these terms.

Acceptable use

You may not use Token Canopy or our hosted products to:

  • Do anything illegal where you are or where we operate, or violate anyone's rights (copyright, trademark, privacy, publicity).
  • Send spam or phishing, distribute malware, or attack other systems. For e2a specifically: the mailboxes we host are for legitimate agent communication, not bulk unsolicited email.
  • Attempt to bypass authentication, access another user's account or data, or probe for vulnerabilities outside a coordinated disclosure (email [email protected] first).
  • Impersonate any person, brand, or organization, or misrepresent who a message is from — through an agent name, display name, subject line, or content designed to look like it comes from someone else.
  • Send messages that ask recipients for credentials, payment details, or other sensitive information under false pretenses, or that link to pages that do.
  • Pay with a payment method you are not authorized to use, test payment cards against our checkout, or dispute charges you authorized.
  • Register a new account, or use someone else's, to get around a suspension, pause, limit, or termination we applied to yours.
  • Exceed documented rate limits deliberately and persistently, or otherwise degrade the service for other users.

For e2a specifically: you are the sender of every message your agents send. You are responsible for its content, for having any consent the law requires (including the CAN-SPAM Act and the equivalent laws wherever your recipients are), and for honoring unsubscribe and complaint signals. e2a is the platform that transmits your messages; we are not their sender or initiator.

That means, for mail your agents send to anyone outside your own account:

  • Every recipient must have asked to hear from you or have an existing relationship with you that makes the message expected. Purchased, rented, or scraped address lists may not be used, and neither may addresses collected for another purpose.
  • Bulk or marketing mail must carry a working way to opt out, and opt-outs, unsubscribe requests, and spam complaints must be honored promptly. Sender names and subject lines must not be misleading.
  • Your sending must stay within the complaint and bounce rates that mailbox providers and our upstream relay tolerate. As a guide, a spam-complaint rate above 0.1% or a bounce rate above 5% will cause us to pause sending or contact you, because sustained rates above those levels put every other user's deliverability at risk.

We may, but are not obliged to, monitor use of the hosted services for compliance with these terms. What that involves for message content is stated precisely in the e2a privacy disclosure: humans do not read your mail except with your consent or where security or the law requires it.

Abuse detection and enforcement

We work to keep the hosted services from being used for spam, phishing, fraud, and impersonation, and we may use automated and manual checks to do so. What that involves for your data is stated in the e2a privacy disclosure. As part of that:

  • Where a check indicates abuse, we may hold or discard messages, pause sending, limit features, require verification, or suspend or terminate the account — before contacting you, where waiting would put recipients or other users at risk. If you contest an automated action, a person reviews it and tells you what we found, within the limits of not tipping off an active abuser.
  • We keep records of abuse (the privacy disclosure says what, and for how long) and may share them with affected parties, hosting and domain providers, payment networks, and law enforcement.
  • Payments the cardholder did not authorize are reversed. An account terminated for abuse forfeits any prepaid fees for the rest of its term.

We make reasonable efforts to detect and stop abuse, but no system catches everything. We do not promise that abusive content will be detected or blocked, that it will be caught before it reaches anyone, or that a legitimate message will never be held by mistake. If your message is held in error, tell us and we will release it.

Your content stays yours

  • You retain ownership of the content you (or your agents) create and store in our products.
  • You grant Mnexa the limited license needed to host, transmit, back up, and serve that content as the product's features require — and nothing more.
  • We do not sell your content and we do not train models on it. The data-handling specifics are in our privacy disclosure.

Fees and billing

  • Paid plans and add-ons are billed monthly in advance through Stripe and renew automatically until you cancel. You can cancel or change your plan at any time from the dashboard; a cancellation or downgrade takes effect at the end of the current billing period and we do not refund the unused part of it.
  • Increasing a plan or add-on quantity mid-period is charged immediately, prorated for the remainder of the period. Reducing a quantity applies immediately with no partial-period credit.
  • Prices exclude taxes. Where we are required to collect sales tax, VAT, or similar, it is added to the invoice. We will give at least 30 days' notice by email before a price increase applies to an existing subscription.
  • Fees are non-refundable except where these terms or the law say otherwise. We reverse payments the cardholder did not authorize, and we may refund at our discretion when we get something wrong.
  • If you dispute a charge with your card issuer instead of contacting us first, we may suspend the account while the dispute is open and close it if the charge was authorized. Disputing a charge you authorized is a breach of these terms.
  • Free plans have the limits shown on the pricing page. We may change those limits, and the features of any plan, with notice as described under Changes to these terms.

Suspension and termination

  • You can stop using Token Canopy at any time and request account deletion (see the privacy disclosure for what deletion does).
  • We may suspend or terminate an account that violates these terms — immediately for severe abuse (illegal content, fraud, attacks on other systems, spam or phishing at scale), with notice for everything else where reasonable. Termination for abuse forfeits prepaid fees, as described under Abuse detection and enforcement.
  • If we terminate you for a reason other than abuse, we will give you a window to export your data.
  • When an account ends, for any reason, access to it and its API keys stops; its content is deleted on the schedule in the privacy disclosure and the e2a privacy disclosure; fees already due remain due; and the sections on content ownership, fees, liability, indemnity, governing law, and general terms continue to apply.

No warranty, limited liability

Token Canopy and our hosted products are provided as-is and as-available, without warranties of any kind, express or implied. To the maximum extent permitted by law, our total liability to you for any claim arising out of or relating to the service is limited to the greater of (a) what you paid us in the 12 months before the claim, or (b) USD $100. We are not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenues, or data.

Other users and third parties.The hosted services carry messages and content that other people create. We are not liable to you or to anyone else for the conduct or content of another user, or for any loss — financial or otherwise — caused by a message, agent, or account operated by someone other than us, including spam, phishing, fraud, or impersonation that our detection did not catch. If you receive a message you believe is abusive, report it to us at the address below; we act on reports, but we owe no duty to people who are not our customers beyond what the law requires.

Your responsibility for your use. If you use the hosted services on behalf of a business or organization, you will defend and indemnify Mnexa against third-party claims, and the costs that result, arising from your content, your messages, or your breach of these terms. If you use them as an individual consumer, nothing in these terms limits rights you have under law that cannot be waived, and the limits above apply only to the extent the law allows.

Compliance, data, and other terms

  • Laws that apply to your use.You are responsible for complying with the laws that apply to your messages and data — including anti-spam laws such as the CAN-SPAM Act, CASL, and the ePrivacy rules, and privacy laws such as the GDPR and CCPA — and for any notices or consents they require from you. You confirm you are not on a US or EU sanctions list and will not use the hosted services from or for a sanctioned country or person.
  • Data processing. Where we process personal data on your behalf, we do so under the privacy disclosure (Token Canopy) and the e2a privacy disclosure, which list our sub-processors and security measures. Business customers who need a signed Data Processing Agreement can request one at the contact address below. We notify you without undue delay if we learn of a security incident affecting your data.
  • Third-party services. Sign-in providers, payment processing, and the sub-processors listed in the privacy disclosures are operated by third parties under their own terms. We are not responsible for their services beyond what these terms say about ours.
  • Feedback. If you send us suggestions about the products, we may use them without obligation to you.
  • Beta features. Features marked beta, preview, or early access may change or be withdrawn at any time and are excluded from any commitment these terms make about the service.
  • Force majeure. Neither of us is liable for a delay or failure caused by events outside our reasonable control, other than payment obligations.
  • General. These terms, together with the privacy disclosures they reference and the pricing page, are the whole agreement between us about the hosted services. If a court finds part of them unenforceable, the rest still applies. Not enforcing a term is not a waiver of it. You may not assign these terms without our consent; we may assign them to a successor in a merger, acquisition, or sale of the business, with notice to you. They confer no rights on anyone who is not a party to them. We send notices to the email address on your account; you send them to the contact address below.

Changes to these terms

We may update these terms as the product evolves. We will bump the “Last updated” date at the top, and for any change that materially reduces what you can do with your account we will notify you (via the email tied to your account) at least 14 days before it takes effect. Continued use after a change takes effect means you accept the updated terms.

Governing law

These terms are governed by the laws of the State of California, USA, without regard to its conflict-of-law principles. Before starting a claim, email us with a description of the dispute and give us 30 days to try to resolve it with you. Any dispute that the parties cannot resolve informally will be brought in the state or federal courts located in San Francisco County, California, and you and we each consent to the jurisdiction of those courts.

Contact

AgentDrive access requests, product support, or service incidents: [email protected]. Questions about these terms, and abuse reports (a message you received from an address under agents.e2a.dev, or an account being misused): [email protected]. Coordinated security disclosures: [email protected].