Terms of Service

ICPay is an open-source interface to a smart contract (a canister) running on the Internet Computer. It is not operated by an incorporated company, and no ICPay employee, support desk or account manager exists. It is software, published as source, that you choose to use.

Because there is no legal entity behind it, there is nobody to sue, no insurance, and no deposit protection scheme. If that is not acceptable for the amount you intend to hold, do not hold it here.

Your ICP is not held at your own principal. It sits in a subaccount of the ICPay canister that is derived from your principal, which means the canister's code — not your signature alone — is what moves it.

The practical consequence: you are trusting the canister's code and whoever can upgrade it. Section 7 says exactly who that is. A self-custody wallet does not ask this of you; ICPay does, in exchange for being able to pay a username instead of a 63-character address.

Authentication is Internet Identity only. ICPay never asks for, never receives and cannot store a password, private key or seed phrase.

Your Internet Identity is the only way into your funds. If you lose access to it, your ICPay balance is unreachable — permanently. No recovery phrase for ICPay exists, and none can be created: your identity is derived by Internet Identity, and ICPay never holds a key that could reconstruct it. Set up Internet Identity's own recovery methods before you deposit anything.

A confirmed ledger transfer cannot be reversed, cancelled or refunded by anyone, including whoever controls the canister. There is no chargeback and no dispute process.

Check the recipient before confirming. Sending to a wrong-but-valid address means the money now belongs to whoever holds that address.

Sending, receiving and withdrawing cost ICPay nothing. The Internet Computer ledger charges its own fee of 0.0001 ICP per transfer, deducted from the sender. That fee goes to the ledger, not to ICPay.

Usernames of 5 characters or more are free to claim. Shorter handles are sold, because short handles are the scarce inventory:

Username payments go to a treasury account fixed in the canister's source. They are final and non-refundable. The address is published on the Transparency page so you can confirm where your money went.

• 1 to 8 characters, letters, numbers and underscores only. Case-insensitive, so Alice and alice are the same handle.
• A claim is permanent. There is no release, expiry or reclaim, and handles cannot be sold or transferred between accounts.
• Buying a new handle does not free your old one. Every handle you have ever held keeps pointing at you, so that anyone who memorised an old handle as your payment address still reaches you rather than a stranger who claimed it.
• A handle is a payment address, not a verified identity. It does not prove who someone is. Confirm out-of-band before sending a meaningful amount.

One principal is the canister's controller and can upgrade or stop it. That principal is published on the Transparency page, along with what it can and cannot do.

The interface exposes no function that lets anyone move another user's funds — every transfer and withdrawal draws from the caller's own subaccount, and that is verifiable in the source. But a controller can deploy different code. Upgrade power is the trust you are extending, and it is not eliminated by the current code being honest.

ICPay is provided as-is, without warranty of any kind. It may contain bugs. It may be unavailable. The Internet Computer itself may fail or change. To the fullest extent permitted by law, no contributor is liable for any loss arising from your use of it — including lost funds.

Cryptocurrency prices move. Prices shown in ICPay are indicative, sourced from a third-party feed, and are not an offer or a valuation.

Do not use ICPay for anything unlawful in your jurisdiction, and do not use it if you are barred from using cryptocurrency services where you live. You are responsible for your own tax and reporting obligations — ICPay issues no statements and withholds nothing.

Display names and transfer memos are permanent public records. Do not put anything in them you would not publish.

These terms may change as the software does. The date at the top marks the current version, and the full history is in the public repository.

Questions, security reports and bugs go to GitHub issues. There is no support email and no private channel.