Terms of Use

mwen.io (“mwen”, “we”, “us”, “our”) operates the website at mwen.io and the mwen browser extension (together, the “Service”). These Terms of Use govern your access to and use of the Service.

By accessing or using the Service, you confirm that you have read, understood, and agree to be bound by these terms. If you do not agree, you must not use the Service.

If you are using the Service on behalf of an organisation, you represent that you have authority to bind that organisation to these terms.

mwen is a browser extension and accompanying developer SDK that enables private, credential-based identity verification. The extension stores encrypted identity credentials locally in your browser. It allows you to generate selective disclosure proofs and present them to third-party services that support the OID4VP and SD-JWT-VC open standards.

The Service does not create or maintain user accounts on our servers. Your credentials and private keys exist exclusively on your device.

You must be at least 16 years old (or the age of digital consent in your jurisdiction, whichever is higher) to use the Service. By using the Service you represent that you meet this requirement.

You agree not to:

• Use the Service to present false, fraudulent, or unauthorised credentials to any third party
• Attempt to reverse-engineer, decompile, or tamper with the extension in ways that violate the Apache 2.0 licence terms
• Use the Service in any way that violates applicable laws or regulations in your jurisdiction, including but not limited to laws governing identity fraud, data protection, and consumer protection
• Attempt to interfere with, disrupt, or gain unauthorised access to the infrastructure serving this website
• Use the Service to collect or process personal data of others without a lawful basis

The mwen browser extension, JS SDK, and protocol library are released under the Apache 2.0 licence. Your use of those open-source components is governed by that licence. These Terms of Use govern your use of the hosted website and the extension as distributed through browser extension stores.

Our collection and use of personal data is governed by our Privacy Policy, which is incorporated into these terms by reference. The Privacy Policy describes what data we collect, why, on what legal basis, and the rights you have under GDPR, PIPEDA, CCPA/CPRA, Quebec's Law 25, the Jamaica Data Protection Act 2020, the Barbados Data Protection Act (Cap. 308D), and, where applicable, the African Union Malabo Convention.

The Service is provided “as is” and “as available” without warranty of any kind, express or implied, including without limitation warranties of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Service will be uninterrupted, error-free, or free from security vulnerabilities.

Nothing in this clause limits statutory rights you may have as a consumer under the laws of your jurisdiction that cannot be excluded by contract.

To the maximum extent permitted by applicable law, mwen.io and its contributors shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of or inability to use the Service — including loss of credentials, data, or access to third-party services.

Because credentials are stored exclusively on your device, we cannot recover a lost vault. Keep your 24-word recovery phrase and any encrypted backup files in a safe place. We are not liable for data loss resulting from lost recovery materials.

Where applicable consumer protection legislation (including under EU, Canadian, Quebec, California, Jamaican, or Barbadian law, or under any other jurisdiction whose mandatory consumer protection laws apply to you) grants you rights that cannot be excluded or limited by contract, those rights are not affected by this clause.

If you are a consumer, you may have statutory rights that apply in addition to or instead of these terms, depending on your jurisdiction. Nothing in these terms is intended to limit any right you have that cannot lawfully be excluded, including:

• EU / EEA: Rights under the Consumer Rights Directive (2011/83/EU) and applicable national consumer law, including rights to clear information and remedies for defective digital content.
• Canada: Rights under applicable provincial consumer protection legislation. Quebec consumers have rights under the Consumer Protection Act (L.R.Q., c. P-40.1).
• California: Rights under the California Consumer Privacy Act / CPRA, including rights described in our Privacy Policy. You also have the right to non-discrimination for exercising any CCPA right.
• Jamaica: Rights under the Jamaica Data Protection Act 2020, including rights to access, rectification, erasure, restriction, portability, and objection (including an absolute right to object to direct marketing). The Office of the Information Commissioner (OIC) supervises compliance with the DPA 2020.
• Barbados: Rights under the Barbados Data Protection Act (Cap. 308D, in force since 15 March 2021), including the same categories of rights as listed for Jamaica above. The Data Protection Commissioner of Barbados supervises compliance.
• African Union / Malabo Convention: The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) entered into force in June 2023. It is binding on its 16 ratifying member states, but creates enforceable individual rights only where a ratifying state has enacted domestic implementing legislation. Where such legislation exists in your country, those rights apply in addition to any rights listed above.
• CARICOM / OECS member states: The CARICOM Model Privacy Bill and OECS Data Protection Framework are model instruments, not binding law in their own right. Any data protection rights you hold in a CARICOM or OECS country arise from that country's domestic legislation (such as the Jamaica DPA 2020 or Barbados DPA listed above). Nothing in these terms limits any such statutory right.

mwen allows you to present identity proofs to third-party services (“verifiers”). We are not responsible for the privacy practices, terms, security, or conduct of those services. You should review their policies before presenting any credential. mwen's role is to facilitate the technical presentation of your credential — we are not a party to the relationship between you and the verifier.

The mwen name, logo, and website content are the property of mwen.io and protected by applicable intellectual property laws. The software components are licensed under Apache 2.0 as described in Section 6. Nothing in these terms transfers ownership of any intellectual property to you.

You may stop using the Service at any time by uninstalling the extension. We may suspend or discontinue the Service at any time with reasonable notice where practicable. Termination does not affect credentials stored locally on your device.

We may update these terms from time to time. Material changes will be communicated by updating the effective date at the top of this page and, where appropriate, by notifying newsletter subscribers. Continued use of the Service after changes take effect constitutes your acceptance of the revised terms. If you do not agree to the revised terms, you should stop using the Service.

These terms are governed by the laws of England and Wales, without regard to conflict of law principles, except where mandatory local consumer protection laws in your jurisdiction require otherwise.

We encourage you to contact us directly to resolve any dispute before pursuing formal proceedings. If a dispute cannot be resolved informally, it shall be subject to the exclusive jurisdiction of the courts of England and Wales, subject to any mandatory jurisdiction rules that apply to you as a consumer in your jurisdiction.

EU consumers may also use the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr.

For questions about these terms, contact us at: