Terms of service

Last updated: October 18, 2026

These terms apply when you book a review on this website. They are short on purpose. If something is unclear, email hello@slopmedic.com before you book.

1. Who we are

Slop Medic is a service of Katalyze, Michel Wehrli, Gysulaweg 7, 5034 Suhr, Switzerland (“we”, “us”).

2. What you buy

You buy a fixed-price service for one app, in the tier you choose: a Safety Scan, a Launch Review or a Fix Pack. After any review you can also buy fixing by the hour, as agreed by email. What each tier includes, its turnaround and the app size it covers are as described on this website at the time you book.

One app means one product: its source code (one repository, or a frontend and its backend in up to two repositories or one monorepo) and the one database or backend project it uses (for example one Supabase or Firebase project), reachable at one address. A mobile app that shares the same backend is part of the same app. A second product, a second database project or an app for a different audience is a second booking.

App size is measured in lines of your own code: the code files in your repository (TypeScript, JavaScript, SQL, CSS and HTML), not counting installed dependencies, lockfiles, build output, images and other assets, generated files (such as database types and generated clients), configuration files, documentation and the UI component kit your tool copied in (for example components/ui). We measure the size before we start and tell you the number; you never have to measure it yourself. If the app is larger than the tier covers, section 3 applies.

Scope. We review apps whose backend is written in JavaScript or TypeScript. Apps with a backend in another language (for example Python) are outside our scope, and we tell you before the work starts. Mobile apps built with Expo or React Native are reviewed through their code and their backend; we do not test on devices or review app-store configuration.

A review is an expert opinion on your code at one point in time. We use automated tools and AI to do a first pass; a human engineer verifies the findings and writes the verdict. A review is not a penetration test, a certification or a guarantee of security. What we find depends on the code and setup you make available to us, and we do not guarantee that your software is secure, correct or free of defects, before or after you apply our recommendations.

3. Booking and payment

Prices are in US dollars and are paid upfront by card through Stripe, unless we agree on an invoice. Your booking is confirmed once you have paid.

Founding price. The first ten Safety Scans are sold at the lower founding price shown on the booking page, in exchange for permission to ask you for a short quote after delivery. You may decline the quote and keep the price. The regular price applies once those ten are booked.

Before we start, we check that your app fits the tier you booked. If it does not, we tell you and you choose: a larger tier, a smaller scope we agree on, or a full refund. The Launch Review covers apps up to the size stated on the website; for apps up to the larger size stated there, a fixed add-on applies, which we tell you about before we start and which you can decline for a full refund.

Upgrade credit. If you book a Launch Review or a Fix Pack for the same app within 30 days of receiving your Safety Scan report, the price you paid for the Safety Scan is deducted from the price of the new tier. The credit applies once per app, is not paid out in cash, and does not apply if the Safety Scan was refunded.

What we need from you. The turnaround starts once we have access to your code (section 4): read-only, or a zip. For the rest of the service we also need: for the live-app proof, the address of your deployed app and a way to sign in with accounts that are not real users (open sign-up or test accounts you create); your database rules (usually in your repository, otherwise an export we show you how to make); and, for the Fix Pack, permission to propose changes to your repository. We never need your passwords or secret keys. We send step-by-step instructions after you book. If we cannot get what we need, we tell you what is missing; the parts of the service that depend on it (such as the live-app proof) are delivered as far as possible, and the rest is noted in the report.

4. Turnaround

Turnaround is counted in business days (Monday to Friday, excluding Swiss public holidays) from the moment we have access to your code.

5. Your code and confidentiality (our NDA)

You confirm that you are allowed to share the code with us.

Every booking includes this confidentiality undertaking, which works like a non-disclosure agreement and needs no separate signature: we keep your code, your data and everything you tell us about your business confidential; we use them only to perform the service; and we never sell, publish or distribute your code. This obligation continues after the service ends.

To work quickly, we use automated tools and an AI provider that process your code on our behalf. We only use AI providers whose terms do not allow them to train on your code. Details are in our privacy policy. Apart from these providers, nobody else gets access to your code.

Access is read-only, except for the Fix Pack (see section 7). We delete our working copy of your code within 7 days of delivering the final report. For a re-check, you give us access again. If you need your own NDA signed as well, send it before you share access. We sign any reasonable NDA that allows the service providers described in our privacy policy. Please remove our access to your code once the service is delivered; we remind you.

6. Testing your live app

When you book, you allow us to test your live app to prove critical problems. We do this with test accounts we create ourselves. We only look at data that a problem exposes, we never change or delete your users’ data, and we tell you which test accounts to remove afterwards. Testing is manual and low-volume: no load or denial-of-service tests, no automated attack tools, and nothing aimed at your hosting or database provider. If your provider’s rules do not allow security testing on your plan, or you would rather we test a copy of your app, we prove the problem on a copy instead; tell us before we start if you prefer that.

7. Fix Pack

With the Fix Pack, we propose changes to your code as pull requests on GitHub; you give us permission to open them, or we work on a copy and send you the changes. After the included scan we send you the list of fixes we propose, with our time estimate, and we change nothing until you approve the list. Every change comes with a plain-language description and a note on how to test it. Nothing is changed in your live app by us: you decide whether to accept each change, and you remain responsible for deploying it. The Fix Pack covers up to 6 hours of fixing work.

More fixing after the 6 hours. If the approved fixes need more time, or you want more fixed, we stop when the 6 hours are used, tell you what remains with a time estimate, and continue only if you approve it in writing (an email is enough). Further work is billed at the hourly rate shown on the website when you approve it, in blocks of hours you agree to and pay for in advance; the three-hour minimum for fixing by the hour does not apply here. You can stop after any block, and you can come back for more fixing later. We never bill hours you have not approved in advance.

Fixing by the hour works the same way: it is paid in advance for the agreed hours, three hours minimum, we agree on what to fix before we start, and it is scheduled by email into our weekly capacity. We tell you the start date before you pay.

8. Calls and follow-up questions

Calls included in your tier are scheduled by email, on weekdays during the hours stated on the website (Swiss time). Follow-up questions about your report are answered by email within the period stated for your tier, counted from delivery of the report. The report and our communication are in English; German is available on request.

The free follow-up check is one re-check of the problems listed in your report, requested within 30 days of delivery, after you have given us access again. For the Safety Scan it covers the problems in the report; for the Launch Review and Fix Pack, every problem in the report. We check in the code and re-test on your live app where the original proof was on the live app, and answer within 2 business days of regaining access. It does not cover new features or code added since the review.

9. Refunds

Safety Scan: find nothing, pay nothing. If your report contains no problem rated medium or higher, we refund the full price automatically. The report states the rating of every problem it lists; medium means a real weakness that could cost you data, money or users if someone went looking, and low means tidy-up that can wait.

All tiers: before we start. Cancel any time before we begin the work and you get a full refund.

Otherwise, once the work has started, the price is not refundable, except where the law requires it (see section 10).

10. Right of withdrawal for consumers in the EU, EEA and UK

If you are a consumer living in the EU, the EEA or the UK, you have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period is 14 days from the day the contract is concluded.

To exercise it, tell us by email at hello@slopmedic.com with a clear statement of your decision. You can use the model form below, but you do not have to. It is enough to send your message before the 14 days are over.

If you withdraw, we refund all payments received from you without undue delay, and at the latest within 14 days, using the same payment method you used.

When you book, you can ask us to start right away. If you do and then withdraw, you pay a proportionate amount for what we have already done. Once the service has been fully delivered, you no longer have a right of withdrawal.

Model withdrawal form

To: Katalyze, Michel Wehrli, Gysulaweg 7, 5034 Suhr, Switzerland, hello@slopmedic.com

I hereby give notice that I withdraw from my contract for the following service: [tier name], ordered on [date].
Name: [your name]
Address: [your address]
Date: [date]

11. The report is yours

You may use, copy and share the report as you like, for example with your team, contractors or investors. We may describe the kinds of issues we find in general terms, but we never publish anything that identifies you or your code without your written permission.

12. Liability

Our total liability for any claim related to the service is limited to the price you paid for it. We are not liable for indirect or consequential damages such as lost profits or data. These limits do not apply to damage caused intentionally or through gross negligence, or where the law does not allow them.

13. Governing law

These terms are governed by Swiss law. The place of jurisdiction is Aarau, Switzerland. If you are a consumer, the mandatory consumer protection rules of the country you live in still apply, and the courts where you live may also have jurisdiction.