Ferrow is free. You pay for the models.

Your prompt goes to the model provider you connected — on Private, that is your own account; on Managed, it is Ferrow's. That is the only outbound call the CLI makes.

Billing talks to Stripe, which sees a subscription id and an email and never sees a vault. If you turn on the relay so your phone or a browser can reach your hub, it carries end-to-end-encrypted payloads between your own devices and cannot read them: the key is on your devices and never on our servers. Nothing crossing the relay is written to disk; a bounded window of recent sealed frames is held in memory so a device that drops its connection can reconnect without a gap. On Managed, a completed answer is held against its request id for about twenty-four hours so a retry replays it instead of paying the provider twice. The privacy page says exactly what is held and for how long.

That is the one qualification on “your notes do not leave”, and it is worth stating exactly. There is no copy of your vault anywhere but your disk, and nothing is uploaded in the background. When the relay is on and one of your own paired devices asks to read a note, that note travels — sealed, on request, and only to a device you paired. A paired browser cannot write to your vault at all; edits happen on the machine itself.

Your API keys do not leave. There is no telemetry and no analytics on this site or in the CLI.

The subscription, plus what you use. Usage is priced on the tokens a call actually spends, at the rate of the model you picked — a small fast model and a frontier one are not within an order of magnitude of each other, so one number printed here would be wrong for most calls and stale for the rest.

What you get instead is arithmetic you can watch. Every reply carries what it cost, in the terminal and in the app, and every charge is on your Stripe receipt. If a call would take you past your cap, Ferrow stops before sending it and tells you what it would have cost — nothing is sent and nothing is charged. You pay for what you use, and nothing else.

The number that decides your bill is the cap, and you set it. Ferrow stops there. If you never set one it uses a conservative default of $20 — ferrow spendcap status tells you what it is before you spend anything.

ferrow unsubscribe. That is the entire flow. No confirmation maze, no discount offer, no exit survey.

It tells you the date your plan ends. You keep everything you paid for until then, and nothing else is charged. Your vault and your notes were never ours — they are files on your disk and they stay exactly where they are.

No local feature is. The vault, memory, search, undo, skills, the Council, projects, import and the local UI are the same on a free account as on any plan, and there is no check anywhere in the command path that asks which one you are on.

What a plan buys is Ferrow's side of it: the relay, reaching your machines through it, the hosted app, and support. Two things additionally need Ferrow's own keys and therefore need Managed: models billed through Ferrow, and schedules that run while your laptop is shut. Everything else runs on yours, free, for as long as you want it.

All of it, on your own machine, with your own model keys — the vault, memory, search, the change log and undo, agents, skills, projects, import and the local UI. No card, no clock, no feature held back. The only thing money buys is model calls billed through us, and you can decide about that on the day you want them.

Nothing, if you use your own model keys — that is the free install, and it does not expire. If you want models billed through us, plans start at $15 a month and include that month’s credits; $100 and $200 are the heavier rungs. Ferrow is pre-1.0 and has not had its first outside user, so the honest advice is to start on the free install and pay only once you know you want it.

Any time, in the app. Moving up takes effect at once; moving down takes effect at your next renewal so you keep the credits you have already paid for. Credits you bought are yours whatever you do with the plan — they never expire and they are never taken back.

Live, always, unless you pass --test. The CLI will not quietly put you in test mode: somebody typing ferrow subscribe means to subscribe, and a command that took their time for nothing would be its own kind of lie.