Licensing Conflict: Apache 2.0 vs Terms of Service Content Rights Requirements

[icoxfog417]

What happened?

As a open source Cline user, I found unclear separation between the open source license and the service terms.

1. Cline project is licensed under Apache 2.0, which:

   • Allows commercial use
   • Does not require contractual agreements between users and Cline Bot Inc.
   • Permits free use and modification of the software

2. However, the Cline Bot Inc.'s Terms of Service updated on February 24th, 2025 that includes VSCode extension (*1) requires users to:

   • Accept a contract with Cline Bot Inc.
   • At 3.2, grant Cline extensive rights to user content and output, including:
     • Irrevocable, perpetual, transferable rights
     • Rights to modify and create derivative works
     • Rights to use content for business purposes and product development
     • Worldwide, royalty-free licensing rights
   • Simply, it exposes all data including prompt, source code and responses to Cline Bot Inc (refer 3.1).

This creates a concerning situation where:

• Users expecting Apache 2.0 freedoms are actually required to accept additional terms
• The ToS imposes significant content rights requirements that go beyond the Apache 2.0 scope

Could you please clarify:

1. How these licensing terms are meant to coexist?
2. Which parts of the project are purely Apache 2.0 vs requiring ToS acceptance?
3. Whether the ToS content rights requirements can be reconciled with Apache 2.0's permissive nature?

*1 : Here is the exact part that indicates VSCode extension (Cline OSS?) is included to Terms of Services.

These Terms of Service (these “Terms”) describe the terms and conditions by which you may access and/or use: (a) the Visual Studio Code extension and software development agent provided by Cline Bot Inc. (including its successors and assigns, “Cline,” “we,” “our,” or “us”) that uses frontier models to write, edit, and build software; and (b) the website(s), including cline.bot, and any successor URL(s), and any and all related software, documentation, and online, mobile-enabled, and/or digital services that link to these Terms (collectively, the “Service”).

Steps to reproduce

1. Visit https://cline.bot/tos, then finds out the conflict between license on GitHub.

Relevant API REQUEST output

Provider/Model

none

Operating System

none

System Info

none

Cline Version

(This is not Cline Version) but Terms of Service is updated on February 24th, 2025.

Additional context

Security Concerns documentation outlines the architecture designed to maintain data privacy and security but does not address right of data usage. While the secure architecture framework protects data, Cline Bot Inc. reserves the right to request data access (like having a key for house) according to terms of service.

[saoudrizwan]

Thank you for raising this 🙏

You're absolutely right that the distinction between the open-source license and our hosted services needs to be made clearer, and we're working with legal counsel to update our ToS.

To clarify:

• The Cline VS Code extension itself is open-source and licensed under Apache 2.0. This means anyone can freely use, modify, and distribute the extension without needing to agree to any additional terms. If you're self-hosting or using your own API keys, none of our hosted ToS apply.

• The Terms of Service at cline.bot/tos apply only to users who choose to use our hosted API provider ("Cline" in the "API Provider" dropdown). This is an optional service that powers the extension if you don’t bring your own API key. These terms support scenarios like routing requests to third-party inference providers and sending telemetry when users opt in to the "Allow anonymous error and usage reporting" setting.

• If you use your own key (e.g. Anthropic, OpenAI, OpenRouter, etc.), we have no access to your requests, code, or completions. Your data does not touch our servers at all, and your usage is governed solely by the Apache 2.0 open-source license and the API provider you configure.

I'll follow up once we've updated our terms to make these things more clear.

[icoxfog417]

Thank you for your clarification! This is excellent news for the community.
We will close this issue once the Terms of Service update has been completed.

[saoudrizwan]

Following up as promised, we’ve updated our Terms of Service at cline.bot/tos to better clarify the distinctions and boundary between the open-source extension and our hosted services. Notably:

"...if you install a Cline Extension and direct all model calls through infrastructure you control, Cline does not receive or store your input tokens, output tokens, underlying code, or other User Content."

This reflects what we’ve always intended: if you’re using your own API key or model endpoint, we don’t see or store anything. The Apache 2.0 license governs your use, and there are no additional terms. Thank you to everyone for their input and patience as we worked this out! ❤️

[icoxfog417]

Thank you for your clarification! The updated Terms of Service will ensure that Cline maintains user's data security standards 💪
I close this issue. Thank you again for your engagement to our concern.