A Big One

Three weeks after closing a $30 million round at a $500 million valuation led by Craft Ventures, ComfyUI published a new Terms of Service on May 13. It carries a creator-friendly headline pledge, plus one sentence directly underneath it that quietly reserves the right to do something the pledge was supposed to prevent.

The pledge: “Comfy will not use Input or Output to train generative AI or diffusion models. Comfy may, however, collect and use limited metadata derived from Customer’s use of the Comfy Products, such as prompt classifications, workflow structures, and node configurations, to improve the performance, functionality, and user experience of the Comfy Products.”

The first sentence protects your content. The second carves out a third category, the behavior around your content, and gives it none of the same protection. And it names that category plainly: prompt classifications, workflow structures, node configurations. The structure of the workflow you spent months refining is exactly what Comfy reserves the right to collect and use.

In human terms: A VFX freelancer has spent two years on her workstation building texture-synthesis workflows for ad clients: the node sequence she refined by trial and error, the sampler choices, the ControlNet she chained to her inpainting pass. That craft lives in JSON files on her drive. This week a brief requires the job to run on hosted infrastructure, so she clicks “Launch Cloud.” The interface looks the same; the workflows transfer cleanly. What’s changed is that her workflow structure, the thing she actually got paid for understanding, is now metadata Comfy is permitted to use to improve its products. Her prompts get classified before they ever reach a training corpus, but the classification carries her intent forward. The pixels she generates are protected. The recipe that produced them is not.

Why this matters: ComfyUI sits underneath a large share of professional VFX, ad-studio, and game-studio AI pipelines. This is the cleanest example this quarter of a Tier-1 venture round reshaping the legal scaffolding around an open-source tool. The no-training pledge is real, but it has two holes the headline doesn’t reach: Partner Nodes downstream and the metadata carve-out upstream. If workflow intelligence becomes the next competitive layer in creative AI, that carve-out is the sentence the contract was built to enable, while still saying never.

Details: Here’s how the carve-out gets there. Input and Output are defined terms: the prompts, models, and workflows you submit, and the images and videos you generate. Those get the no-training protection. But the metadata category names its examples (“prompt classifications, workflow structures, node configurations”) without defining any of them, and attaches no training restriction at all. “Limited” qualifies the categories, not the volume: there’s no cap, no anonymization requirement, no time window. And “to improve the performance, functionality, and user experience” is broad enough to cover almost any model that isn’t strictly generative or diffusion: recommendation engines, ranking, best-next-node suggestion, automatic workflow construction. None of those are barred by the pledge.

The sharpest example is “prompt classifications.” That isn’t your prompt; it’s what comes out the other side of running your prompt through a classifier: a label, an embedding, an intent tag. Type “cinematic rainy Tokyo street with anamorphic flare” and the system can keep something like [cyberpunk, night exterior, lens-style, workflow type #4821]. The text never enters a training set. The meaning does.

That matters because of what workflow data actually is. A ComfyUI workflow encodes which nodes chain to which, which sampler an artist preferred, which order of operations a senior technical artist worked out over months. Outputs commoditize and prompts are noisy, but workflows are expertise, and expertise is exactly what the carve-out names. The ToS doesn’t say Comfy is training a workflow-savvy agent on user behavior. It preserves the ability to, while still saying the word never about Input and Output.

The rest of the rewrite is the scaffolding for a commercial pivot. Two new defined terms carry it: Comfy OSS (the open-source repos at github.com/Comfy-Org, explicitly excluded from these Terms) and Comfy Products (Cloud, API, Enterprise, which the Terms govern). Run ComfyUI on your own machine and you’re outside the contract; launch Cloud and you’re inside it. Inside, the mechanics are conventional enterprise fare: a formally defined Enterprise tier, prepaid Credits that are “final and non-refundable,” auto-renewing self-serve plans, JAMS arbitration in San Francisco, and a liability cap floored at the greater of $1,000 or six months of fees. Carving OSS out is what lets Comfy layer all of this onto Cloud without it touching the local install the community built around. It is the structural version of the funding announcement’s promise that ComfyUI “always stays open.”

One editorial detail: the live ToS page carries a noindex, nofollow directive. It’s footer-linked from every page on comfy.org, so anyone looking will find it, but a Google search for “ComfyUI terms of service” still surfaces the pre-May-13 language. Deliberate or a leftover static-site flag, the effect is that the commercial framework is now legally operative while the old community-friendly framing is what journalists, prospective hires, and studio compliance teams see first.