Expand policies for Slink and community game servers

privacy-policy.md

@@ -1,155 +1,167 @@
 # Privacy Policy
 
-**Last updated:** 2026-07-09
+**Last updated:** 2026-08-11
 
-This Privacy Policy explains how Majjo Duran collects, uses, stores, and protects your data when you use our services. It works alongside our Terms of Service and should be read together with them.
+This Privacy Policy explains how Majjo Duran collects, uses, stores, and protects data when you use our services. It works alongside our Terms of Service.
 
-We collect the minimum data reasonably needed to operate, secure, and monitor our services. We do not sell your data. We do not run advertising tracking.
+We do not sell personal data or use advertising trackers. We aim to collect only what is reasonably needed to operate, secure, moderate, and improve the services.
 
 ---
 
 ## 1. Service Scope
 
-This policy applies to all services covered by our Terms of Service:
+This policy applies to user-facing services covered by our Terms of Service:
 
 - **Plex** — media streaming and playback
 - **Seerr** — media request management
 - **Bitwarden (Vault)** — password and credential management
+- **Slink** — image upload, storage, and link sharing
+- **Community game servers** — including Minecraft and Palworld
 
-Supporting infrastructure such as security monitoring, access logging, and analytics operates behind these services. Data processed by this infrastructure is covered by this policy.
+Administrative and supporting infrastructure—including reverse proxies, security monitoring, access logging, analytics, media-management tools, dashboards, and AI-assisted administration—may process data behind these services but is not separately offered to users.
 
 ## 2. Data We Collect
 
-When you use our services, we may collect and process the following categories of data:
+Depending on the service you use, we may process:
 
-- **Account and identity data** — usernames, email addresses where applicable, Discord usernames if used for support or access, service roles and permissions.
-- **IP and network data** — IP addresses, ASN/provider, VPN/datacenter/proxy classification, country or region from GeoIP where available.
-- **Device and client data** — device name, platform, app or browser type, device identifiers where provided by the service.
-- **Playback and media activity** — watch history, user statistics, media titles and metadata, playback devices, timestamps, bandwidth, transcode, and session data where available.
-- **Request activity** — Seerr requests, approval/denial status, requester, requested media, timestamps, and request history.
-- **Vault and authentication data** — Bitwarden access metadata, login and session events, known-device checks, failed authentication and security events where logged.
-- **Access and security logs** — request metadata including IP, host, path, method, status code, timestamps, duration, routed service, and TLS/router metadata.
-- **Enforcement data** — bans, suspensions, blacklists, VPN/datacenter/proxy violations, scanner and probing records, abuse and security incident notes.
-- **Support communications** — Discord, email, or other support messages related to account, access, or service issues.
+- **Account and identity data** — usernames, email addresses where applicable, Discord usernames used for support or access, roles, and permissions
+- **IP and network data** — IP addresses, ASN/provider information, VPN/datacenter/proxy classification, and approximate country or region from GeoIP
+- **Device and client data** — device name, platform, application or browser type, client version, and identifiers supplied by the service
+- **Playback and media activity** — watch history, media titles and metadata, playback devices, timestamps, bandwidth, transcoding, sessions, and user statistics
+- **Request activity** — Seerr requests, requester, approval or denial state, requested media, timestamps, and history
+- **Vault and authentication metadata** — login and session events, known-device checks, failed authentication, and security events where logged; private vault contents and raw credentials are not used for analytics or AI training
+- **Slink account and upload data** — usernames, account settings, uploaded image files, filenames, image type and size, dimensions, share/privacy/password/expiration settings, upload and deletion times, storage usage, and access activity where logged
+- **Game-server data** — player names, UUIDs or platform/account identifiers, IP addresses, connection history, chat and command logs where enabled, gameplay and administrative events, moderation actions, inventories, character or player progress, server statistics, and contributions stored in shared world files
+- **Access and security logs** — IP, host, path, method, status code, timestamp, duration, routed service, user-agent, TLS/router metadata, and traffic volume
+- **Enforcement data** — warnings, bans, suspensions, blacklists, moderation actions, suspected cheating or exploitation, scanner/probing records, and incident notes
+- **Support communications** — Discord, email, or other support messages related to access, moderation, content, or service issues
 
-Data is only acquired when you actively use our services. We do not collect data without your knowledge.
+Data is generally collected when you interact with a service, when your client connects, when a public share link is requested, or when security systems observe traffic reaching our infrastructure.
 
-## 3. How We Use Your Data
+## 3. How We Use Data
 
-Data is used for:
+Data may be used to:
 
-- Operating and maintaining the services
-- Monitoring performance and resource utilization
-- Analyzing user activity for service optimization
-- Security monitoring, abuse prevention, and threat detection
-- Enforcing compliance with our Terms of Service
-- Providing user-facing features such as playback history and dashboards
-- Training internal AI models (see Section 4)
-
-Data will not be shared with third parties except as required by law or as necessary to operate and protect the services.
+- Operate, maintain, and troubleshoot services
+- Provide uploads, sharing, playback, requests, authentication, multiplayer worlds, and other user-facing features
+- Monitor performance, bandwidth, storage, and resource utilization
+- Secure accounts and infrastructure and detect abuse, cheating, exploitation, scanning, or attacks
+- Moderate user uploads, chat, gameplay, and community conduct
+- Investigate rights complaints, incidents, and Terms of Service violations
+- Restore backups, troubleshoot corrupted game state, and maintain shared worlds
+- Provide support and communicate service changes
+- Train or evaluate internal AI models as described in Section 4
 
 ## 4. AI & Automated Processing
 
-Your data may be processed by AI and automated systems as part of service operation, security monitoring, and improvement.
+Data may be processed by local or cloud-based AI and automated systems for operation, security monitoring, abuse detection, moderation support, troubleshooting, and service improvement.
 
-- **Local AI** — Internal systems may process service data for security analysis, abuse detection, and operational tasks.
-- **Cloud AI** — Data may be processed by cloud-based AI providers for inference and analysis. Our current cloud provider (Ollama) operates under a zero-log-retention and zero-training policy, meaning your data is not stored or used for training by the provider.
+Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are internal-only, access-controlled, and not exposed to users.
 
-**AI Training:**
+Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training. When cloud AI providers are used, data is limited to what is reasonably necessary for the task and is processed under the provider's applicable terms and privacy practices.
 
-Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are:
+Automated security or moderation signals are not treated as infallible. Context may be reviewed before permanent enforcement where circumstances allow.
 
-- **Internal-only** — never sold, published, or shared with third parties
-- **Access-controlled** — accessible only by Majjo and authorized management members (currently none exist)
-- **Not user-facing** — models are used for administration and security, not exposed to users
+## 5. Slink Sharing & Third-Party Caching
 
-Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training, regardless of consent.
+Slink content is stored on infrastructure operated by Majjo Duran until deleted, removed, or expired according to the applicable settings and retention limits.
 
-## 5. Data Retention
+When you create or distribute a share link, anyone who receives or discovers that link may request the image unless you use an available password or other access restriction. Discord and other platforms may automatically crawl, proxy, resize, preview, or cache shared images. Those services may process the image, link, and request metadata under their own terms and privacy policies.
 
-We retain data for as long as necessary to operate, secure, and enforce our services. Specifically:
+Deleting an upload or share from Slink does not delete copies already downloaded, reposted, captured, or cached by recipients, browsers, Discord, content-delivery networks, search engines, or other third parties outside our control.
 
-- **Service and activity data** (playback history, request history, dashboards) — retained indefinitely to provide user-facing history features and service functionality.
-- **Access and security logs** — retained as needed for diagnostics, performance monitoring, and security analysis.
-- **Enforcement data** (bans, suspensions, blacklists, abuse records) — may be retained permanently to prevent evasion and protect the services.
-- **Support communications** — retained as long as needed for support and enforcement purposes.
+## 6. Game Servers & Third-Party Platforms
 
-Data related to suspected abuse, compromise, or security incidents may be retained longer than standard retention periods where necessary to investigate, prevent recurrence, or enforce access restrictions.
+Minecraft, Palworld, Steam, Microsoft/Xbox, Mojang, Pocketpair, mod loaders, and third-party mods or plugins may independently process account, device, telemetry, crash, or gameplay data under their own terms and privacy policies. We do not control that separate processing.
 
-Users may request deletion of their data (see Sections 9–10), but some data cannot be deleted where it is required for security or enforcement.
+Third-party server components may create their own configuration, log, cache, or world data as part of normal operation. We limit access to server files to administration and operational purposes, but cannot guarantee the behavior or security of third-party code.
 
-## 6. Data Storage Location
+Game chat and activity occur in a shared multiplayer environment. Other players may see, record, quote, stream, or capture what you say, build, or do. Do not disclose information you do not want other players to receive.
 
-All sensitive data is stored within the European Union. The vast majority of data is hosted in Majjo's private infrastructure in Stockholm, Sweden. No sensitive service data is currently stored on servers outside the EU.
+## 7. Data Retention
 
-Some infrastructure providers may process limited data (such as email routing or DNS) as part of operating the services. These are listed in Section 7.
+We retain data for as long as reasonably necessary to operate, secure, moderate, and enforce the services:
 
-## 7. Data Sharing & Third Parties
+- **Accounts and service activity** — retained while the account or service relationship remains active and longer where needed for functionality or support
+- **Slink uploads** — retained until deleted by the user, expired, removed by management, or deleted with the account, subject to backups and third-party copies
+- **Game worlds and player state** — retained as part of the active world or server history; individual player data may remain embedded in shared world files and backups
+- **Playback, request, and dashboard history** — may be retained indefinitely to provide history and service functionality
+- **Access and security logs** — retained as needed for diagnostics, bandwidth monitoring, abuse prevention, and security analysis
+- **Enforcement and moderation data** — may be retained permanently where necessary to prevent evasion and protect users and services
+- **Support communications** — retained as needed for support, moderation, and enforcement
 
-We do not sell your data. We do not voluntarily share your data with unrelated third parties.
+Data connected to suspected abuse, compromise, illegal content, rights complaints, cheating, or security incidents may be retained longer while necessary to investigate, document, or prevent recurrence.
 
-The following providers may process limited data when necessary to operate, host, or support the services:
+## 8. Data Storage & International Processing
 
-- **Infrastructure and hosting providers** — process data such as IP addresses and traffic metadata as part of hosting and routing.
-- **Email providers** — process data necessary for email delivery and support communications.
-- **Discord** — processes messages, usernames, and related data when support is conducted through Discord.
+Primary service storage and most sensitive operational data are hosted on private infrastructure in Stockholm, Sweden.
 
-Data may be disclosed to legal authorities only where required by law.
+Limited data may be processed outside Sweden or the European Union when you interact with third-party services or when infrastructure providers are required to deliver the service. In particular, public Slink images and links may be fetched or cached globally by Discord, browsers, recipients, and content-delivery networks. Game publishers, platform providers, email providers, DNS providers, and cloud AI providers may also process limited data in other jurisdictions under their own terms.
 
-## 8. Cookies & Sessions
+## 9. Data Sharing & Third Parties
 
-Cookies, session tokens, and local storage are used only for service-related purposes:
+We do not sell personal data or voluntarily share it with unrelated third parties. Data may be processed by or disclosed to:
 
-- Login sessions and authentication
-- Security and access control
-- User preferences and settings
+- **Infrastructure, DNS, and hosting providers** — traffic metadata and technical information needed for routing, delivery, and security
+- **Email providers** — data required for email delivery and support communications
+- **Discord** — messages and usernames used for support or community access, plus shared Slink images and link metadata when users post links to Discord
+- **Game and platform providers** — such as Microsoft, Mojang, Xbox, Pocketpair, and Steam when their games, accounts, networking, or software are used
+- **Cloud AI providers** — limited task data when cloud inference is used
+- **Legal authorities or rights holders** — only where legally required or reasonably necessary to respond to valid legal or rights complaints
 
-We do not use advertising cookies. We do not use unrelated tracking cookies. We do not use cookies for any purpose not connected to our services.
+## 10. Cookies & Sessions
 
-## 9. Your Rights
+Cookies, session tokens, and local storage are used for login sessions, authentication, security, access control, and service preferences. We do not use advertising cookies or unrelated behavioral tracking.
 
-You have the following rights regarding your personal data:
+## 11. Security Monitoring
 
-- **Access** — You may request a copy of the personal data we hold about you.
-- **Modification** — You may request corrections to your data if it is inaccurate or incomplete.
-- **Deletion** — You may request deletion of your data, subject to the limits in Section 10.
-- **Data Portability** — You may request a copy of your data in a structured, machine-readable format.
-- **Withdrawal of Consent** — You may stop using the services at any time. Note that service data needed for security and enforcement may still be retained as described in this policy.
+Security monitoring may log request metadata, classify traffic by ASN/provider or GeoIP, detect suspicious patterns, and automatically rate-limit or temporarily block traffic. Game servers may additionally log connections, commands, chat where enabled, suspicious gameplay, and administrative actions.
 
-To exercise any of these rights, contact management using the information in Section 12.
+Provider or datacenter classification alone is not treated as conclusive proof of abuse. Legitimate platform proxying or caching of public Slink links, including Discord image fetching, may originate from shared cloud or CDN infrastructure.
 
-## 10. Data Deletion Limits
+## 12. Your Rights
 
-You may request deletion of your identifiable data. However, some data cannot be deleted:
+Subject to applicable law, you may request:
 
-- Security records, ban records, and blacklists retained to prevent evasion
-- Enforcement data required to maintain the integrity of the services
-- Data within rotated backups that may persist until the retention window expires
-- Data required for ongoing security operations
+- Access to personal data we hold about you
+- Correction of inaccurate or incomplete data
+- Deletion, subject to Section 13
+- A structured, machine-readable copy where reasonably available
+- Withdrawal of consent where consent is the applicable legal basis
 
-Requesting deletion of data required for security or enforcement purposes may result in loss of access or blacklisting, as that data is necessary to operate the services safely.
+To exercise these rights, contact management using the details below. We may need to verify your identity before fulfilling a request.
 
-## 11. Children's Data
+## 13. Data Deletion Limits
 
-Our services are not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete it. Parents or guardians who believe their child has provided data may contact us using the information in Section 12.
+Some data may not be immediately or fully removable, including:
 
-## 12. Changes to This Policy
+- Security, ban, moderation, and enforcement records required to prevent evasion or protect services
+- Player state or contributions embedded in shared game worlds where separation is not technically reasonable
+- Data in rotated backups until the retention window expires
+- Data required for an active investigation, legal obligation, or rights complaint
+- Copies downloaded, reposted, recorded, or cached by other users or third parties outside our control
 
-We reserve the right to update this Privacy Policy periodically. When changes are made:
+Deleting data required to operate an account may result in loss of access. Requests are normally scheduled within 30 days after identity verification.
 
-- Users will be notified by email and via our Discord server's announcement channel
-- Continued use of the services after notification constitutes acceptance of the updated policy
-- The updated policy takes effect immediately upon publication
+## 14. Children's Data
 
-## 13. Governing Law & Severability
+Services are not directed at children under 13. We do not knowingly offer accounts to children under 13. If we learn that a child under 13 provided personal data, we will take reasonable steps to delete it, subject to security, shared-world, backup, and legal limits.
 
-This Privacy Policy is governed by the laws of Sweden and the European Union. If any provision of this policy is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.
+Parents or guardians who believe a child has provided data may contact us below. Third-party games and platforms may impose additional age or parental-consent requirements.
+
+## 15. Changes to This Policy
+
+We may update this policy periodically. Material changes will be announced by email, through the Discord server's announcement channel, or by another reasonable service notice. Unless a later date is stated, changes take effect upon publication. Continued use after notice constitutes acceptance where permitted by law.
+
+## 16. Governing Law & Severability
+
+This policy is governed by Swedish law and applicable European Union law. Mandatory privacy rights remain unaffected. If a provision is unenforceable or invalid, it will be limited or removed only to the minimum extent necessary; the remainder stays in effect.
 
 ---
 
 **Contact**
 
-For questions, concerns, or requests regarding this Privacy Policy:
+For privacy questions, access requests, deletion requests, or concerns:
 
 - Discord: `@majjoduran`
 - Email: `support@majjoduran.xyz`

terms-of-service.md

@@ -1,148 +1,165 @@
 # Terms of Service
 
-**Last updated:** 2026-07-09
+**Last updated:** 2026-08-11
 
-By accessing or using any of the services provided by Majjo Duran, you agree to be bound by these Terms of Service. If you do not agree to these terms, you must discontinue use of the services immediately.
+By accessing or using any service operated by Majjo Duran and offered to users, you agree to these Terms of Service. If you do not agree, you must discontinue use of the services.
 
 ---
 
 ## 1. Acceptance of Terms
 
-By accessing or using any of the services provided by Majjo Duran, you agree to be bound by these Terms of Service. If you do not agree to these terms, you must discontinue use of the services immediately. Your continued use of the services after any changes to these terms constitutes acceptance of the updated terms.
+By accessing or using any covered service, you agree to be bound by these Terms of Service and any service-specific rules presented to you. Your continued use after an announced update constitutes acceptance of the updated terms.
 
 ## 2. Service Scope
 
-These terms apply to all services operated by Majjo Duran and offered to users, including:
+These terms apply to services operated by Majjo Duran and offered to users, including:
 
 - **Plex** — media streaming and playback
 - **Seerr** — media request management
 - **Bitwarden (Vault)** — password and credential management
+- **Slink** — image upload, storage, and link sharing
+- **Community game servers** — including Minecraft and Palworld servers made available to invited or community users
 
-Supporting infrastructure such as security monitoring, access logging, and analytics operates behind these services but is not offered as a separate service. These terms and the Privacy Policy cover the processing of data by such infrastructure.
+Administrative and supporting systems—including Gitea, Portainer, monitoring dashboards, media-management tools, reverse proxies, access logging, analytics, and AI-assisted administration—are not offered as user services. They may process data behind the covered services as described in the Privacy Policy.
 
-Services may be added, changed, or discontinued at any time. Some services may have additional guidelines or requirements that supplement these terms.
+Services may be added, changed, paused, reset, or discontinued at any time. Some services or game servers may have additional rules that supplement these terms.
 
 ## 3. Acceptable Use
 
 You agree not to:
 
-- Share, sell, or transfer your login credentials or account access
-- Attempt to bypass authentication, access controls, or security measures
-- Probe, scan, or test the services for vulnerabilities without explicit permission
-- Use automated tools to scrape, overload, or disrupt the services
-- Request, upload, or distribute illegal or unlawful content
-- Harass, threaten, or abuse other users or management
+- Share, sell, or transfer login credentials or account access
+- Attempt to bypass authentication, access controls, bans, or security measures
+- Probe, scan, or test services for vulnerabilities without explicit permission
+- Use automated tools to scrape, overload, or disrupt services
+- Request, upload, publish, or distribute illegal or unlawful content
+- Upload content that infringes copyright, privacy, publicity, or other rights
+- Upload malware, malicious files, non-consensual intimate imagery, child sexual abuse material, or content intended to identify, threaten, harass, or exploit another person
+- Harass, threaten, discriminate against, or abuse other users or management
+- Cheat, grief, exploit bugs, evade moderation, damage shared worlds, or intentionally degrade a game server or another player's experience
+- Impersonate management, another user, Mojang, Microsoft, Pocketpair, or another third party
 - Resell or commercially exploit access to the services
-- Use VPN, proxy, Tor, or datacenter IP addresses to access the services (see Section 6)
+- Use VPN, proxy, Tor, or datacenter IP addresses where prohibited under Section 8
 
 ## 4. Accounts & Credentials
 
-You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account. Notify management immediately through Discord or email if you suspect your credentials have been compromised.
+You are responsible for maintaining the confidentiality of your credentials and for activity performed through your account. Notify management immediately through Discord or email if you suspect compromise.
 
-Management may require password resets, enable additional authentication factors, or restrict access if account security is in question.
+Management may require password resets or additional authentication, revoke sessions, restrict access, or suspend an account when its security is in question.
 
-## 5. Data, Privacy & Monitoring
+## 5. Slink Uploads & Shared Content
 
-We collect and process data necessary to operate, secure, and monitor the services. This includes:
+You retain ownership of original content you upload to Slink. By uploading content, you grant Majjo Duran a limited, non-exclusive, royalty-free license to store, back up, process, resize, compress, display, and deliver that content only as necessary to operate Slink and provide the sharing features you request.
+
+You confirm that you own the content or have permission to upload and share it. You are responsible for the content you upload and for choosing appropriate privacy, password, and expiration settings.
+
+A share link may be accessible to anyone who obtains it. Services such as Discord, social platforms, browsers, crawlers, and content-delivery networks may fetch, proxy, preview, or cache shared images. Copies held by recipients or third parties may remain available after the original upload or share is deleted. Management does not control those third-party copies.
+
+Management may restrict sharing, disable links, or remove content when reasonably necessary to address illegality, rights complaints, abuse, security risks, excessive resource use, or violations of these terms. Copyright, privacy, or other content complaints may be sent using the contact details below.
+
+## 6. Community Game Servers & Third-Party Software
+
+Players must follow these terms, server-specific rules, and the applicable publisher/platform terms for each game. Minecraft use remains subject to Mojang/Microsoft terms and community standards. Palworld use remains subject to Pocketpair and the applicable distribution platform's terms.
+
+Our game servers are independent community services. They are not official, approved by, endorsed by, or associated with Mojang, Microsoft, Pocketpair, Steam, or other game publishers and platforms.
+
+Game servers may use third-party mods, plugins, mod loaders, server tools, maps, or content packs. These components are created and maintained by third parties and are outside our control. They may change, become incompatible, contain defects, stop receiving updates, require client-side installation, or affect performance and saved data. We do not guarantee their quality, security, compatibility, continued availability, or fitness for a particular purpose.
+
+Management may update, add, remove, configure, or replace third-party components when needed for security, compatibility, balance, or server operation. Players are responsible for obtaining games and client software from authorized sources and for complying with third-party licenses.
+
+Worlds, characters, inventories, builds, progress, and other game state are provided on a best-effort basis. Rollbacks, resets, wipes, corruption, balance changes, or data loss may occur. We may moderate chat and gameplay, restore backups, remove content, reverse exploited progress, or suspend players to protect the server and community.
+
+## 7. Data, Privacy & Monitoring
+
+We collect and process data necessary to operate, secure, and monitor the services. Depending on the service, this may include:
 
 - IP addresses and network metadata
 - Device and client information
-- Account and identity data (usernames, emails where applicable)
-- Playback and media activity history
-- Request activity and history
-- Access and security logs
-- Enforcement records (bans, suspensions, violations)
+- Account and identity data
+- Playback and request activity
+- Slink uploads, image metadata, share settings, and access activity
+- Game usernames, UUIDs or platform identifiers, chat, connection history, moderation records, gameplay events, inventories, progress, and world contributions
+- Access, security, and enforcement records
 
-Data may be used for service operation, performance monitoring, abuse prevention, security analysis, and enforcement of these terms. Full details on data collection, retention, sharing, and your rights are in our Privacy Policy.
+Data may be used for service operation, performance monitoring, abuse prevention, security analysis, support, moderation, and enforcement. Full details are in the Privacy Policy.
 
-Security monitoring is active on all services. Automated systems may log, classify, rate-limit, or block traffic that is deemed suspicious or abusive. You consent to this monitoring as a condition of using the services.
+Security monitoring is active on all services. Automated systems may log, classify, rate-limit, or block suspicious or abusive traffic.
 
-## 6. VPN / Datacenter / Proxy Policy
+## 8. VPN / Datacenter / Proxy Policy
 
-The use of VPN services, proxies, Tor, or datacenter IP addresses to access any service is prohibited unless explicitly approved by management.
+Use of VPN services, proxies, Tor, or datacenter IP addresses to access non-public or account-based services is prohibited unless explicitly approved by management.
 
-This policy exists because:
-- VPN and proxy networks are frequently used to bypass access rules and restrictions
-- Shared IP pools make it difficult to distinguish legitimate users from attackers and abusers
-- These networks generate disproportionate spam, scanning, and malicious traffic
-- They undermine our ability to ensure a safe and reliable experience for real users
+This restriction does not apply to legitimate automated previewing, proxying, or caching of publicly shared Slink links by platforms such as Discord, nor to infrastructure explicitly approved by management.
 
-Management may grant exceptions on a case-by-case basis. Violating this policy may result in immediate access restriction, ban, or termination without warning.
+Provider or datacenter classification is treated as a security signal rather than conclusive proof of abuse. Management may grant exceptions or request verification. Abuse, evasion, scanning, or unauthorized access may still result in immediate restriction regardless of network type.
 
-## 7. AI & Automated Systems
+## 9. AI & Automated Systems
 
-Your data may be processed by AI and automated systems as part of service operation, security monitoring, and improvement. This includes:
+Service data may be processed by local or cloud-based AI and automated systems for operation, security monitoring, abuse detection, moderation support, and service improvement.
 
-- **Local AI** — Internal systems may process service data for security analysis, abuse detection, and operational tasks.
-- **Cloud AI** — Data may be processed by cloud-based AI providers for inference and analysis. Our current cloud provider (Ollama) operates under a zero-log-retention and zero-training policy, meaning your data is not stored or used for training by the provider.
+Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are internal-only, access-controlled, and not exposed to users. Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training.
 
-**AI Training:**
+Where cloud providers are used, data is limited to what is reasonably necessary for the task and is subject to the provider's applicable terms and privacy practices.
 
-Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are:
+## 10. Service Availability & Data Loss
 
-- **Internal-only** — never sold, published, or shared with third parties
-- **Access-controlled** — accessible only by Majjo and authorized management members (currently none exist)
-- **Not user-facing** — models are used for administration and security, not exposed to users
+Services are privately operated and provided on a best-effort basis. We do not guarantee uptime, availability, performance, compatibility, or permanent storage.
 
-Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training, regardless of consent.
+- Services, worlds, features, mods, and configurations may change or be discontinued
+- Data loss may occur because of hardware failure, software defects, third-party updates, corruption, administrative error, or other events
+- Users should retain their own copies of important uploaded content where practical
+- Management is not liable for losses resulting from interruption, resets, incompatibility, or data loss to the extent permitted by law
 
-## 8. Service Availability
+## 11. Fair Use & Resource Limits
 
-These services are privately operated and provided on a best-effort basis. We do not guarantee any level of uptime, availability, or performance.
+Access is provided for reasonable personal and community use. Management may apply upload limits, storage quotas, bandwidth controls, rate limits, compression, expiration, or other safeguards to preserve service availability.
 
-- Services may be changed, paused, degraded, or discontinued at any time without prior notice
-- Data loss may occur due to hardware failure, software issues, or other events
-- Users should maintain their own backups of any data stored on these services
-- Management is not liable for any loss or damage resulting from service interruption or data loss
+Repeated automated downloading, hotlinking, deliberate bandwidth amplification, excessive storage consumption, or other disproportionate use may be limited or suspended. Legitimate platform previews and caching of ordinary shared Slink links are not considered abuse by themselves.
 
-## 9. Enforcement & Termination
+## 12. Enforcement & Termination
 
-Management reserves the right to suspend, restrict, or terminate access at any time for violations of these terms or for any other valid reason, including but not limited to:
+Management may warn, mute, remove content, roll back progress, suspend, restrict, or terminate access for violations, security risks, disruption, rights complaints, or other valid operational reasons.
 
-- Violating any term of this agreement
-- Sharing or compromising credentials
-- Activities that threaten the security or integrity of the services
-- Using VPN, proxy, Tor, or datacenter IP addresses when prohibited
-- Abuse, harassment, or disruption of other users or services
+Immediate action may be taken without warning when necessary to protect users, shared worlds, data, infrastructure, or legal compliance. Attempts to evade enforcement may result in longer or permanent restrictions.
 
-Access may be restricted immediately and without warning where the safety or integrity of the services is at risk.
+## 13. Account Deletion & Data Removal
 
-## 10. Account Deletion & Data Removal
+You may request deletion of identifiable data by contacting management and verifying your identity. Requests may take up to 30 days.
 
-You may request deletion of your data by contacting management and verifying your identity. Upon verification, deletion will be scheduled and may take up to 30 days.
+Subject to technical and legal limits, deletion may include account data, Slink uploads still under our control, and service-linked records. Some data may not be immediately or fully deleted, including:
 
-Some data cannot be deleted, including:
-- Security records, ban records, and blacklists retained to prevent evasion
-- Enforcement data required to maintain the integrity of the services
-- Data within rotated backups that may persist until the retention window expires
+- Security, ban, moderation, and enforcement records needed to prevent evasion or protect services
+- Shared game-world data that cannot reasonably be separated from the persistent world or other players' activity
+- Data in rotated backups until the applicable retention window expires
+- Copies already obtained or cached by recipients, Discord, browsers, search engines, CDNs, or other third parties outside our control
 
-Requesting deletion of data required for security or enforcement purposes may result in loss of access or blacklisting, as that data is necessary to operate the services safely.
+Deletion of data required to operate an account or enforce access restrictions may result in loss of access.
 
-## 11. Age Requirement
+## 14. Age Requirement
 
-Users must be at least 13 years of age to use these services. Some content available through the services may not be suitable for all ages. Parental controls and content restrictions are available through Plex. Users are responsible for ensuring that their access to content complies with the laws of their jurisdiction.
+Users must be at least 13 years old. A parent or legal guardian is responsible for any additional consent required for a minor under applicable law or third-party platform terms.
 
-## 12. Changes to These Terms
+Some media, user uploads, chat, and multiplayer interactions may not be suitable for all ages. Users and guardians are responsible for applying appropriate supervision and platform controls.
 
-We reserve the right to update these Terms of Service periodically. When changes are made:
+## 15. Changes to These Terms
 
-- Users will be notified by email and via our Discord server's announcement channel
-- Continued use of the services after notification constitutes acceptance of the updated terms
-- The updated terms take effect immediately upon publication
+We may update these terms periodically. Material changes will be announced by email, through the Discord server's announcement channel, or by another reasonable service notice. Unless a later date is stated, updated terms take effect upon publication. Continued use after notice constitutes acceptance.
 
-## 13. Governing Law
+## 16. Governing Law
 
-These terms are governed by the laws of Sweden and the European Union. Any disputes arising from the use of these services shall be resolved in accordance with Swedish law.
+These terms are governed by Swedish law and applicable European Union law. Mandatory rights that cannot legally be waived remain unaffected.
 
-## 14. Severability
+## 17. Severability
 
-If any provision of these Terms of Service is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.
+If a provision is unenforceable or invalid, it will be limited or removed only to the minimum extent necessary. The remaining provisions remain in effect.
 
 ---
 
 **Contact**
 
-For questions, concerns, or requests regarding these terms:
+For questions, rights complaints, takedown requests, or other concerns:
 
 - Discord: `@majjoduran`
-- Email: `support@majjoduran.xyz`
+- Email: `support@majjoduran.xyz`
+
+**Minecraft disclaimer:** NOT AN OFFICIAL MINECRAFT SERVICE. NOT APPROVED BY OR ASSOCIATED WITH MOJANG OR MICROSOFT.