Add Terms of Service — 14 sections, public-facing

terms-of-service.md

@@ -0,0 +1,148 @@
+# Terms of Service
+
+**Last updated:** 2026-07-09
+
+By accessing or using any of the services provided by Majjo Duran, you agree to be bound by these Terms of Service. If you do not agree to these terms, you must discontinue use of the services immediately.
+
+---
+
+## 1. Acceptance of Terms
+
+By accessing or using any of the services provided by Majjo Duran, you agree to be bound by these Terms of Service. If you do not agree to these terms, you must discontinue use of the services immediately. Your continued use of the services after any changes to these terms constitutes acceptance of the updated terms.
+
+## 2. Service Scope
+
+These terms apply to all services operated by Majjo Duran and offered to users, including:
+
+- **Plex** — media streaming and playback
+- **Seerr** — media request management
+- **Bitwarden (Vault)** — password and credential management
+
+Supporting infrastructure such as security monitoring, access logging, and analytics operates behind these services but is not offered as a separate service. These terms and the Privacy Policy cover the processing of data by such infrastructure.
+
+Services may be added, changed, or discontinued at any time. Some services may have additional guidelines or requirements that supplement these terms.
+
+## 3. Acceptable Use
+
+You agree not to:
+
+- Share, sell, or transfer your login credentials or account access
+- Attempt to bypass authentication, access controls, or security measures
+- Probe, scan, or test the services for vulnerabilities without explicit permission
+- Use automated tools to scrape, overload, or disrupt the services
+- Request, upload, or distribute illegal or unlawful content
+- Harass, threaten, or abuse other users or management
+- Resell or commercially exploit access to the services
+- Use VPN, proxy, Tor, or datacenter IP addresses to access the services (see Section 6)
+
+## 4. Accounts & Credentials
+
+You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account. Notify management immediately through Discord or email if you suspect your credentials have been compromised.
+
+Management may require password resets, enable additional authentication factors, or restrict access if account security is in question.
+
+## 5. Data, Privacy & Monitoring
+
+We collect and process data necessary to operate, secure, and monitor the services. This includes:
+
+- IP addresses and network metadata
+- Device and client information
+- Account and identity data (usernames, emails where applicable)
+- Playback and media activity history
+- Request activity and history
+- Access and security logs
+- Enforcement records (bans, suspensions, violations)
+
+Data may be used for service operation, performance monitoring, abuse prevention, security analysis, and enforcement of these terms. Full details on data collection, retention, sharing, and your rights are in our Privacy Policy.
+
+Security monitoring is active on all services. Automated systems may log, classify, rate-limit, or block traffic that is deemed suspicious or abusive. You consent to this monitoring as a condition of using the services.
+
+## 6. VPN / Datacenter / Proxy Policy
+
+The use of VPN services, proxies, Tor, or datacenter IP addresses to access any service is prohibited unless explicitly approved by management.
+
+This policy exists because:
+- VPN and proxy networks are frequently used to bypass access rules and restrictions
+- Shared IP pools make it difficult to distinguish legitimate users from attackers and abusers
+- These networks generate disproportionate spam, scanning, and malicious traffic
+- They undermine our ability to ensure a safe and reliable experience for real users
+
+Management may grant exceptions on a case-by-case basis. Violating this policy may result in immediate access restriction, ban, or termination without warning.
+
+## 7. AI & Automated Systems
+
+Your data may be processed by AI and automated systems as part of service operation, security monitoring, and improvement. This includes:
+
+- **Local AI** — Internal systems may process service data for security analysis, abuse detection, and operational tasks.
+- **Cloud AI** — Data may be processed by cloud-based AI providers for inference and analysis. Our current cloud provider (Ollama) operates under a zero-log-retention and zero-training policy, meaning your data is not stored or used for training by the provider.
+
+**AI Training:**
+
+Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are:
+
+- **Internal-only** — never sold, published, or shared with third parties
+- **Access-controlled** — accessible only by Majjo and authorized management members (currently none exist)
+- **Not user-facing** — models are used for administration and security, not exposed to users
+
+Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training, regardless of consent.
+
+## 8. Service Availability
+
+These services are privately operated and provided on a best-effort basis. We do not guarantee any level of uptime, availability, or performance.
+
+- Services may be changed, paused, degraded, or discontinued at any time without prior notice
+- Data loss may occur due to hardware failure, software issues, or other events
+- Users should maintain their own backups of any data stored on these services
+- Management is not liable for any loss or damage resulting from service interruption or data loss
+
+## 9. Enforcement & Termination
+
+Management reserves the right to suspend, restrict, or terminate access at any time for violations of these terms or for any other valid reason, including but not limited to:
+
+- Violating any term of this agreement
+- Sharing or compromising credentials
+- Activities that threaten the security or integrity of the services
+- Using VPN, proxy, Tor, or datacenter IP addresses when prohibited
+- Abuse, harassment, or disruption of other users or services
+
+Access may be restricted immediately and without warning where the safety or integrity of the services is at risk.
+
+## 10. Account Deletion & Data Removal
+
+You may request deletion of your data by contacting management and verifying your identity. Upon verification, deletion will be scheduled and may take up to 30 days.
+
+Some data cannot be deleted, including:
+- Security records, ban records, and blacklists retained to prevent evasion
+- Enforcement data required to maintain the integrity of the services
+- Data within rotated backups that may persist until the retention window expires
+
+Requesting deletion of data required for security or enforcement purposes may result in loss of access or blacklisting, as that data is necessary to operate the services safely.
+
+## 11. Age Requirement
+
+Users must be at least 13 years of age to use these services. Some content available through the services may not be suitable for all ages. Parental controls and content restrictions are available through Plex. Users are responsible for ensuring that their access to content complies with the laws of their jurisdiction.
+
+## 12. Changes to These Terms
+
+We reserve the right to update these Terms of Service periodically. When changes are made:
+
+- Users will be notified by email and via our Discord server's announcement channel
+- Continued use of the services after notification constitutes acceptance of the updated terms
+- The updated terms take effect immediately upon publication
+
+## 13. Governing Law
+
+These terms are governed by the laws of Sweden and the European Union. Any disputes arising from the use of these services shall be resolved in accordance with Swedish law.
+
+## 14. Severability
+
+If any provision of these Terms of Service is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.
+
+---
+
+**Contact**
+
+For questions, concerns, or requests regarding these terms:
+
+- Discord: `@majjoduran`
+- Email: `support@majjoduran.xyz`