From a8d738dccc2af699d30ab8e1a0b5d3c2e1f17a15 Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Tue, 29 Sep 2026 20:52:51 -0500 Subject: [PATCH] seamark: add Seamark's own privacy policy, terms of service and security.txt The generic legal pages predate the scanner, billing, webhooks, the labeler and the image advisor, and several of their statements never matched the code (log retention, export contents, hold-side deletion). Seamark's pages now live as theme overrides that describe this deployment: Seamark Registry LLC, its domains and hold, providers, retention, the honest deletion story (backfill re-indexing, hold history), paid plans, the scan and AI disclaimers, the registered DMCA agent, and Texas arbitration with an opt-out. "Last updated" is set by hand in the page. /.well-known/security.txt is served from the theme's public tree (embedded with all:public so the dot-directory ships). A test renders both pages, pins the DMCA agent block, rejects em dashes, and fails once security.txt's Expires date lapses. Co-Authored-By: Claude Fable 5.1 --- pkg/appview/server.go | 9 + themes/seamark/embed.go | 4 +- themes/seamark/legal_test.go | 130 +++++++++ .../seamark/public/.well-known/security.txt | 6 + themes/seamark/templates/pages/privacy.html | 212 ++++++++++++++ themes/seamark/templates/pages/terms.html | 272 ++++++++++++++++++ 6 files changed, 632 insertions(+), 1 deletion(-) create mode 100644 themes/seamark/legal_test.go create mode 100644 themes/seamark/public/.well-known/security.txt create mode 100644 themes/seamark/templates/pages/privacy.html create mode 100644 themes/seamark/templates/pages/terms.html diff --git a/pkg/appview/server.go b/pkg/appview/server.go index 90422ab..390bfe6 100644 --- a/pkg/appview/server.go +++ b/pkg/appview/server.go @@ -739,6 +739,15 @@ func NewAppViewServer(cfg *Config, branding *BrandingOverrides) (*AppViewServer, // Appview DID document endpoint (service identity for key discovery) mainRouter.Get("/.well-known/did.json", s.handleDIDDocument) + // RFC 9116 security contact, served from public/.well-known/security.txt + // when the theme ships one (404 otherwise). Not behind the year-long static + // cache: the file carries an Expires date the operator bumps. + securityTxt := PublicHandler(branding) + mainRouter.Get("/.well-known/security.txt", func(w http.ResponseWriter, r *http.Request) { + r.URL.Path = "/.well-known/security.txt" + securityTxt.ServeHTTP(w, r) + }) + s.Router = mainRouter return s, nil diff --git a/themes/seamark/embed.go b/themes/seamark/embed.go index 4114cf3..4ac24f6 100644 --- a/themes/seamark/embed.go +++ b/themes/seamark/embed.go @@ -10,7 +10,9 @@ import ( "atcr.io/pkg/appview" ) -//go:embed public +// all: so dot-directories ship too (public/.well-known/security.txt). +// +//go:embed all:public var publicFS embed.FS //go:embed templates diff --git a/themes/seamark/legal_test.go b/themes/seamark/legal_test.go new file mode 100644 index 0000000..28d237b --- /dev/null +++ b/themes/seamark/legal_test.go @@ -0,0 +1,130 @@ +package seamark + +import ( + "bytes" + "io/fs" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "atcr.io/pkg/appview" + "atcr.io/pkg/appview/handlers" +) + +// TestLegalPagesRender renders Seamark's privacy and terms overrides through +// the same template set the appview serves, so a template error in either page +// fails here instead of on the live site. +func TestLegalPagesRender(t *testing.T) { + tmpl, err := appview.Templates(branding()) + if err != nil { + t.Fatalf("Templates(branding()) error = %v", err) + } + + pageData := handlers.PageData{ + SiteURL: "seamark.dev", + RegistryURL: "seamark.cr", + ClientName: "Seamark", + ClientShortName: "Seamark", + } + + tests := []struct { + name string + want []string + }{ + { + name: "privacy", + want: []string{ + "Seamark Registry LLC", + "5900 Balcones Dr, Ste 100", + "privacy@seamark.dev", + "us-chi1.cove.seamark.dev", + "up to 90 days", + }, + }, + { + name: "terms", + want: []string{ + "Seamark Registry LLC", + // The DMCA agent block must match registration DMCA-1072207. + "Evan Jarrett, Designated Agent", + "Phone: (805) 440-7813", + "dmca@seamark.dev", + "Travis County, Texas", + "MIT License", + "abuse@seamark.dev", + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + data := handlers.LegalPageData{ + PageData: pageData, + Meta: handlers.NewPageMeta(tt.name, tt.name), + } + var buf bytes.Buffer + if err := tmpl.ExecuteTemplate(&buf, tt.name, data); err != nil { + t.Fatalf("ExecuteTemplate(%q) error = %v", tt.name, err) + } + out := buf.String() + for _, s := range tt.want { + if !strings.Contains(out, s) { + t.Errorf("%s page missing %q", tt.name, s) + } + } + + // User-facing copy uses no em dashes. + start, end := strings.Index(out, "") + if start < 0 || end < start { + t.Fatalf("%s page has no
element", tt.name) + } + if strings.Contains(out[start:end], "—") { + t.Errorf("%s page body contains an em dash", tt.name) + } + }) + } +} + +// TestSecurityTxt checks the RFC 9116 file the theme ships at +// /.well-known/security.txt. It fails once the file's Expires date has passed, +// which is the reminder to bump it. +func TestSecurityTxt(t *testing.T) { + data, err := fs.ReadFile(branding().PublicFS, "public/.well-known/security.txt") + if err != nil { + t.Fatalf("security.txt not embedded: %v", err) + } + body := string(data) + if !strings.Contains(body, "Contact: mailto:security@seamark.dev") { + t.Error("security.txt lacks the Contact line") + } + + var expires time.Time + for _, line := range strings.Split(body, "\n") { + if v, ok := strings.CutPrefix(line, "Expires: "); ok { + expires, err = time.Parse(time.RFC3339, strings.TrimSpace(v)) + if err != nil { + t.Fatalf("security.txt Expires is not RFC 3339: %v", err) + } + } + } + if expires.IsZero() { + t.Fatal("security.txt lacks an Expires line") + } + if !expires.After(time.Now()) { + t.Errorf("security.txt expired on %s; bump the Expires line", expires.Format(time.DateOnly)) + } + + // The appview serves it through PublicHandler with the request path + // rewritten to the file, the same way server.go routes it. + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/.well-known/security.txt", nil) + appview.PublicHandler(branding()).ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("GET /.well-known/security.txt = %d, want 200", rec.Code) + } + if rec.Body.String() != body { + t.Error("served security.txt differs from the embedded file") + } +} diff --git a/themes/seamark/public/.well-known/security.txt b/themes/seamark/public/.well-known/security.txt new file mode 100644 index 0000000..b50529e --- /dev/null +++ b/themes/seamark/public/.well-known/security.txt @@ -0,0 +1,6 @@ +# Security contact for seamark.dev and the Seamark registry domains (RFC 9116). +# Bump Expires before it lapses; themes/seamark/legal_test.go fails once it does. +Contact: mailto:security@seamark.dev +Expires: 2027-09-29T00:00:00.000Z +Preferred-Languages: en +Canonical: https://seamark.dev/.well-known/security.txt diff --git a/themes/seamark/templates/pages/privacy.html b/themes/seamark/templates/pages/privacy.html new file mode 100644 index 0000000..102d0e3 --- /dev/null +++ b/themes/seamark/templates/pages/privacy.html @@ -0,0 +1,212 @@ +{{/* Seamark's own privacy policy. It overrides the generic default in + pkg/appview/templates/pages/privacy.html and describes this deployment + specifically: its operator, domains, hold, providers and retention. + "Last updated" is set by hand below; the Makefile's git-date stamp only + tracks the default template. */}} +{{ define "privacy" }} + + + + {{ template "head" . }} + {{ template "meta" .Meta }} + + + {{ template "nav" . }} + +
+

Privacy Policy

+

Seamark Registry LLC · Last updated September 29, 2026

+ +
+

This policy explains what Seamark Registry LLC ("Seamark", "we", "us") collects when you use seamark.dev, our registry domains (seamark.cr, buoy.cr, bouy.cr and atcr.io), the storage holds we operate, and the Seamark credential helper (together, the "Service"), and what we do with it.

+ +
+

The short version

+
    +
  • Seamark is built on the AT Protocol. Your image manifests, tags, stars and repository pages are records in your own repository on your PDS, and they are public.
    • +
  • Images you push are not private. Anyone who signs in can pull images from our holds, and our holds publish records about them (layer lists, usage counts, vulnerability scans and image configuration) that anyone can read.
    • +
  • We keep what we need to run the Service: your sign-in sessions, the devices you approve, a copy of public records for search and display, and server logs for up to 90 days.
    • +
  • We only get your email address if you subscribe (Stripe collects it) or email us. We never store your password, and we don't run ads or analytics or sell your data.
    • +
  • You can export your data and delete your Seamark data from Settings.
    • +
+
+ +
+

1. Who we are

+

Seamark Registry LLC, 5900 Balcones Dr, Ste 100, Austin, TX 78731, United States, is responsible for the personal data described in this policy (the "controller" under EU and UK data protection law). You can reach us at privacy@seamark.dev.

+
+ +
+

2. Where your data lives

+

Seamark keeps data in three kinds of places:

+
    +
  • Your PDS. Your AT Protocol account lives on a Personal Data Server (PDS) run by you or a provider you chose. When you use Seamark, we write records under the io.atcr.* namespace to your repository there: image manifests, tags, your Seamark settings, stars and repository pages. Anyone can read them, and your PDS provider's policies govern how they are stored. We can change them only while you allow Seamark access to your account.
    • +
  • Our AppView. seamark.dev and the registry domains run on our servers. They keep a copy of public records for search and display, plus the account data described below.
    • +
  • Holds. A hold is a storage server for image layers. We operate the hold at us-chi1.cove.seamark.dev. You can instead choose a hold run by someone else, including one you run yourself. That hold's operator is responsible for the data it stores, and this policy doesn't cover it.
    • +
+
+ +
+

3. What we collect and why

+ +

3.1 Public records we index

+

We index public io.atcr.* records from every AT Protocol account that publishes them, whether or not the account has signed in to Seamark, along with the handle and avatar from the account's public profile. We use them for search, repository pages and routing pulls. Our copy follows your PDS through the network's event stream: when you delete a record there, we delete our copy. We also re-read public records once a day, so records that remain on your PDS reappear on Seamark even after you delete your Seamark data (see section 8).

+ +

3.2 Your account

+

Your DID, handle, PDS address, default hold, Seamark preferences (such as automatic removal of untagged images and your preferred registry domain), and when you last signed in or pushed. We use this to run your account and keep it until you delete your Seamark data.

+ +

3.3 Signing in

+
    +
  • Website and OAuth. When you sign in, your PDS gives us OAuth tokens that let us act for you within the permissions you approved: writing io.atcr.* records to your repository, uploading image manifests, and getting short-lived tokens to access holds for you. We never see your account password. A cookie keeps your browser signed in until you sign out or the session expires. The OAuth session itself stays available to your other browsers and devices until 30 days after it was last used, or until you delete your Seamark data.
    • +
  • Credential helper. When you approve the Seamark credential helper, we store the device name, the IP address and software version (user agent) it connected from, and when it was created and last used, so you can recognize and revoke it in Settings. We keep this until you revoke the device. The helper stores its own token on your computer.
    • +
  • App passwords. If you run docker login with an app password instead of using the credential helper, we pass it to your PDS to create a session. We don't store the password, and the session is kept in memory for up to 2 hours.
    • +
+ +

3.4 Webhooks

+

If you create a webhook, we store its URL, secret and triggers, and send event details (such as the repository, tag, digest, pusher, vulnerability counts or storage usage) to that URL. We keep the webhook until you delete it or your Seamark data.

+ +

3.5 Our holds

+

Image data. Image layers and configuration are stored in object storage by content digest. Identical layers pushed by different people are stored once and shared. We keep image data while any image uses it, and our nightly cleanup removes data that no image uses, normally within 30 days.

+

Hold records. Each hold is also an AT Protocol account with its own public repository. Our holds record:

+
    +
  • your membership: your DID, permissions, plan tier and founding-member status;
    • +
  • each layer you push: its digest, size and type, the image it belongs to, and your DID;
    • +
  • pull and push counts for each of your repositories, including daily counts;
    • +
  • vulnerability scan results for your images, including a software bill of materials (SBOM);
    • +
  • each image's configuration, which includes its environment variables, labels, entrypoint and build history.
    • +
+

Anyone can read these records, whatever a hold's access settings, and the hold announces them to public relays on the AT Protocol network, so copies can exist beyond our servers. Access settings such as invite-only registration control who can push to a hold; they don't make its data private. We use hold records to store and serve images, apply quotas, and show usage and security information.

+ +

3.6 Vulnerability scanning

+

Our scanner, which runs on our own server, reads your image layers to produce an SBOM and a vulnerability report after you push and again periodically. It receives the repository, tag, your DID and your handle. The results are published as hold records (section 3.5).

+ +

3.7 Subscriptions

+

If you subscribe to a paid plan, Stripe processes the payment and collects your email address, payment details and billing address under its own privacy policy. We never receive your full card number. We create your Stripe customer record with your handle and DID, and we can see your email and billing details in Stripe to manage your subscription and send you notices about it. We keep a record of the Stripe events we have processed, and billing records for as long as tax and accounting law requires. Your plan tier is part of your public membership record (section 3.5).

+ +

3.8 AI image advisor

+

When you use the AI image advisor on one of your images, information about that image, such as its name, manifest, configuration, layers, SBOM and vulnerability scan results, may be sent to Anthropic to generate suggestions. We store the suggestions for that image so they can be shown again without another request. The advisor runs only when you ask it to, it's available on some plans, and you can turn it off in Settings.

+ +

3.9 Logs

+

Our servers log each request with its IP address, the URL requested, the time and the response status. Application logs can also include your DID and handle, and which images signed-in users pull. Logs stay on our servers, only we can read them, and we keep them for up to 90 days. We use them to operate, secure and debug the Service.

+ +

3.10 Moderation

+

When we act on a legal complaint or a violation of our Terms of Service, our labeler publishes a takedown label for the account or repository. Labels are public. We keep takedown records for as long as they apply.

+
+ +
+

4. Cookies and browser storage

+

We use these cookies:

+
    +
  • atcr_session keeps you signed in.
    • +
  • oauth_return_to remembers where to send you after you sign in.
    • +
  • atcr_login_handle remembers the handle you signed in with, so the sign-in form can suggest it next time.
    • +
+

The site also uses your browser's local storage for recent handles, cached profile names and display preferences. We don't use advertising, analytics or other tracking cookies. Because we don't track you across sites, Do Not Track and Global Privacy Control signals don't change what we do.

+

Some pages load content from other services, which then receive your IP address: avatars and repository icons from imgs.blue; handle suggestions on the sign-in page from typeahead.waow.tech and public.api.bsky.app, which receive what you type in the handle field; and images that publishers embed in a README or repository icon, which can come from any site.

+
+ +
+

5. Who we share data with

+

Service providers that process data for us:

+
    +
  • UpCloud: servers, load balancing and object storage.
    • +
  • Bunny: content delivery for our registry domains, object storage and database hosting.
    • +
  • Fastmail: email.
    • +
  • Stripe: payments, for subscribers.
    • +
  • Anthropic: the AI image advisor, when you use it.
    • +
+

We also share data:

+
    +
  • with the AT Protocol network, where public records on your PDS and our holds are distributed by relays and can be read and copied by anyone;
    • +
  • with the hold operators you choose, and with the webhook URLs you configure;
    • +
  • when the law requires it, or to protect the rights and safety of Seamark, our users or others;
    • +
  • with a buyer or successor if Seamark Registry LLC is sold, merged or reorganized.
    • +
+

We don't sell your personal data or share it for advertising.

+
+ +
+

6. Legal bases (EEA and UK)

+
    +
  • Contract: running your account, storing and serving your images, sign-in, subscriptions, webhooks, and features you choose to use, such as the AI advisor.
    • +
  • Legitimate interests: indexing public AT Protocol records, including those of accounts that haven't signed in to Seamark; publishing vulnerability information; and keeping logs to secure and debug the Service.
    • +
  • Legal obligation: billing records and responding to lawful requests.
    • +
+
+ +
+

7. How long we keep data

+ + + + + + + + + + + + + + + + + + + + +
DataKept
Indexed public recordsWhile they exist on your PDS
Account data, scan summaries and advisor suggestionsUntil you delete your Seamark data
OAuth sessions30 days after last use, or until you delete your Seamark data
Website sessionUntil you sign out or it expires
Credential helper devicesUntil you revoke them
App password sessionsUp to 2 hours, in memory
WebhooksUntil you delete them or your Seamark data
Image data on our holdsWhile any image uses it, then normally removed within 30 days
Hold recordsSee section 8
Server logsUp to 90 days
Billing recordsAs long as tax and accounting law requires
+
+ +
+

8. Exporting and deleting your data

+

Export. Settings › Export All My Data downloads a file with your devices, sign-in sessions (not the tokens), hold memberships, webhooks (without their secrets), vulnerability scan summaries, advisor suggestions, and the records our holds keep about you (membership, layers and usage counts). Your public records are in your repository on your PDS, where any AT Protocol tool can export them. For anything else, email privacy@seamark.dev.

+

Delete. Settings › Delete My Seamark Data does the following:

+
    +
  • On Seamark: deletes your account data, sessions, devices, webhooks, scan summaries, advisor suggestions and our copy of your public records.
    • +
  • On your PDS: if you tick "Also delete all io.atcr.* records from my ATProto PDS", we delete them too. If you don't, they stay public on your PDS, and our daily re-indexing adds your repositories back to Seamark. Delete them from your PDS to keep them off Seamark.
    • +
  • On our holds: we delete your membership, layer and usage records. Image data that no other image uses is removed by our nightly cleanup, normally within 30 days. Scan results, image configurations and daily usage counts stay on the hold (scan results and configurations are shared by everyone who pushed the same image). Records we delete remain in the hold's public history, which anyone can download, and relays may keep copies.
    • +
  • On other holds: we ask them to delete your data, but we can't guarantee they do.
    • +
  • Elsewhere: others on the AT Protocol network may have copied public records.
    • +
+

We keep billing records as the law requires, and Stripe keeps its records under its own policy. Deleting your Seamark data doesn't delete your AT Protocol account.

+
+ +
+

9. Your rights

+

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. We give these rights to everyone, wherever they live. Use the tools in section 8 or email privacy@seamark.dev. We'll confirm a request comes from you by checking that you control the account (DID), and we'll respond within 30 days. If we decline a request, you can appeal by replying to our answer. If you're in the EEA or UK, you can also complain to your data protection authority.

+

We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you.

+
+ +
+

10. Children

+

Seamark isn't intended for children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has used Seamark, email privacy@seamark.dev and we'll delete their data.

+
+ +
+

11. International transfers

+

We're based in the United States and our servers are in the United States. Some of our service providers process data in other countries. Public AT Protocol data is copied worldwide by design.

+
+ +
+

12. Security

+

We use HTTPS for all connections, store credential-helper secrets only as hashes, and never store passwords. Our OAuth access is limited to the permissions described in section 3.3. No system is perfectly secure, and we can't guarantee the security of your data.

+
+ +
+

13. Changes to this policy

+

We may update this policy. We'll post the new version here with a new date, and changes take effect when posted.

+
+ +
+

14. Contact

+

Seamark Registry LLC
5900 Balcones Dr, Ste 100
Austin, TX 78731
privacy@seamark.dev

+
+
+
+ + {{ template "footer" . }} + + +{{ end }} diff --git a/themes/seamark/templates/pages/terms.html b/themes/seamark/templates/pages/terms.html new file mode 100644 index 0000000..de943bf --- /dev/null +++ b/themes/seamark/templates/pages/terms.html @@ -0,0 +1,272 @@ +{{/* Seamark's own terms of service. It overrides the generic default in + pkg/appview/templates/pages/terms.html and describes this deployment + specifically. "Last updated" is set by hand below; the Makefile's git-date + stamp only tracks the default template. The DMCA agent block must match + registration DMCA-1072207 exactly (17 U.S.C. 512(c)(2)). */}} +{{ define "terms" }} + + + + {{ template "head" . }} + {{ template "meta" .Meta }} + + + {{ template "nav" . }} + +
+

Terms of Service

+

Seamark Registry LLC · Last updated September 29, 2026

+ +
+

These Terms are an agreement between you and Seamark Registry LLC ("Seamark", "we", "us"). They cover seamark.dev, our registry domains (seamark.cr, buoy.cr, bouy.cr and atcr.io), the storage holds we operate, the Seamark credential helper and related services (together, the "Service"). You accept these Terms by signing in, approving a device, subscribing, or otherwise using the Service. If you don't agree, don't use the Service.

+ +
+ Please read section 19. It requires most disputes to be resolved through individual arbitration and waives class actions. You can opt out within 30 days (section 19.6). +
+ +
+

1. The Service

+

Seamark is an OCI container registry built on the AT Protocol. Image manifests and tags are stored as records in your own AT Protocol repository on your Personal Data Server (PDS), and image layers are stored on holds. Our Privacy Policy explains how we handle personal data.

+

The software behind Seamark is open source under the MIT License, and nothing in these Terms limits your rights under it. The Seamark name and logo aren't covered by that license.

+
+ +
+

2. Eligibility

+

You must be at least 13 years old to use the Service, and if you're under 18, you need permission from a parent or guardian. You can't use the Service if you're barred from doing so under US law or the law where you live, including sanctions laws (section 21). If you use the Service for an organization, you confirm you're authorized to accept these Terms for it.

+
+ +
+

3. Your account

+

3.1 Your identity

+

You sign in with an AT Protocol account (DID), which we don't control. Your PDS provider's terms govern that account.

+ +

3.2 Security

+

Keep your PDS credentials, app passwords and credential-helper devices secure, and revoke devices you no longer use. Tell us promptly at legal@seamark.dev if you think your account has been compromised. You're responsible for activity that happens through your credentials, unless it results from our failure to secure the Service.

+
+ +
+

4. Your content

+

4.1 Ownership

+

You keep ownership of the images and other content you push ("your content").

+ +

4.2 License to us

+

You grant us a worldwide, non-exclusive, royalty-free license to host, store, copy, cache, scan, index, display and distribute your content, and to publish information about it (such as layer lists, scan results, SBOMs and image configuration), as needed to operate, secure and provide the Service. The license lasts while your content is on the Service and for any time needed to finish deleting it or to keep records the law requires.

+ +

4.3 Shared layers

+

The Service stores identical layers once and shares them between images. Deleting your images doesn't remove layers that other images use.

+ +

4.4 Your responsibility

+

You're responsible for your content and must have the rights needed to publish it, including complying with the licenses of the software inside your images.

+ +

4.5 Other people's images

+

Images published by other users are theirs. We don't review or endorse them, and you use them at your own risk. Report images that violate these Terms to abuse@seamark.dev.

+
+ +
+

5. Public by default

+

Images you push aren't private. Anyone who signs in can pull images from our holds, and a hold may allow pulls without signing in. Your manifests and tags on your PDS, and our hold records about your images (including layer lists, scan results, and image configuration with environment variables and build history), are public and are copied across the AT Protocol network. Hold access settings such as invite-only registration control who can push; they don't make data private.

+

Don't put secrets or personal information in images, environment variables, labels or build arguments. If you push a secret by mistake, treat it as exposed and rotate it. Deleting an image doesn't recall copies others have already pulled.

+
+ +
+

6. Acceptable use

+

You agree not to use the Service to:

+
    +
  • store or distribute malware, cryptocurrency-mining code, or anything designed to damage systems or access them without permission;
    • +
  • store or distribute content that's illegal, that infringes someone else's intellectual property, or that you don't have the right to distribute;
    • +
  • harass, threaten, spam or impersonate anyone, or misrepresent your affiliation with anyone;
    • +
  • get around quotas, rate limits, takedowns, suspensions or access controls, including by creating additional accounts;
    • +
  • interfere with, overload or disrupt the Service, or try to gain unauthorized access to it;
    • +
  • mainly store or distribute files that aren't container images or other OCI artifacts; or
    • +
  • break any applicable law, including export control and sanctions laws.
    • +
+

We decide whether conduct violates these Terms, and we may investigate suspected violations.

+
+ +
+

7. Usage limits

+

Storage quotas, bandwidth limits and request-rate limits may apply to your account or plan. Your current storage quota is shown in Settings, and other limits, where they apply, are listed in Settings or our documentation. We may set or change limits to protect the Service. If you're over a limit, pushes or pulls may be refused until you're back under it.

+
+ +
+

8. Paid plans

+

8.1 Billing and renewal

+

Paid plans are billed in advance, monthly or yearly as you choose at checkout, and renew automatically at the same price until you cancel. Payments are processed by Stripe. By subscribing, you authorize us, through Stripe, to charge your payment method at the start of each billing period.

+ +

8.2 Cancelling

+

You can cancel at any time from Settings. Cancellation takes effect at the end of your current billing period, and you keep paid features until then.

+ +

8.3 Price and plan changes

+

A subscription keeps its price and included features while it remains active. Changes to prices or plan features apply only to new subscriptions. If we retire a plan, we'll email subscribers at their billing email address before it ends, and they keep the plan through the end of their current billing period.

+ +

8.4 Refunds

+

Payments are non-refundable, except where the law requires otherwise or these Terms say so. If an outage on our side keeps you from using paid features for an extended period, contact us and we'll consider a refund or credit.

+ +

8.5 Taxes

+

Prices don't include taxes unless stated, and you're responsible for any taxes that apply.

+ +

8.6 Failed payments and disputes

+

If a payment fails, paid features may stop until it's resolved. Please contact us before disputing a charge with your bank. We may suspend accounts involved in fraudulent chargebacks.

+ +

8.7 Going over quota

+

If your plan ends or you move to a plan with a smaller quota, your existing images stay available, but new pushes may be refused until you're under the new quota.

+ +

8.8 Visibility

+

Your plan tier is part of your public membership record on our hold.

+
+ +
+

9. Vulnerability scans and the AI advisor

+

9.1 Scans

+

Vulnerability scans and SBOMs are generated automatically and can be incomplete or wrong. A scan that finds nothing doesn't mean an image is secure. Scan results are public, they're information rather than security advice, and you remain responsible for the security of your images.

+ +

9.2 AI advisor

+

The AI image advisor's suggestions come from an AI model and can be wrong or incomplete. Review them before relying on them. Using the advisor may send information about your image to Anthropic, as described in our Privacy Policy. It's available only on some plans.

+
+ +
+

10. Actions we take for you

+

Some features change your PDS on your behalf. Automatic removal of untagged images deletes manifest records from your PDS according to your settings, and deleting your Seamark data can also delete all of your io.atcr.* records if you choose. These deletions are permanent, and we can't undo them.

+
+ +
+

11. Your PDS and the AT Protocol network

+

We don't operate your PDS. We're not responsible for what your PDS provider does, including outages, data loss, or suspending or deleting your account (some providers may treat frequent pushes as unusual activity). Revoking Seamark's access to your account stops us from writing to your repository but doesn't delete records already there. The AT Protocol and PDS software change over time, and those changes can affect how the Service works.

+
+ +
+

12. Holds and third-party services

+

We operate our own holds. Other holds are run by their operators under their own terms. We don't control them, don't guarantee them, and can't delete data they store. We may stop routing images to or from a hold, for example if it's unreliable or hosts content that violates these Terms.

+

The Service also depends on services run by others, including PDS providers, AT Protocol relays, Stripe, Anthropic, and the code hosts that repository READMEs are loaded from. Their terms apply to your use of them, and we're not responsible for their availability, content or conduct.

+
+ +
+

13. Takedowns and copyright

+

13.1 Removing content

+

We may remove or disable access to content, and suspend or terminate accounts, that we believe violate these Terms or the law, with or without notice. A takedown hides the repository on Seamark and blocks pulls and pushes through our registry, and layers stored on our holds are deleted after a grace period. We can't delete records on your PDS or data on holds we don't operate.

+ +

13.2 Copyright complaints (DMCA)

+

We respond to notices of alleged copyright infringement under the Digital Millennium Copyright Act. Send notices to our designated agent:

+

Evan Jarrett, Designated Agent
Seamark Registry LLC
5900 Balcones Dr, Ste 100
Austin, TX 78731
Phone: (805) 440-7813
Email: dmca@seamark.dev

+

Your notice must include:

+
    +
  1. your physical or electronic signature;
    2. +
  2. the copyrighted work you believe is infringed;
    3. +
  3. the material you believe infringes it, with enough detail for us to find it: the image reference (for example seamark.cr/<handle>/<repository>:<tag> or @sha256:<digest>), the page URL, or the at:// URI of the manifest record;
    4. +
  4. your name, address, phone number and email;
    5. +
  5. a statement that you believe in good faith that the use is not authorized by the copyright owner, its agent or the law; and
    6. +
  6. a statement, under penalty of perjury, that your notice is accurate and that you are the copyright owner or authorized to act for the owner.
    7. +
+

When we receive a valid notice, we disable access to the material as described in section 13.1. If the material is stored on a hold we don't operate, we can still block access through our registry, and you should also send your notice to that hold's operator.

+ +

13.3 Counter-notices

+

If your material was removed by mistake or misidentification, you may send our agent a counter-notice that includes:

+
    +
  • your physical or electronic signature;
    • +
  • the material and where it appeared before it was removed;
    • +
  • a statement, under penalty of perjury, that you believe in good faith it was removed by mistake or misidentification;
    • +
  • your name, address and phone number; and
    • +
  • a statement that you consent to the jurisdiction of the federal district court for your address (or, if you're outside the United States, any judicial district where we can be found), and that you'll accept service of process from the person who sent the original notice.
    • +
+

We forward counter-notices to the person who sent the original notice. We restore the material in 10 to 14 business days unless that person tells us they have filed a lawsuit.

+ +

13.4 Repeat infringers

+

In appropriate circumstances, we terminate the accounts of users who repeatedly infringe.

+
+ +
+

14. Changes to and availability of the Service

+

We provide the Service on a best-effort basis, with no uptime commitment. We may change, suspend or discontinue any part of the Service at any time. If we discontinue a paid plan's features before the end of a period you've paid for, we'll refund the unused part of that period. Apart from that refund, we're not liable to you for changing, suspending or discontinuing the Service.

+
+ +
+

15. Termination

+

You can stop using the Service at any time and delete your data from Settings. We may suspend or terminate your access at our discretion, including for violating these Terms, for legal reasons, or to protect the Service or others. If we terminate a paid subscription for a reason other than your breach of these Terms, we'll refund the unused part of your current billing period.

+

When your access ends, we stop serving and indexing your content and may delete your data from our systems as described in our Privacy Policy. Records on your PDS remain there. Sections 4.2 (as needed to finish deletion), 4.3, 4.4, 5, 10, 11 and 16 through 22 continue to apply after termination.

+
+ +
+

16. Disclaimers

+

The Service is provided "as is" and "as available", without warranties of any kind, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Service will be uninterrupted, secure or error-free, that scan results or AI suggestions will be accurate, or that any data will be preserved. You are responsible for keeping your own copies of your images.

+
+ +
+

17. Limitation of liability

+

To the maximum extent permitted by law, Seamark and its members, employees and agents will not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, data or goodwill, arising from or relating to the Service or these Terms, even if we were told they were possible.

+

To the maximum extent permitted by law, our total liability for all claims arising from or relating to the Service or these Terms is limited to the greater of the amount you paid us in the 12 months before the event giving rise to the claim, or US$50.

+

Nothing in these Terms limits liability that can't be limited under applicable law, such as liability for fraud, gross negligence, willful misconduct, or death or personal injury caused by negligence.

+
+ +
+

18. Indemnity

+

You'll defend and indemnify Seamark and its members, employees and agents against third-party claims, and the resulting losses and reasonable legal fees, arising from your content, your breach of these Terms, or your violation of the law or of someone else's rights.

+
+ +
+

19. Disputes and arbitration

+

19.1 Informal resolution first

+

Before starting an arbitration or court case, the party with the claim will send the other a written description of the dispute (to us at legal@seamark.dev), and we'll both try to resolve it informally for 30 days.

+ +

19.2 Arbitration

+

If we can't resolve it, any dispute arising from or relating to these Terms or the Service will be resolved by binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules. The Federal Arbitration Act governs this section. The arbitration is seated in Travis County, Texas, and hearings can be held by video or phone, or in person in the county where you live. We'll pay the filing, administration and arbitrator fees that the AAA's consumer rules assign to businesses. The arbitrator's award is final and can be entered in any court with jurisdiction.

+ +

19.3 Exceptions

+

Either of us can bring an individual claim in small claims court, and either of us can ask a court for an injunction to stop infringement of intellectual property or unauthorized access to the Service.

+ +

19.4 No class actions

+

Claims can be brought only individually, not as a plaintiff or class member in any class, collective or representative proceeding, and the arbitrator can't consolidate claims or award relief to anyone other than the individual parties. If this paragraph is found unenforceable for a claim, that claim will be decided in court under section 20, and the rest of this section still applies.

+ +

19.5 Mass arbitration

+

If 25 or more similar arbitration demands are filed against us by or with the help of the same lawyers or organizations, the AAA's Mass Arbitration Supplementary Rules apply.

+ +

19.6 Opting out

+

You can opt out of this arbitration agreement by emailing legal@seamark.dev within 30 days after you first accept Terms that include it, with your handle or DID and a statement that you're opting out. Opting out doesn't affect the rest of these Terms.

+ +

19.7 Changes to this section

+

Changes to this section take effect 30 days after we post them and don't apply to any claim that arose before they take effect.

+ +

19.8 EU and UK residents

+

If you live in the EU or UK, this section doesn't apply to you, and you can bring claims in the courts where you live.

+
+ +
+

20. Governing law and courts

+

Texas law governs these Terms, without regard to its conflict-of-laws rules, and the Federal Arbitration Act governs section 19. Any claim that isn't arbitrated will be decided in the state or federal courts in Travis County, Texas, and you and we consent to their jurisdiction. This doesn't take away protections you have under the mandatory consumer laws of the place where you live.

+
+ +
+

21. Export control and sanctions

+

You may not use the Service if you're located in, or ordinarily resident in, a country or region subject to comprehensive US sanctions, or if you're on a US government restricted-party list. You're responsible for complying with export control and sanctions laws for the software you publish or pull, including encryption software.

+
+ +
+

22. General

+
    +
  • Entire agreement. These Terms and our Privacy Policy are the entire agreement between you and us about the Service.
    • +
  • Severability. If any provision is found unenforceable, it will be enforced to the maximum extent permitted, and the rest of these Terms remains in effect.
    • +
  • No waiver. Not enforcing a provision isn't a waiver of it.
    • +
  • Assignment. You can't transfer these Terms without our written consent. We can transfer them in connection with a merger, acquisition, reorganization or sale of assets.
    • +
  • Force majeure. We're not liable for delays or failures caused by events beyond our reasonable control, including outages of the AT Protocol network, PDS providers or our service providers.
    • +
  • Notices. We communicate by posting on the Service and, for subscribers, by email to the billing email address. You agree that these satisfy any requirement that communications be in writing.
    • +
  • Changes to these Terms. We may update these Terms by posting a new version with a new date. Changes take effect when posted, except as sections 8.3 and 19.7 provide. If you keep using the Service after a change, you accept the new Terms.
    • +
+
+ +
+

23. Contact

+

Seamark Registry LLC
5900 Balcones Dr, Ste 100
Austin, TX 78731

+ +
+
+
+ + {{ template "footer" . }} + + +{{ end }} -- knotmirror 0.0.1