docs: update privacy policy, add terms of service

docs/content/.vuepress/components/PluralKitBanner.vue

@@ -0,0 +1,55 @@
+<template>
+  <aside class="pkBanner" v-if="shouldShowBanner">
+    <div class="pkBannerText" v-html="bannerContent"></div>
+  </aside>
+</template>
+
+<script>
+  export default {
+    name: 'PluralKitBanner',
+    computed: {
+      shouldShowBanner() {
+        return typeof this.$site.themeConfig.pkBannerContent === "string"
+      },
+      bannerContent() {
+        return this.$site.themeConfig.pkBannerContent
+      },
+    },
+    beforeMount() {
+      if (this.shouldShowBanner) {
+        document.getElementsByTagName('html')[0].classList.add("pkBannerVisible")
+      }
+    },
+  }
+</script>
+
+<style lang="stylus">
+  html.pkBannerVisible .theme-container
+    position relative
+    margin-top 3rem
+
+    .navbar
+      top 3rem
+
+  .pkBanner
+    position fixed
+    top 0
+    left 0
+    right 0
+    height 3rem
+    background var(--bgColor)
+
+    .pkBannerText
+      padding 0.5rem 1rem
+      min-width 100%
+      height 3rem
+
+      background var(--warningBgColor)
+      color var(--textColor)
+
+      line-height 2rem
+      overflow auto hidden
+      white-space nowrap
+      word-break keep-all
+      text-align center
+</style>

docs/content/.vuepress/config.js

@@ -43,6 +43,7 @@ module.exports = {
           "/user-guide",
           "/command-list",
           "/privacy-policy",
+          "/terms-of-service",
           "/faq",
           "/tips-and-tricks"
         ]
@@ -71,11 +72,16 @@ module.exports = {
         ]
       },
       ["https://discord.gg/PczBt78", "Join the support server"],
-    ]
+    ],
+    pkBannerContent: "PluralKit's new <a href=\"/terms-of-service/\">Terms of Service</a> and <a href=\"/privacy/\">Privacy Policy</a> will go into effect on November 11th, 2024.",
   },
 
   plugins: [
     '@vuepress/plugin-back-to-top',
     ["vuepress-plugin-clean-urls", { normalSuffix: "/" }],
   ],
+
+  globalUIComponents: [
+    'PluralKitBanner'
+  ]
 }

docs/content/privacy-policy.md

@@ -1,32 +1,51 @@
 ---
 title: Privacy Policy
-description: I'm not a lawyer. I don't want to write a 50 page document no one wants to (or can) read. It's short, I promise.
+description: This page outlines PluralKit’s privacy policy - how PluralKit collects and uses your data - in plain language.
 permalink: /privacy
 ---
 
 # Privacy Policy
 
-I'm not a lawyer. I don't want to write a 50 page document no one wants to (or can) read. In short:
+This page outlines PluralKit’s privacy policy - **how PluralKit collects and uses your data** - in plain language.
+I'm not a lawyer, and having a 50-page document here filled with legal jargon means no one will read it - so we're keeping things as simple as we can.
 
-This is the data PluralKit collects indefinitely:
+This version of the policy is effective from November 11th, 2024. Previous versions of this policy [can be viewed on GitHub](<https://github.com/PluralKit/PluralKit/commits/main/docs/content/privacy-policy.md>).
-* Information *you give the bot* (eg. system/member profiles, switch history, linked accounts, etc)
-* Metadata about proxied messages (sender account ID, sender system/member, timestamp)
-* Aggregate anonymous usage metrics (eg. gateway events received/second, messages proxied/second, commands executed/second)
-  * This is visible on [https://stats.pluralkit.me/](https://stats.pluralkit.me/)
-* Nightly database backups of the above information
-* High-level logs of actions taken on the bot (eg. systems created or deleted, switches logged, etc)
 
-This is the data PluralKit does *not* collect:
+If you have any questions or concerns regarding this policy, please join [the support server](<https://discord.gg/PczBt78>) (preferred), or email [legal@pluralkit.me](mailto:legal@pluralkit.me).
-* Anything not listed above, including...
-* Proxied message *contents* (they are fetched on-demand from the original message object when queried)
-* Metadata about deleted messages, members, switches or systems
-* Information added *and deleted* between nightly backups
-* Information about messages that *aren't* proxied through PluralKit
 
-System and member information (names, member lists, descriptions, etc) are public by default, and can be looked up by anyone given a system/member ID or an account ID. This can be changed using the [privacy settings](/guide#privacy). 
+## Data provided by you
 
-You can export your system information using the `pk;export` command. This does not include message metadata (as the file would be huge). If you wish to request a copy of the message metadata PluralKit has stored for your Discord account, ask a developer [in the support server](https://discord.gg/PczBt78).
+Any information **explicitly provided by you** (eg. system/member profiles, switch history, linked accounts, etc) is collected indefinitely, and deleted immediately when you choose to remove it.
 
-You can delete your information using `pk;system delete`. This will delete all system information and associated members, switches, and messages. This will not delete your information from the database backups. Contact me if you want that wiped, too.
+For technical reasons, there may be a short delay before images (avatars and banners) uploaded to the PluralKit CDN are fully removed.
 
-The bot is [open-source](https://github.com/PluralKit/PluralKit). While I can't *prove* this is the code that's running on the production server... it is, promise.
+System and member information (names, member lists, descriptions, etc) is **public by default**, and can be looked up by anyone given a system/member ID or an account ID. This can be changed using [the privacy settings](/guide/#privacy).
+
+You can export your system information using the `pk;export` command. This does not include message metadata (as the file would be huge). If you wish to request a copy of the message metadata PluralKit has stored for your Discord account, ask a developer in the support server.
+
+You can delete your information using `pk;system delete`. This will delete all system information, including any associated members, groups, and other information. This will not delete message metadata, which is required for moderation purposes - see below for details.
+
+## Data required for moderation
+
+PluralKit stores **metadata for all proxied messages**, to allow for moderation. This includes:
+
+- Message link
+- ID of original message
+- ID of Discord account from which the message was sent
+- ID of PluralKit member associated with the message
+
+Metadata, by definition, does not include the content of messages proxied with the bot. PluralKit discards the content of proxied messages (and any attachments to proxied messages) after the message has been proxied.
+
+This data is stored indefinitely, and deleted when the proxied message is deleted.
+
+## Other
+
+PluralKit stores other miscellaneous data, to aid in fixing any issues that may occur, and to help us know how many people are using the service. This includes:
+
+- Aggregate **anonymous** usage metrics (eg. gateway events received/second, messages proxied/second, commands executed/second)
+- High-level logs of actions taken on the bot (eg. systems created or deleted, switches logged, etc)
+- High-level logs of requests to the API
+
+PluralKit **does not collect** any data other than the above.
+Any data collected by PluralKit is accessed only when **explicitly requested** by a user, or by the staff team for **abuse handling and moderation purposes**.
+No data is shared with third parties by the staff team except when **required by law**.

docs/content/terms-of-service.md

@@ -0,0 +1,53 @@
+---
+title: Terms of Service
+description: This page outlines PluralKit's Terms of Service - the rules you have to follow to use PluralKit - in plain language.
+permalink: /terms-of-service
+---
+
+# Terms of Service
+
+This page outlines PluralKit's Terms of Service - **the rules you have to follow to use PluralKit** - in plain language. I'm not a lawyer, and having a 50-page document here filled with legal jargon means no one will read it - so we're keeping things as simple as we can.
+
+By using PluralKit, you agree to these terms, whether you've read them or not. Please also read our [Privacy Policy](/privacy), which talks about what data PluralKit does and does not collect.
+
+This version of the policy is effective from November 11th, 2024. Previous versions of this policy [can be viewed on GitHub](<https://github.com/PluralKit/PluralKit/commits/main/docs/content/terms-of-service.md>).
+
+If you have any questions or concerns regarding this policy, please join [the support server](<https://discord.gg/PczBt78>) (preferred), or email [legal@pluralkit.me](mailto:legal@pluralkit.me).
+
+## You must abide by the Discord Terms of Service, and the Discord Community Guidelines
+
+This includes, but is not limited to:
+
+- You must meet [the minimum age requirement to use Discord](<https://support.discord.com/hc/en-us/articles/360040724612-Why-is-Discord-asking-for-my-birthday>) (which is 13 years of age in most, but not all, countries)
+- Any and all forms of bullying; harassment; and/or making threats towards any person (or group of people), are prohibited
+    - This includes, but is not limited to, using PluralKit to evade blocks
+    - We recommend reading [Discord's Bullying, Harassment, and Threats Policy Explainer](<https://discord.com/safety/bullying-harassment-threats-policy-explainer>) for clarification
+- Any and all forms of hate speech, ([as defined by Discord](<https://discord.com/safety/hateful-conduct-policy-explainer>)), are prohibited
+- Impersonation of any person; group of people; or organisation, where the impersonation is deliberately deceptive or harmful, is prohibited
+    - This includes, but is not limited to, using PluralKit to impersonate staff members of servers you're in; or using PluralKit to impersonate a Discord bot in a given server
+
+## You must not use PluralKit for hosting sexually explicit content
+
+Sexually explicit content is strictly forbidden on Discord in any spaces that are not age-restricted. As all data in PluralKit is publicly visible by default, this means you must not have any sexually explicit content associated with public PluralKit systems, members, or groups.
+
+Using sexually explicit images as *server-specific* avatars; or having sexually explicit text in *server-specific* member display names, is permitted *only if the server in question is entirely age-restricted*. We do not allow sexually explicit images to be uploaded to the PluralKit CDN in any form - if you wish to use a sexually explicit image as a server-specific avatar, you must use an alternate image hosting provider for that content.
+
+We recommend reading [Discord's Sexual Content Policy Explainer](<https://discord.com/safety/sexual-content-policy-explainer>) in addition to these terms.
+
+## You are responsible for the the security of your PluralKit system
+
+All Discord accounts that are linked to your PluralKit system; and anyone with the token for your PluralKit system, can modify (or delete) any and all data associated with your PluralKit system.
+
+If you suffer any data loss as a result of linking a Discord account not owned by you to your system, or sharing your PluralKit system token with anyone, we can not be held responsible for that data loss.
+
+## Actions we can take if you break these terms
+
+If you violate these terms, any action we may take is at our discretion.
+
+We will, generally, do the least restrictive thing needed to resolve any issues that may arise. For example, if you set sexually explicit images as your public member avatars, we may delete those images, and replace the image links of the members in question with an image containing a link to these terms (or the Discord Sexual Content Policy Explainer).
+
+## How to report violations of these terms
+
+If a PluralKit user is violating these terms *in the content of their proxied messages*, please report the messages to Discord directly with the in-app Report Message function - found in the right-click menu on a message on desktop; and in the press-and-hold menu on mobile. PluralKit staff can not take action on the content of a proxied message, as we do not store message content (as detailed in our [Privacy Policy](/privacy/)).
+
+If a PluralKit user is violating these terms in ways other than message content, please contact us in [the support server](<https://discord.gg/PczBt78>), or email [abuse@pluralkit.me](mailto:abuse@pluralkit.me). Please include all relevant information (including PluralKit system/member/group IDs; Discord account usernames/IDs; etc.), so that we can investigate.