diff --git a/build.ps1 b/build.ps1 index 1e42f8cc..2b94b16c 100644 --- a/build.ps1 +++ b/build.ps1 @@ -29,12 +29,25 @@ New-Item -ItemType Directory -Force -Path "_pdf" | Out-Null # Generate PDF (using PDF-specific config that includes pdf/** files) Write-Host "Generating PDF..." -ForegroundColor Green -dotnet docfx pdf docfx.pdf.json --output _pdf - -# Copy PDF to downloads folder and clean up -Write-Host "Copying PDF to downloads folder..." -ForegroundColor Green -New-Item -ItemType Directory -Force -Path "_site/downloads" | Out-Null -Copy-Item "_pdf/pdf/MonoGameGuide.pdf" "_site/downloads/" -Remove-Item -Path "_pdf" -Recurse -Force +try { + dotnet docfx pdf docfx.pdf.json --output _pdf + if ($LASTEXITCODE -ne 0) { + throw "docfx pdf exited with code $LASTEXITCODE" + } + + # Copy PDF to downloads folder + Write-Host "Copying PDF to downloads folder..." -ForegroundColor Green + New-Item -ItemType Directory -Force -Path "_site/downloads" | Out-Null + Copy-Item "_pdf/pdf/MonoGameGuide.pdf" "_site/downloads/" -ErrorAction Stop +} +catch { + Write-Warning "PDF generation failed: $_" + Write-Warning "Continuing without PDF - the site will be served/built without the downloadable guide." +} +finally { + if (Test-Path "_pdf") { + Remove-Item -Path "_pdf" -Recurse -Force -ErrorAction SilentlyContinue + } +} Write-Host "Build and documentation generation completed successfully!" -ForegroundColor Green \ No newline at end of file diff --git a/ci.docfx.json b/ci.docfx.json index 59a23291..adafb81c 100644 --- a/ci.docfx.json +++ b/ci.docfx.json @@ -38,6 +38,7 @@ "articles/**/*.md", "articles/**/*.yml", "foundation/**/*.md", + "policies/**/*.md", "roadmap/**/*.md", "roadmap/**/*.yml", "errors/**/*.md", diff --git a/docfx.json b/docfx.json index c7cc594c..c4254da0 100644 --- a/docfx.json +++ b/docfx.json @@ -39,6 +39,7 @@ "articles/**/*.md", "articles/**/*.yml", "foundation/**/*.md", + "policies/**/*.md", "roadmap/**/*.md", "roadmap/**/*.yml", "errors/**/*.md", diff --git a/docfx.pdf.json b/docfx.pdf.json index ba1ee6d5..197194e9 100644 --- a/docfx.pdf.json +++ b/docfx.pdf.json @@ -39,6 +39,7 @@ "articles/**/*.md", "articles/**/*.yml", "foundation/**/*.md", + "policies/**/*.md", "roadmap/**/*.md", "roadmap/**/*.yml", "errors/**/*.md", diff --git a/external/MonoGame b/external/MonoGame index 92a63602..9e50250f 160000 --- a/external/MonoGame +++ b/external/MonoGame @@ -1 +1 @@ -Subproject commit 92a63602a0c3371f252f048f23fdacf818455f97 +Subproject commit 9e50250f1867a97be1d845cb2c30fad3c1805ece diff --git a/policies/MonoGame-Foundation-Data-Incident-Response-Plan.md b/policies/MonoGame-Foundation-Data-Incident-Response-Plan.md new file mode 100644 index 00000000..00cd121b --- /dev/null +++ b/policies/MonoGame-Foundation-Data-Incident-Response-Plan.md @@ -0,0 +1,143 @@ +--- +title: Data Incident Response & Data Protection Operations Plan +layout: landing +_disableToc: true +_disableBreadcrumb: true +--- + +# Data Incident Response & Data Protection Operations Plan + +This plan gives the MonoGame Foundation, Inc. ("the Foundation") a documented, rehearsable procedure for (a) responding to data security incidents and breaches, including the notification duties under Texas Business & Commerce Code § 521.053 and GDPR Articles 33–34, and (b) handling day-to-day data protection operations: rights requests, privacy queries, retention and destruction, and vendor management. It is the internal counterpart to the public commitments in the Foundation's Privacy Policy. + +## Part A — Roles and Contacts + +| Role | Holder | Responsibilities | +|---|---|---| +| Incident Lead (Data Protection Officer-equivalent) | Foundation President | Owns this plan; declares incidents; decides notification; signs regulator filings | +| Technical Lead | Foundation Board Chairman | Containment, forensics, log preservation, recovery | +| Communications Lead | Foundation Corporate Secretary | User notices, transparency posts, press/community questions | +| Legal Counsel | Foundation Treasurer | Notification-duty analysis, regulator liaison | +| Board liaison | Foundation Corporate Secretary | Board notification, resource decisions | + +Standing mailboxes: **`privacy@monogame.net`** (rights requests and privacy queries), **`privacy@monogame.net`** (vulnerability and incident reports), **`admin@monogame.net`** (copyright notices). Each must route to at least two named people. + +Key external contacts to keep current in this section: Discourse/CDCK support and `privacy@discourse.org`; hosting provider abuse/security contact; payment processor security contacts; the Texas Attorney General breach reporting portal (`texasattorneygeneral.gov`); cyber-insurance carrier if/when obtained. + +## Part B — Incident Response Procedure + +### B.1 Definitions + +- **Security incident:** any event that compromises, or credibly threatens, the confidentiality, integrity, or availability of Foundation systems or data (compromised admin account, exploited vulnerability, lost backup, ransomware, processor breach notice). +- **Personal data breach (GDPR):** a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. +- **Breach of system security (Texas § 521.053(a)):** unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of *sensitive personal information* — broadly, a name combined with SSN, government ID number, or financial account/card numbers with access codes, or certain health data. Encrypted data counts if the key was also taken. + +A single event can be all three. The GDPR definition is the broadest; assess against it first. + +### B.2 Severity classification + +| Level | Definition | Examples | Activation | +|---|---|---|---| +| SEV-1 | Confirmed unauthorized acquisition of personal data, or full admin compromise | Database exfiltration; stolen admin credentials used; processor reports breach of our data | Full plan; all roles; notification analysis mandatory | +| SEV-2 | Suspected exposure or serious vulnerability under active exploitation | Credential stuffing spike; vulnerability disclosed with evidence of probing | Incident Lead + Technical Lead; 72-hour assessment | +| SEV-3 | Contained or low-risk event | Single account phished and recovered; vulnerability patched before exploitation | Technical Lead; log in incident register | + +### B.3 Response phases and the notification clocks + +**Phase 1 — Detect & contain (hour 0+).** Confirm the report; preserve logs and evidence *before* remediation where possible; contain (revoke sessions/keys, isolate systems, force password resets if credentials affected); open an incident record (timestamps matter — every legal clock runs from when the Foundation *determines* a breach occurred or *becomes aware* of it). + +**Phase 2 — Assess (within 72 hours of awareness).** Establish: what data, whose data, how many people, which jurisdictions (forum location data is unreliable; assume EU/UK members are affected unless shown otherwise), whether Texas "sensitive personal information" is involved, whether data was encrypted and keys safe, and the risk to individuals. Record the determination and its time. Engage counsel for any SEV-1. + +**Phase 3 — Notify.** The clocks, fastest first: + +| Audience | Trigger | Deadline | Method | +|---|---|---|---| +| EU/UK supervisory authority | Personal data breach with risk to individuals, GDPR applies | **72 hours** from awareness (document the reason for any delay) | Authority's online breach form | +| Affected individuals (GDPR) | High risk to rights and freedoms | **Without undue delay** | Email + transparency post | +| Texas Attorney General | Breach of system security involving **≥ 250 Texas residents** | **As soon as practicable, ≤ 30 days** from determination | **Electronic form on the AG website** (mandatory); include nature of breach, number of affected Texans, notices sent, measures taken and planned, law-enforcement status. Note: the AG publishes reported breaches publicly. | +| Affected individuals (Texas) | Unauthorized acquisition of their sensitive personal information | **Without unreasonable delay, ≤ 60 days** from determination (limited delay for law enforcement / scoping) | Written or email notice; substitute notice (site posting + statewide media) only if cost > $250,000, > 500,000 affected, or insufficient contact information is held (per the Texas AG's ITEPA guidance) | +| Other US states' residents | Per each state's breach statute | Varies — counsel to run a 50-state check for SEV-1 | Per statute | +| Consumer reporting agencies | **> 10,000 persons** notified at once | Without unreasonable delay | Equifax, Experian, TransUnion security contacts | +| Processors/vendors | Their systems implicated | Immediately | Direct contact (conversely: our processor contracts must require them to notify us without undue delay) | +| Community at large | Any SEV-1 affecting forum data | With individual notices | Pinned transparency post, updated as facts develop | + +Practical rule: **work to the 72-hour GDPR clock.** Anything fast enough for GDPR satisfies the Texas pace comfortably. + +**Phase 4 — Recover.** Eradicate the cause, restore from clean backups, rotate all secrets touched, re-enable services, monitor for recurrence. + +**Phase 5 — Review (within 30 days of closure).** Post-incident review covering root cause, what worked, clock compliance, and corrective actions with owners and dates; report to the Board; update this plan; retain the incident record for 3 years minimum. + +### B.4 Individual notice template (adapt per incident) + +> Subject: Important security notice about your MonoGame community account +> +> What happened: On [date] we determined that [description] between [dates]. +> What information was involved: [categories — e.g., email addresses, hashed passwords, IP addresses]. Payment card data was not involved; we never store it. +> What we have done: [containment, resets, patches, regulator notifications]. +> What you can do: [reset password; beware of phishing emails referencing this incident; if reused elsewhere, change it there]. +> What we will do next: [commitments]. Updates: [link to transparency post]. +> Contact: [privacy@monogame.net](mailto:privacy@monogame.net). We are sorry this happened. + +### B.5 Texas AG filing checklist (≥ 250 Texas residents) + +1. Detailed description of the breach or its use of sensitive personal information. +2. Measures taken regarding the breach. +3. Measures intended after notification. +4. Whether law enforcement is investigating. +5. File via the AG's electronic submission form; keep the receipt in the incident record. + +## Part C — Data Protection Operations + +### C.1 Rights request (DSAR) procedure + +1. **Intake:** all requests to `privacy@monogame.net`; log in the request register (date received, requester, type, deadline = one month). +2. **Verify identity:** confirmation email to the registered account address; for non-account requests, proportionate verification only — never ask for more data than needed. +3. **Execute:** + - *Access/export:* point the user to Discourse self-service export, or run admin export. + - *Correction:* user self-service, or admin edit. + - *Deletion/anonymization:* Discourse admin → user → Anonymize (severs identity from posts, erases profile/email/IP links). Review the user's posts for embedded personal data on request and redact case by case. Note: public post text may lawfully remain (freedom-of-expression carve-out, content license), and this is stated in the Privacy Policy. + - *Objection/restriction:* assess against legitimate interests; suspend the processing in question while assessing. +4. **Respond within one month**; one two-month extension is possible for complex requests — tell the requester within the first month with reasons. Refusals must cite the ground and mention complaint routes. +5. **Record** outcome and close the register entry. Target metric: 100% within deadline; review register quarterly. + +### C.2 Privacy query handling (non-rights questions) + +Community questions about data handling ("where is my data stored?", "do you sell data?", "what happens in a breach?") are answered from the Privacy Policy; if the policy doesn't answer it, that is a defect — answer the person, then file a policy amendment for the next review. Maintain a short public FAQ on the forum linking to the policy sections, including the breach commitments, so moderators can answer with a link. + +### C.3 Retention and destruction schedule + +Quarterly calendar task (Technical Lead): + +- Verify Discourse settings enforce the published log retention (server logs ≤ 90 days; user/post IP history ≤ 5 years). +- Purge expired backups beyond the backup retention window. +- Destroy correspondence past its retention (privacy/DMCA: 3 years post-resolution) — destruction means erasure or rendering unreadable, per Tex. Bus. & Com. Code § 521.052(b). +- Confirm donation records held only as financial record-keeping requires. +- Record completion in the operations log. + +### C.4 Vendor / processor management + +- Maintain a register of every service holding personal data: name, role (processor vs independent controller), data categories, location, DPA status, breach-notification clause, sub-processor list link. +- Minimum contract terms for processors: process only on instruction; confidentiality; security measures; sub-processor flow-down; breach notice to us without undue delay; deletion/return at end of service; SCCs for EU/UK data. +- Review the register annually and when adding any new tool. Current entries to confirm at adoption: Discourse/CDCK (execute standard DPA if hosted), web/docs hosting, email delivery provider, storefront, payment processors. + +### C.5 Security baseline (supports Tex. § 521.052(a) and GDPR Art. 32) + +- MFA mandatory on: Discourse admin, DNS registrar, hosting consoles, GitHub organization owners, mail provider admin. +- Admin access list reviewed quarterly; offboard departing volunteers same week. +- TLS everywhere; HSTS on Foundation domains. +- Forum software updated within **`14`** days of security releases; critical patches ASAP. +- Backups encrypted at rest, access-restricted, restore-tested annually. +- Secrets (API keys, tokens) stored in a password manager/secret store, never in repositories. +- `privacy@monogame.net` monitored; good-faith vulnerability reports acknowledged within 5 business days (consider publishing a security.txt and simple safe-harbor disclosure policy). + +### C.6 Annual review checklist + +- [ ] Policies (ToS, Privacy) reviewed; version/changelog updated +- [ ] Legal scan: TDPSA scope changes, new state laws reaching nonprofits, COPPA/SCOPE developments +- [ ] Vendor register reviewed; DPAs current +- [ ] Retention settings audited against policy +- [ ] Admin access audit completed +- [ ] Tabletop exercise completed; corrective actions closed +- [ ] DMCA agent registration current, *if* the Board opted in to § 512 safe harbor (Copyright Office renewal every 3 years); otherwise confirm the published copyright-complaints contact still routes correctly +- [ ] Board briefed; minutes recorded + +*This is an internal operating document. It is not legal advice; counsel should be engaged for any SEV-1 incident and for periodic review of this plan.* diff --git a/policies/MonoGame-Foundation-Privacy-Policy.md b/policies/MonoGame-Foundation-Privacy-Policy.md new file mode 100644 index 00000000..d779850c --- /dev/null +++ b/policies/MonoGame-Foundation-Privacy-Policy.md @@ -0,0 +1,160 @@ +--- +title: MonoGame Foundation Privacy Policy +layout: landing +_disableToc: true +_disableBreadcrumb: true +--- + +# MonoGame Foundation Privacy Policy + +This Privacy Policy explains how **MonoGame Foundation, Inc.**, a Texas nonprofit corporation (501(c)(3), EIN 93-3803929) ("the Foundation", "we", "us"), collects, uses, shares, and protects personal information when you use **monogame.net**, **community.monogame.net**, **docs.monogame.net**, and any other service we operate that links to this policy (the "Services"). + +**The short version:** we run a free, open-source community. We collect the minimum needed to operate a forum and websites — an account name, an email address, IP addresses, the content you post, and a few cookies. We do not sell personal data, we do not run targeted advertising, and we never see your payment card details. + +On request, we can show, correct, export, or delete your data at any time. If we suffer a data breach affecting you, we will tell you. + +## 1. Who Is Responsible (Data Controller) + +The data controller for the Services is: + +> MonoGame Foundation, Inc. +> 12225 Greenville Ave. STE. 1040 Dallas TX 75243. U.S.A. +> Privacy contact: [privacy@monogame.net](mailto:privacy@monogame.net) + +Our community forum runs on Discourse hosted locally by the MonoGame Foundation. + +## 2. What We Collect + +| Category | Details | When | +|---|---|---| +| Account data | Username, display name, email address (private), password (stored hashed), optional profile fields you choose to fill in (bio, avatar, website, location) | When you register on the forum | +| Content | Posts, topics, replies, private messages on the forum, uploaded images/files, reactions, flags | When you participate | +| Technical data | IP address of requests and of posts, browser/user-agent, server logs | Automatically, for all visitors | +| Cookies | Session and preference cookies (see Section 10) | Automatically | +| Email interaction | Whether forum notification emails are delivered/bounced; newsletter subscription status if you opt in | When you enable notifications or subscribe | +| Donation and store data | Name, email, and transaction confirmation passed back from payment processors or the storefront. **We never receive or store full payment card numbers.** | If you donate or purchase merchandise | +| Correspondence | Emails you send to our contact, privacy, security, or DMCA addresses | When you contact us | + +We do not knowingly collect data from children under 13 (Section 11), and we do not collect sensitive categories of data (health, biometrics, precise geolocation, etc.). Anything you choose to reveal in public posts is, of course, public. + +## 3. Why We Use It (Purposes and Legal Bases) + +For visitors and members in the EU/UK, the GDPR/UK GDPR requires us to state a legal basis for each purpose: + +| Purpose | Examples | Legal basis (GDPR Art. 6) | +|---|---|---| +| Providing the Services | Operating your account, displaying your posts, sending notification emails you request | Performance of a contract (the Terms of Service) | +| Security and abuse prevention | Rate limiting, spam filtering, investigating attacks, retaining IP logs | Legitimate interests (protecting the Services and users) | +| Communication | Answering your questions; service announcements | Legitimate interests / contract | +| Optional newsletters or announcements | Project news you explicitly subscribe to | Consent (withdraw any time via unsubscribe link) | +| Legal compliance | Responding to lawful requests; breach notification; record-keeping duties | Legal obligation | +| Improving the Services | Aggregate, non-identifying usage statistics | Legitimate interests | + +We do **not** use your data for targeted advertising, we do not sell or rent personal data, and we do not use personal data for automated decision-making with legal effects. + +## 4. Who We Share It With + +We share personal data only with: + +- **Service providers (processors)** who run infrastructure for us — currently Discourse/CDCK (forum hosting, if applicable), our web/documentation hosting providers, and our email delivery provider. Processors act under contract, only on our instructions, and must protect the data. +- **Payment processors and the storefront** (independent controllers) when you donate or buy merchandise — they handle your payment under their own privacy policies, which are linked in those flows. +- **Authorities**, when we believe in good faith that disclosure is required by law or necessary to protect the rights, property, or safety of the Foundation, our users, or the public. +- **A successor organization**, if the Foundation's operations are ever reorganized, under the same commitments in this policy. + +Third-party platforms where the community also gathers (GitHub, Discord, Reddit, YouTube, X, Bluesky, Mastodon, Facebook, Patreon) are independent services with their own privacy policies; data you share there is governed by those policies, not this one. + +## 5. International Transfers + +The Foundation is based in the United States and the Services are hosted there. If you use the Services from the EU, UK, or elsewhere, your data is transferred to the US. For EU/UK data we rely on data processing agreements incorporating the **Standard Contractual Clauses** with our processors, alongside the safeguards described in this policy. + +## 6. How Long We Keep It (Retention) + +We keep personal data only as long as needed, then delete or anonymize it: + +| Data | Retention | +|---|---| +| Server logs containing IP addresses | No more than **90 days** | +| IP addresses associated with registered users and their posts | No more than **5 years** | +| Account data | For the life of the account; anonymized or deleted on verified request or account closure (public posts may remain in anonymized form — see Section 7) | +| Private messages | For the life of the accounts involved | +| Donation/transaction confirmations | As required for nonprofit financial record-keeping (typically 7 years) | +| Privacy/DMCA/legal correspondence | 3 years after resolution | + +Records that no longer need to be retained are destroyed in line with Texas Business & Commerce Code § 521.052(b) by erasure or other means that make the information unreadable. + +## 7. Your Rights and Choices + +Wherever you live, you can: + +- **Access and export** your data — Discourse provides a self-service "Download My Data" export in your account preferences, and you may also ask us for a copy; +- **Correct** your profile information at any time in your account settings; +- **Delete/anonymize** — ask us to anonymize your account, which removes the link between you and your posts and erases your profile data. Because the forum is a public archive of technical discussion, the text of public posts may be retained in anonymized form (and under the content license you granted), but we will remove personal information contained within posts on a case-by-case basis where feasible; +- **Object or restrict** processing based on legitimate interests; +- **Withdraw consent** for anything based on consent (e.g., newsletters), without affecting prior processing; +- **Not be discriminated against** for exercising any of these rights. + +To exercise a right, email **[privacy@monogame.net](mailto:privacy@monogame.net)**. We will verify the request comes from the account holder (normally by confirmation from the registered email address), respond within **one month**, and explain ourselves if we need a one-time extension or must refuse (e.g., a legal duty to retain). There is no fee for reasonable requests. If you are in the EU/UK you may also complain to your local supervisory authority; if you are in Texas, you may contact the Texas Attorney General's consumer protection division. + +Although the Foundation, as a nonprofit, is exempt from the Texas Data Privacy and Security Act, we voluntarily extend the rights above to everyone. + +## 8. How We Protect It (Security) + +We implement reasonable administrative, technical, and physical safeguards appropriate to a community of our nature, consistent with Texas Business & Commerce Code § 521.052 and GDPR Article 32, including: + +- encryption of data in transit (TLS) across all Services; +- passwords stored only in salted, hashed form; +- multi-factor authentication required on administrative accounts; +- least-privilege access — administrative access limited to a small, reviewed list of named individuals; +- security patching of forum software and infrastructure; +- backups, with access controls, to allow recovery from data loss; +- a designated security contact (**[privacy@monogame.net](mailto:privacy@monogame.net)**) for vulnerability reports. + +No internet service can guarantee absolute security; what we can guarantee is honesty about incidents, as follows. + +## 9. Data Breach Notification — Our Commitment + +If we determine that a breach of system security has resulted in, or is reasonably believed to have resulted in, unauthorized acquisition of your personal data, we will: + +1. **Assess promptly** — our internal Data Incident Response Plan requires initial assessment and containment to begin immediately and a risk determination within 72 hours of discovery; +2. **Notify regulators where required** — including the competent EU/UK supervisory authority within **72 hours** where GDPR applies, and the **Texas Attorney General within 30 days** (via the AG's electronic form) if 250 or more Texas residents are affected; +3. **Notify you directly** — without unreasonable delay and in any event within **60 days** of determining the breach occurred, by email to your registered address (or substitute notice where permitted), describing what happened, what data was involved, what we have done, and what you can do; +4. **Notify consumer reporting agencies** if more than 10,000 individuals must be notified at one time, as Texas law requires; +5. **Publish a transparency notice** on the community site for incidents affecting the community at large, and update it as facts develop. + +## 10. Cookies + +The Services use a small number of cookies: + +| Cookie type | Purpose | Consent | +|---|---|---| +| Strictly necessary | Session cookie keeping you logged in to the forum; security/CSRF tokens | Not required (essential to the service) | +| Preferences | Remembering interface settings such as theme (light/dark) | Not required / opt-out by clearing cookies | +| Analytics or advertising | **None.** We do not run third-party advertising or tracking cookies. | n/a | + +If we ever introduce non-essential cookies, we will categorize them here and request consent from visitors in jurisdictions that require it before setting them. You can also control cookies through your browser settings; blocking essential cookies will prevent login. + +## 11. Children + +The Services are directed to people **aged 13 and over**. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact [privacy@monogame.net](mailto:privacy@monogame.net) and we will delete the account and associated personal data. We do not direct targeted advertising at anyone, including minors, and we apply data minimization to all users. + +## 12. Notice of Sale or Transfer + +Should the Foundation change ownership at any time, all registered accounts will be notified as early as possible for users to take action as they deem fit. However, this is a very unlikely scenario due to the nature of the MonoGame Foundation incorporation. The Foundation is not for sale or transfer at this time. + +## 13. Scope and External Data + +This policy covers information collected through the Services. It does not cover information collected offline (for example at conferences), on third-party platforms, or by the MonoGame framework itself — the framework is software you run; it does not transmit personal data to the Foundation. Any storage of data is on MonoGame Foundation owned hardware located at Foundation addresses, secured according to the legal requirements present at its location. + +## 14. Changes to This Policy + +When we change this policy we will post the new version here with an updated version number and effective date, and for material changes we will announce the change on the community forum with reasonable advance notice. Earlier versions will remain available on request. + +## 15. Contact + +Questions, concerns, complaints, or rights requests: + +> MonoGame Foundation, Inc. +> 12225 Greenville Ave. STE. 1040 Dallas TX 75243. U.S.A. +> General: [contact@monogame.net](mailto:contact@monogame.net) · Legal: [admin@monogame.net](mailto:admin@monogame.net) · Privacy/Security: [privacy@monogame.net](mailto:privacy@monogame.net) + +*This document is licensed CC BY-SA 4.0.* diff --git a/policies/MonoGame-Foundation-Terms-of-Service.md b/policies/MonoGame-Foundation-Terms-of-Service.md new file mode 100644 index 00000000..f5f15ede --- /dev/null +++ b/policies/MonoGame-Foundation-Terms-of-Service.md @@ -0,0 +1,120 @@ +--- +title: MonoGame Foundation Terms of Service +layout: landing +_disableToc: true +_disableBreadcrumb: true +--- + +# MonoGame Foundation Terms of Service + +These Terms of Service ("Terms") govern your use of websites and online services operated by **MonoGame Foundation, Inc.**, a Texas nonprofit corporation recognized as tax-exempt under Section 501(c)(3) of the Internal Revenue Code (EIN 93-3803929) ("the Foundation", "we", "us"). The services covered by these Terms (together, the "Services") include: + +- **monogame.net** — the MonoGame project website; +- **community.monogame.net** — the MonoGame community forum, operated using Discourse; +- **docs.monogame.net** — the MonoGame documentation site; +- Any other website or service we operate that links to these Terms. + +These Terms do not govern the MonoGame framework itself, which is open-source software, licensed separately under the Microsoft Public License (and other licenses for certain portions) as stated in the source repository. Nor do they govern third-party platforms where the community is also present (GitHub, Discord, Reddit, and others), which have their own terms. + +By accessing or using the Services, you agree to these Terms and to our [Privacy Policy](https://monogame.net/policies/MonoGame-Foundation-Privacy-Policy). If you do not agree, please do not use the Services. + +## 1. Eligibility and Age Requirement + +The Services are available only to individuals who are **at least 13 years old**. By creating an account you represent that you meet this requirement. We will remove accounts that we learn belong to children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If you are between 13 and the age of majority where you live, you may use the Services only with the consent of a parent or guardian. + +## 2. Your Account + +If you create an account on the community forum, you are responsible for maintaining the security of your account and for all activity that occurs under it. Choose a strong password, do not share your credentials, and notify us promptly at [privacy@monogame.net](mailto:privacy@monogame.net) of any unauthorized use of your account or other security issue. We are not liable for loss or damage arising from your failure to protect your credentials. + +You may close your account at any time. Closing or anonymizing an account is handled as described in our Privacy Policy. + +## 3. Community Conduct and Content Standards + +The community forum exists to help people build games. When you post material to the Services ("Content"), you are entirely responsible for that Content and any harm resulting from it. You agree that your Content: + +- will not infringe any third party's copyright, patent, trademark, trade secret, or other proprietary rights, and that you have any permissions or waivers needed from an employer with rights in what you post; +- complies with any third-party licenses that apply to it, including passing through required notices; +- does not contain viruses, worms, malware, or other harmful or destructive code; +- is not spam, is not machine- or randomly-generated, and is not unwanted commercial or promotional material; +- is not pornographic, does not contain threats or incite violence, does not harass others, and does not violate anyone's privacy or publicity rights; +- does not impersonate any person or organization or mislead readers about its source; and +- where it includes code, accurately describes what the code does. + +You must also follow our published Community Guidelines, which form part of these Terms. We may (but are not obligated to) refuse, remove, or moderate any Content that, in our reasonable opinion, violates these Terms or is otherwise harmful or objectionable, and we may suspend or terminate access to the Services for any individual or entity that violates these Terms. + +## 4. License to Your Contributions + +So that the community can function, contributions you post to the forum are licensed by you to the public under the **Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)** license. Contributions posted before [July 2026] remain licensed under CC BY-NC-SA 3.0 Unported, the license in effect when they were posted. You retain copyright in your contributions. You also grant the Foundation the technical rights needed to host, display, distribute, back up, and moderate your Content as part of operating the Services. + +If you include source code in a post and wish it to be available under a more permissive license (for example, the same license as MonoGame itself), say so in the post. + +## 5. Free Services; No Commercial Offerings + +The Services are provided free of charge. The Foundation does not sell subscriptions, paid hosting, paid support tiers, or advertising on user content through the Services. Donations to the Foundation are voluntary, are processed by third-party payment processors, and are governed by the terms presented in the donation flow. Merchandise purchases through our store are fulfilled by a third-party storefront under its own terms of sale. + +## 6. Responsibility of Visitors; Third-Party Links + +We have not reviewed, and cannot review, all material posted to the Services, and we are not responsible for that material's content, use, or effects. Operating the Services does not mean we endorse material posted there or believe it to be accurate or harmless. The Services may contain links to third-party websites that we do not control; we are not responsible for their content or practices. You are responsible for taking reasonable precautions to protect yourself and your systems from harmful content. + +## 7. Copyright Complaints (DMCA Policy) + +We respect the intellectual property rights of others and expect users of the Services to do the same. If you believe material on the Services infringes your copyright, send a notification consistent with the Digital Millennium Copyright Act (17 U.S.C. § 512(c)(3)) to our copyright complaints contact: + +> Copyright Complaints, MonoGame Foundation, Inc. +> Email: [privacy@monogame.net](mailto:privacy@monogame.net) +> Address: 12225 Greenville Ave. STE. 1040 Dallas TX 75243. U.S.A. + +Your notice must identify the copyrighted work, identify and locate the allegedly infringing material, include your contact information, a statement of good-faith belief that the use is unauthorized, a statement under penalty of perjury that the information is accurate and you are authorized to act, and your physical or electronic signature. We will respond to valid notices, including by removing or disabling access to the material. Users may submit counter-notifications under § 512(g). We will **terminate the accounts of repeat infringers** in appropriate circumstances. + +## 8. Intellectual Property of the Foundation + +These Terms do not transfer to you any Foundation or third-party intellectual property. The MonoGame name, the MonoGame logo, and other marks used in connection with the Services are trademarks of the Foundation or its licensors, and except as permitted by our published brand/press guidelines, your use of the Services grants you no right to use them. The MonoGame framework source code remains governed by its own open-source licenses. + +## 9. Changes to These Terms or the Services + +We may modify these Terms from time to time. When we do, we will post the revised Terms with a new version number and effective date, and for material changes we will make reasonable efforts to give notice (for example, a forum announcement). Your continued use of the Services after changes take effect constitutes acceptance. We may also change, suspend, or discontinue any part of the Services at any time. + +## 10. Termination + +We may suspend or terminate your access to all or any part of the Services at any time, with or without cause or notice, including for violation of these Terms. You may stop using the Services at any time. Provisions that by their nature should survive termination (including content licenses, disclaimers, limitations of liability, and indemnification) survive. + +## 11. Disclaimer of Warranties + +The Services are provided **"as is" and "as available"**. To the fullest extent permitted by law, the Foundation and its suppliers and licensors disclaim all warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Services will be error-free or uninterrupted. You obtain content or services through the Services at your own discretion and risk. + +## 12. Limitation of Liability + +To the fullest extent permitted by law, in no event will the Foundation, or its directors, officers, employees, volunteers, suppliers, or licensors, be liable with respect to any subject matter of these Terms under any theory for: (i) any special, incidental, or consequential damages; (ii) the cost of procurement of substitute products or services; (iii) interruption of use or loss or corruption of data; or (iv) any amounts in the aggregate exceeding one hundred US dollars (US $100). The Foundation has no liability for failure or delay due to matters beyond its reasonable control. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you; nothing in these Terms excludes liability that cannot be excluded by law. + +## 13. Indemnification + +You agree to indemnify and hold harmless the Foundation, its contractors and licensors, and their respective directors, officers, employees, volunteers, and agents from and against any and all claims and expenses, including reasonable attorneys' fees, arising out of your use of the Services or your violation of these Terms. + +## 14. Governing Law; Disputes + +These Terms and any access to or use of the Services are governed by the **laws of the State of Texas, U.S.A.**, excluding its conflict-of-law provisions. Before filing any claim, you agree to first contact us at [legal@monogame.net](mailto:legal@monogame.net) and attempt in good faith to resolve the dispute informally for at least 30 days. Except for claims for injunctive or equitable relief or claims regarding intellectual property rights, exclusive jurisdiction and venue for any dispute arising under these Terms lies in the state and federal courts located in **Dallas, Texas**, and you consent to personal jurisdiction there. + +## 15. Contribution to MonoGame Source + +The MonoGame Foundation adheres to strict [Contribution Guidelines](https://github.com/MonoGame/MonoGame/blob/develop/CONTRIBUTING.md) in relation to additions to the MonoGame Foundation code base. + +For further details, please see: `https://github.com/MonoGame/MonoGame/blob/develop/CONTRIBUTING.md` + +## 16. Use of AI + +We prohibit all content created with generative AI and/or LLMs from being contributed to MonoGame. It CANNOT be used for any reason for new code features, documentation, bug fixes, or art content. If you did not write the code yourself, you should not be contributing it to MonoGame. If we find a contribution to be made with LLMs or other generative AI tools, it will be immediately removed. +All use of AI for building games is not within the remit of the MonoGame Foundation and is purely personal use. + +## 17. Miscellaneous + +These Terms, together with the Privacy Policy and Community Guidelines, constitute the entire agreement between you and the Foundation concerning the Services. If any part of these Terms is held invalid or unenforceable, that part will be construed to reflect the parties' original intent, and the remaining portions remain in full force. A waiver of any term in one instance is not a waiver of that term generally. You may not assign these Terms without our consent; we may assign our rights under these Terms in connection with a reorganization of the Foundation. Notices to the Foundation should be sent to [legal@monogame.net](mailto:legal@monogame.net). + +## 18. Contact + +Questions, concerns, complaints, or rights requests: + +> MonoGame Foundation, Inc. +> 12225 Greenville Ave. STE. 1040 Dallas TX 75243. U.S.A. +> General: [contact@monogame.net](mailto:contact@monogame.net) · Legal: [admin@monogame.net](mailto:admin@monogame.net) · Privacy/Security: [privacy@monogame.net](mailto:privacy@monogame.net) + +*This document is licensed CC BY-SA 4.0. Portions derive from the Discourse and WordPress terms-of-service templates (CC BY-SA).* diff --git a/templates/monogame/partials/body.tmpl.partial b/templates/monogame/partials/body.tmpl.partial index 08fb5522..1f38fa31 100644 --- a/templates/monogame/partials/body.tmpl.partial +++ b/templates/monogame/partials/body.tmpl.partial @@ -66,7 +66,6 @@
  • API Reference
  • Showcase
  • About
    • -
  • Foundation Bylaws
    • @@ -89,6 +88,15 @@
  • Facebook
    • +
    +
    Legal
    + +
    diff --git a/templates/monogame/partials/footer.tmpl.partial b/templates/monogame/partials/footer.tmpl.partial index 6508fb82..7d421a94 100644 --- a/templates/monogame/partials/footer.tmpl.partial +++ b/templates/monogame/partials/footer.tmpl.partial @@ -16,9 +16,6 @@
  • About
    • -
  • - Foundation Bylaws -
    • @@ -57,6 +54,23 @@
    +
    +
    Legal
    + +

    Contact Us