Terms of use. The rules, in plain words.

01What these terms are for

Aperture stores and delivers the media that game servers send it: screenshots, clips, voice messages and server assets. The platform is published by Aperture, whose full identity is in the legal notice.

These terms are the contract between you and Aperture. They apply to every use of the platform: the site, the customer space and the API. You accept them when you create your account, or the first time you sign in if an operator or an invitation opened that account for you.

If you accept them on behalf of a company, an association or a team, you confirm that you are entitled to bind it.

They are read together with the documents below:

• Legal notice Who publishes the site, who hosts it, and how to reach them.
• Privacy policy The data processed, why, for how long, and your rights.
• Cookie policy Every cookie and every entry your browser keeps for this site.
• Report content Report hosted content you believe is illegal.

02The words we use

In these terms:

• the platform means Aperture: its site, its customer space, its API and the addresses that deliver the files;
• we means Aperture, who publishes the platform;
• you means the person who holds an account, and the organisation they act for;
• an organisation is the space that brings together media, API keys, settings and members; every organisation has an offer;
• a member is an account with access to an organisation; the owner is the member who holds it;
• a player is a person who plays on a game server connected to the platform;
• content is a file sent to the platform, with what comes with it: its name, its metadata, the player's identifier and name.

You are a consumer if you use the platform outside any professional activity, for example for a server among friends. A few rules apply only to consumers, or only to professionals: these terms say so each time.

03Your account

You must be at least 15 to create an account. Under 18, you also need the agreement of a parent, or of the person with parental authority, to request a paid offer.

To create an account, you go through the steps of the sign-up form, check what you typed, tick the box that accepts these terms, then confirm: the contract is made at that moment. Sign-up may be closed for a while; an operator can also create your account, or an organisation can invite you.

Give accurate details and keep them up to date: you change your name and email address on your account page. An account belongs to one person: to work as a team, invite members rather than share a password.

Keep your password and your API keys secret. A key is shown only once, when it is created: put it in your server's configuration, never in a public code repository. If a key has leaked, revoke it at once from the API keys page. What is done with your account or your keys is your responsibility, until you tell us about a problem.

04Offers

Every organisation is on an offer. Offers differ only in storage, monthly bandwidth and price. Their details and their prices, including all taxes, are on the pricing page.

When you sign up, your organisation starts on the free offer. To move to a paid offer, the owner or a member who manages the organisation's settings requests it from the Offer page of the customer space. Before anything is sent, that page shows what would change: storage, bandwidth and price, and you can back out without sending anything. Once the request is sent, the customer space confirms it at once and shows where it stands; you can withdraw it while it is waiting.

There is no payment on the site and no automatic debit: payment is arranged directly with us, outside the site. An operator activates the offer once the payment is received. Your new terms apply from that moment, and nothing changes until then. An operator can also decline a request, or agree tailored terms with you.

A paid offer has a fixed price per month. It runs from month to month, with no minimum term, until you change offer or close your account. Nothing is charged per upload, per delivery or per unit of traffic. If a month is not paid, we may, after warning you, move the organisation back to the free offer: your media keep being served, but new uploads are refused while the storage used exceeds that offer's.

Storage. When the offer's storage is full, new uploads are refused, and everything already online keeps being served. Your customer space warns you at 80, 90 and 100% of the storage.

Bandwidth. It is counted per month and starts again from zero on the 1st of each month. When the platform measures your organisation's traffic, your customer space warns you at 80 and 100% of the included bandwidth. Either way, going over is never charged and delivery is never cut. If it keeps happening, you can request a larger offer.

To change offer, request another one the same way, including the free offer to leave a paid one. If the new offer stores less than you use, your files keep being served, but new uploads are refused until you free some space.

05What is not allowed

You are responsible for what your servers and your members send. You must not send, store or deliver through the platform:

• child sexual abuse material, meaning any sexual image or video involving a minor;
• incitement to terrorist acts, or their glorification;
• glorification, denial or trivialisation of crimes against humanity;
• incitement to hatred, violence or discrimination against people because of their origin, religion, sex, sexual orientation, gender identity or disability;
• threats or harassment aimed at a real person, or images that violate human dignity;
• intimate or sexual images of a person shared without their consent, or pornographic content that minors can reach;
• promotion of human trafficking or procuring;
• a person's image, voice or personal data when you have no right to share them;
• content that infringes a copyright, a trademark or another right you do not hold;
• scams, phishing, malware or booby-trapped files, or impersonation;
• any other content against the law.

Scenes from a game, such as a car chase or a roleplay shoot-out, are not targeted in themselves: what counts is what the law or these terms forbid.

Abusing the platform is not allowed either:

• trying to reach another organisation's data, or getting round a limit: storage, request rate, permissions;
• overloading the platform, attacking it, or probing it for weaknesses without our written agreement;
• using someone else's account or API key without their agreement;
• using share links to send unsolicited messages.

If you find a security flaw, report it to us without exploiting it.

06Reports and moderation

We do not look through content one file at a time: the law does not ask us to. We act when someone reports content to us, when an authority asks us to, or when we find a problem ourselves.

Anyone can report content to us, without an account, with the report form, which every share page offers too. The form asks for the content's address, the reason, an explanation, your name and email address (except for child sexual abuse material, which can be reported anonymously), and a statement of good faith.

You then get a reference and the address of a page that tracks your report. We send no email: keep that address. The page shows the decision and its reasons as soon as it is made, never your identity.

Every report is read and decided by a person. We use no automated tool to judge content: the checks made on upload look at the type and size of files, never at what they show.

Depending on how serious it is, whether it is repeated and whether it was intended, we may:

• remove the content: it stops being delivered, goes to the organisation's recycle bin and cannot be restored;
• revoke API keys, or remove a member's access to an organisation;
• in serious or repeated cases, close an account or an organisation.

We choose the lightest measure that is enough, and we apply these rules with the same care for everyone.

When we remove content, the organisation sees in its recycle bin and in its activity log the ground we relied on (against the law, or against these terms) and the statement of our decision: the facts involved, and whether they were reported to us. For a measure that affects a whole account or organisation, we give the holder the reasons, at the latest when it takes effect. We do not disclose who made the report, unless the law requires us to.

When an authority orders us to act against content or to give it information, we do so and tell you, unless it forbids us to. We inform the authorities of illegal activity reported to us when the law provides for it, and at once of anything that suggests an offence threatening a person's life or safety. If someone is in immediate danger, call 17 or 112 before anything else.

Reporting content as illegal while knowing this is untrue, to have it removed, is punishable in France by one year of imprisonment and a fine of 15,000 euros (article 6 of the French law for confidence in the digital economy).

07Contesting a decision

A moderation decision can be contested within six months, by the organisation whose content was removed or whose account was restricted, and by the person whose report was rejected. Write to the reports contact (see Contact us) with the report's reference or the content's address, and why you think a different decision is justified.

A person reviews the decision with what you bring, without any automated tool, and replies to you. This recourse is free.

If we reverse a removal, you can upload the content again: the removed file itself cannot be restored, and it is erased with the recycle bin after 7 days.

You can also go to the competent court at any time.

08Your content

Your content remains yours, or its authors'. You guarantee that you have the right to send it and to have it delivered, including the agreement of the people it shows when the law requires it.

To host and deliver it, you grant us, free of charge, worldwide and without exclusivity, the right to store it, copy it, convert it (compression, thumbnails, posters, transcoding) and deliver it at the addresses you use: file addresses, share pages, link previews in messaging apps, and your own domains. This right only serves to run the platform for you, and it ends when the content is erased.

We do not use your content for anything else: no advertising, no resale, no training of artificial intelligence models.

Every file gets a public address: anyone who knows it can see the file, without an account. These addresses are impossible to guess in practice, but they are not secret. A share page shows your organisation's name; you can hide file names or turn share pages off in the organisation's settings.

Deleted content goes to the recycle bin, where it stays 7 days before it is erased. The retention rules you turn on delete files automatically; without them, nothing is deleted automatically.

The platform delivers your files, it does not back them up for you: keep a copy of the ones that matter.

09Your duties toward players

The media your servers send often show players: their image, their voice, their nickname, their messages. For that data, your organisation is the controller, and we act on its behalf, under the annex below. In short, you must:

• tell players, for example in your server's rules, that their screenshots, clips and voice messages are hosted by Aperture on your behalf, why, for how long, and how to ask for them to be deleted;
• have a legal basis for each processing, and send only what you need;
• take care with minors: if you rely on their consent, a player under 15 also needs a parent's;
• answer players' requests within one month, and delete their files when they are entitled to it.

A player can also report an image or a recording of them directly to us with the report form.

10Availability and maintenance

We do our best to keep the platform running without interruption, but we do not guarantee continuous availability, unless your offer expressly provides for it.

The status page shows the live state of each part of the platform, and its recent history.

We may interrupt all or part of the platform for maintenance. When we can, we announce it in advance in the customer space and on the status page. During some maintenance windows, files already online keep being served.

The platform evolves: we may add, change or remove features. If a change removes an essential feature of a current paid offer, we warn you in advance, and you can change offer or close your account.

11Liability

You answer for the content your servers and your members send, for the use of your keys, and for your members keeping to these terms.

We host your content. Like any hosting provider, we are not liable for it as long as we do not know it is illegal, and we act promptly to remove it or block access to it as soon as we do (article 6 of the European Digital Services Act).

We answer for direct and foreseeable damage caused by a failure on our part. We do not answer for what comes from you, from a third party (including storage you connected yourself), or from force majeure.

If you are a professional, our liability under a paid offer does not exceed the amounts paid for that offer during the twelve months before the event in question. This limit does not apply to gross negligence or wilful misconduct, nor to personal injury.

If you are a consumer, nothing in these terms limits the rights the law gives you, in particular the legal guarantee of conformity for digital content and services on a paid offer.

12Suspension and closure

You can close your account at any time from your account page, by confirming your password. The same page lets you download your data first.

When you close your account, you leave all your organisations. An organisation you are the only member of is closed with it: its keys are revoked, its files stop being delivered and are erased. If you are the sole owner of an organisation that has other members, hand it over to one of them first.

The law requires us to keep some information after closure, such as your name and email address for 5 years: the privacy policy sets it out.

Closing an account or an organisation does not refund the month already paid, unless you withdraw within the legal period. To leave only a paid offer, request the free offer.

On our side, if you do not keep to these terms, we tell you what is wrong and give you a reasonable time to put it right, before applying one of the measures described in Reports and moderation. We act without notice in an emergency: illegal content, a threat to the security of the platform or of people, a decision by an authority, or repeated breaches. In every case, we give you our reasons, and you can contest the decision.

If we shut the platform down, we warn you at least 30 days in advance, to give you time to retrieve your files, and we refund the part of a paid month that will not be provided.

13If you are a consumer

For a paid offer, you have 14 days to withdraw, without giving a reason or paying a penalty (article L221-18 of the French Consumer Code). The period starts on the day an operator accepts your request, which makes the contract.

To withdraw, tell us before the period ends with a clear statement, for example using the model below, sent to Aperture (see Contact us). We refund you within 14 days of receiving your decision, by the means of payment you used, unless you agree to another.

If you asked for the offer to start before the period ends, you pay only for the service provided until you withdraw, in proportion to the agreed price (article L221-25 of the French Consumer Code).

Model withdrawal form, to fill in and send back only if you wish to withdraw:

• To Aperture, at the details given in Contact us:
• I hereby give notice that I withdraw from my contract for the provision of the service below:
• Offer and organisation concerned:
• Ordered on:
• Name of consumer:
• Address of consumer:
• Signature of consumer (only if this form is sent on paper):
• Date:

In a dispute, first send us a written complaint: most problems are settled that way.

No consumer mediator has been appointed so far. A complaint can be sent to Aperture through the contact details on this page. The mediator Aperture answers to will be named here before any paid offer is sold to a consumer.

14Changes to these terms

We may change these terms, for example to follow the law or a change in the platform. Each version carries its date, at the top of this page.

With each new version, your customer space shows it to you and asks you to accept it before you carry on. Until then, your account page stays open so you can download your data or close your account. If the new version does not suit you, you can close your account at any time.

A change to the price of a paid offer does not affect the month already paid, and we warn you before it applies.

We record with your account the version you accepted and its date. You can save or print these terms from this page at any time, and we send you on request the version you accepted.

These terms exist in French and in English. Where the two differ, the French version prevails.

15Governing law and disputes

These terms are governed by French law.

If we disagree, write to us first: we look for an amicable solution.

If you are a consumer, you keep the protective rules of the country where you live, and you can bring a claim before the court of the place where you live, or any other court the law designates.

If you are a professional, only the courts for the area of Aperture's registered office have jurisdiction, unless a mandatory rule says otherwise.

16Contact us

For a question about these terms, a complaint or a withdrawal, write to Aperture:

The reports contact is our single point of contact, for users and for authorities alike (articles 11 and 12 of the European Digital Services Act). A person reads every message, and we answer in French and in English.

17Annex: data processing agreement

This annex is part of the terms of use. It is the contract that article 28 of the General Data Protection Regulation (GDPR) requires between a controller and its processor.

For the content your servers and your members send, and for the player data that comes with it, your organisation is the controller: it decides why and how that data is processed. Aperture is its processor: we process the data on its behalf, under its instructions.

For everything else (accounts and members, the security of the platform, reports, and what the law requires us to keep), we are the controller ourselves, as the privacy policy explains.

On data protection, this annex prevails over the rest of the terms if the two contradict each other.

18Annex: subject, nature and duration

Subject and purpose. Hosting, transforming and delivering your game servers' media, as you set it up, and nothing else.

Nature. We receive the files through the API, check their real type, compress them and derive variants from them (thumbnails, posters, transcoding), store them, deliver them at the public addresses and the domains you configure, show them in your customer space, on share pages and, if you open it, in the player space of the player concerned, then delete them when you ask or when your retention rules say so.

Duration. As long as your organisation exists, then the time needed to erase its files, as the end of processing below describes.

19Annex: data and people concerned

The data processed on your behalf is:

• the files themselves: screenshots, clips, voice messages and server assets, which can show a player's image, voice, nickname or messages;
• the player's game identifiers your scripts send (Rockstar licences, Discord, Steam and Cfx.re accounts) and their name;
• the file's original name and the metadata your scripts attach to it;
• technical details: type, size, dimensions, duration, upload date, number of deliveries and date of last access.

By default, the metadata embedded in images (EXIF), GPS location included, is removed on receipt.

The people concerned are the players on your servers, and anyone else who can be seen or heard in content.

The platform is not made for sensitive data, such as health, opinions or sex life: do not send any, in files or in metadata, without a legal basis that allows it.

Separately, as a controller, we keep the IP address that sent each file for 365 days, as the law requires of a hosting provider (French decree no. 2021-1362). The privacy policy explains it.

20Annex: your instructions

We process this data only on your documented instructions: these terms, the requests your scripts send to the API with your keys, what your members do in the customer space, and your organisation's settings (compression, retention, share pages, player space, domains, storage, members). Changing a setting gives a new instruction.

Opening the player space instructs us to show each player who signs in there the media sent under one of their identifiers, of the kinds you choose, and only those sent by a key you marked as feeding it: a key that stays on your game server. Closing it removes your media from your players' spaces at once, without deleting anything. The space itself, with the accounts players link to it, is our own responsibility, as the privacy policy explains.

We do not use the data for our own purposes, beyond what the law imposes on a hosting provider: handling reports and answering authorities.

These instructions also cover any transfer outside the European Economic Area (the European Union, Iceland, Liechtenstein and Norway). If the law requires us to process the data otherwise, we tell you beforehand, unless it forbids us to.

If an instruction seems to us to breach data protection law, we tell you straight away.

When you connect your own storage, an FTP server or a bucket, that provider is yours: we write and read your files there on your instructions, but it is not our sub-processor.

21Annex: confidentiality and security

Only the people who run the platform have access to this data, and only when needed: a request for help from you, a report, an incident or a request from an authority. They are bound by confidentiality.

We protect the data with measures suited to the risk (article 32 of the GDPR), including:

• exchanges with the platform are encrypted (HTTPS);
• files are served from a separate domain, which never receives a session cookie;
• the real type of every file is checked on receipt, and images are re-encoded before they are stored, unless the chosen format keeps the original file;
• API keys are stored only as a fingerprint, and shown only once;
• passwords are never stored in clear;
• each member has only the permissions they are given, and deletions as well as permission changes are written to the activity log;
• uploads and requests are rate limited, and file addresses are impossible to guess in practice.

We review these measures as the platform evolves.

22Annex: sub-processors

You give us a general authorisation to use other sub-processors to host and deliver your data. Here is the current list, the same as in the privacy policy:

Before adding or replacing a sub-processor, we update this list and inform you in advance. You can object on legitimate grounds by writing to us (see Contact us). If we cannot take your objection into account, you can close your account, at no cost.

Every sub-processor is bound in writing to the same data protection obligations as we are, and we remain answerable to you for its work.

We transfer your data outside the European Economic Area only to a sub-processor this list marks as such, with the safeguards it states.

23Annex: our help

To answer players who exercise their rights, the tools are in your hands: the Media page shows each player's uploads and lets you delete them, the API lets you list and delete files, and retention rules delete them automatically.

If a player writes to us about your content, we tell them to contact you and pass their request on to you without delay. For an image or a recording of them, they can also use the report form.

On request, we give you the information you need for the security of your processing, to notify a data breach, for an impact assessment or to consult your supervisory authority beforehand (articles 32 to 36 of the GDPR).

24Annex: data breach

If we learn that a breach affects your data (a leak, a loss, unauthorised access), we warn your organisation's owner without undue delay.

We give them what we know: what happened, the data and the approximate number of people concerned, the likely consequences, and the measures taken or proposed. We add to it as we learn more.

It is then for you to notify your supervisory authority (the CNIL in France) within 72 hours if the breach is a risk to people, and to warn the players if that risk is high. We help you do so.

25Annex: end of processing

While the service runs, you delete your files from the customer space or through the API, or automatically through your retention rules. A deleted file goes to the recycle bin, then it is erased after 7 days.

When your organisation is closed, with its last member's account or by us at the end of the contract, all its media and server assets stop being delivered at once. Their files are erased by the automatic clean-up from the following night, over several nights for a large library, then the organisation's data is deleted.

Before closing, you can retrieve your files from the customer space or through the API: this is how we return them to you. After closure, nothing can be restored.

All that remains is the data the law requires us to keep, for which we are the controller ourselves: for example the upload IP address for 365 days, and a handled report for 365 days after its decision.

26Annex: information and audits

On request, we give you the information needed to show that we keep to this agreement: the description of our security measures, the list of our sub-processors and our record of the processing carried out on behalf of our customers.

You can have this checked by an audit, yourself or through an independent auditor bound by secrecy, by giving us written notice at least 30 days in advance. Except after a data breach or at an authority's request, you can run one per year at most. It is at your expense, without access to other customers' data and without putting the security of the platform at risk. We take part in good faith.

We cooperate with the CNIL and answer its requests.

27Annex: your obligations

As the controller, your organisation:

• makes sure its instructions comply with the GDPR, and that it has a legal basis for each processing;
• informs players before their data is sent (articles 13 and 14 of the GDPR): who it is, that Aperture hosts their media on its behalf, why, for how long, how to exercise their rights and, if it opens the player space, that each of them can find there the media sent under their identifiers (the space's settings offer a text to reuse);
• also obtains a parent's consent for a player under 15, when it relies on consent (article 45 of the French Data Protection Act);
• answers players' requests within one month, and deletes what must be deleted;
• sets a suitable retention period: without a rule, nothing is deleted automatically;
• keeps its API keys secret, and gives its members only the permissions they need.