Acceptable Use Policy

Storm Developments
Storm Buckets - S3-Compatible Object Storage

Effective Date: 07/24/2026
Last Updated: 07/24/2026

1. About This Policy

This Acceptable Use Policy (the "AUP") sets out what you may not store on Storm Buckets, and what you may not do with the service. It forms part of our Terms of Service. If you use Storm Buckets, this policy binds you.

Storm Buckets is infrastructure. We sell object storage and static website hosting to businesses, developers, and platform operators. We are not a file-sharing service. We do not pay anyone to upload content, we do not charge for downloads, and we do not publish an index of what our customers store.

The examples in this policy are illustrative, not exhaustive. We may act on content or conduct that is not specifically listed here, where it is unlawful, harmful, or inconsistent with the purpose of the service.

2. Who This Policy Binds

This policy applies to you, to anyone using your account whether or not you authorized them, and to any content you store or serve through Storm Buckets regardless of who created it.

If your own service accepts uploads from your users, for example if you operate a Mastodon instance, a PeerTube instance, or any other platform backed by a Storm bucket, you are responsible for what those users put there. You must maintain your own acceptable use rules and your own way of receiving and acting on abuse reports. When we receive a report about content on your platform, we deal with you, not with your users.

Using Storm Buckets to help another person do something this policy prohibits is itself a violation of this policy.

3. Changes to This Policy

We may amend this policy as the service develops and as new forms of abuse appear.

An amendment takes effect on the earlier of the date we notify you and the first day of your next billing period following the amendment. Where an amendment is needed to address an immediate legal or security concern, it takes effect when we post it.

This is a shorter notice period than the one for changes to our Terms of Service. That is deliberate. Abuse changes faster than contracts do.

4. Prohibited Content

You may not store, transmit, or serve any of the following through Storm Buckets:

Child sexual abuse material, or any content that sexually exploits or promotes the sexual exploitation of a minor. See Section 9.
Intimate images published without the consent of the person depicted.
Content that incites, threatens, or promotes violence, or that promotes terrorism or violent extremism.
Content that promotes hatred against a person or group on the basis of race, national or ethnic origin, religion, sex, sexual orientation, gender identity or expression, age, or disability.
Content that infringes another person's copyright, trademark, patent, or other intellectual property rights. See Section 8.
Tools, keys, or instructions whose purpose is to defeat technical measures protecting copyrighted works.
Malware, ransomware, spyware, exploit kits, or any code intended to damage a system or gain unauthorized access to one.
Phishing pages, fraudulent storefronts, or any content designed to deceive a person into surrendering credentials, money, or personal information.
Stolen data, including credential dumps, breach data, payment card data, and personal information obtained without authorization.
Personal information about other people that you have no lawful basis to hold or to publish.
Content that is otherwise unlawful under Canadian federal law or the law of Ontario.

5. Prohibited Conduct

You may not use Storm Buckets to:

Gain or attempt to gain unauthorized access to any system, network, or account, including by probing, scanning, or testing for vulnerabilities without the owner's permission.
Monitor or intercept traffic on a network you do not have permission to monitor.
Interfere with any system or network, including by flooding, denial of service, or deliberate overload.
Send unsolicited bulk email, or host the landing pages, images, tracking assets, or other infrastructure supporting an unsolicited bulk campaign. Where you send commercial electronic messages in connection with anything you host with us, you must comply with Canada's Anti-Spam Legislation.
Forge or obscure the origin of a request, message, or file.
Operate command and control infrastructure for malware or a botnet.
Harass or abuse Storm Developments staff.

Testing the security of Storm Buckets itself requires our prior written permission. Ask us before you test.

6. Storage, Capacity, and Bandwidth

Storm Buckets is priced on capacity. The following uses undermine that model and are not permitted:

Using allocated storage as the basis for a blockchain, distributed ledger, or consensus mechanism that derives value from committed capacity. This includes proof-of-space and proof-of-storage farming.
Circumventing, or attempting to circumvent, storage quotas, egress allowances, account limits, or pricing.
Creating accounts in bulk, or by any means other than our published signup process.
Using a bucket primarily as an unauthenticated delivery endpoint for content belonging to a third party, where the traffic is not attributable to your own service or site.
Reselling or sublicensing access to Storm Buckets without our written permission.

Your egress allowance is enforced by throttling, not by additional billing. If your traffic runs well beyond your allowance on a sustained basis, we will throttle it and contact you. We will not send you a surprise invoice.

7. Storm Sites and Public Serving

Buckets are private by default. Public serving is something you enable deliberately, for a specific bucket. Content you make public is content you are publishing, and you are its publisher.

Everything in Sections 4 and 5 applies to public content. In addition:

Content served publicly must not be malware, a phishing page, or a scam. We act on these immediately, because they put visitors at risk and because they get domains blocklisted.
Sites served on our shared domain, stormsites.ca, are held to a stricter standard than sites on your own custom domain. One abusive site on a shared domain can cause the whole domain to be blocklisted by security vendors, browsers, and mail providers, which would take down every other customer's site at the same time. Where we believe a site puts the shared domain at risk, we may remove it from the shared domain immediately and without prior notice. A site on your own custom domain carries its own reputation, and we will normally give you notice before acting.
You are responsible for your site's own obligations to its visitors, including any privacy notice your site needs.

8. Copyright

You may not use Storm Buckets to store, publish, or distribute a work protected by copyright unless you hold the rights, you have the rights holder's permission, or your use is otherwise permitted by law.

Canada's notice-and-notice regime under the Copyright Act governs how we handle copyright complaints. Send a copyright notice to abuse@stormdevelopments.ca. Section 10 describes what to include and what happens next.

We keep an internal record of the copyright notices we receive and act on. Accounts of repeat infringers will be terminated in appropriate circumstances.

9. Child Sexual Abuse Material

There is no warning here, no strike count, and no discretion.

Where we become aware of child sexual abuse material on Storm Buckets, we report it to the Canadian Centre for Child Protection through Cybertip.ca and to law enforcement, as Canadian law requires. We preserve the associated data for the period the law requires and we do not delete it during that period, even if the account has been closed. We terminate the account.

If you find this material on Storm Buckets or on a site we serve, report it to abuse@stormdevelopments.ca. If you encounter it elsewhere on the internet, report it directly to Cybertip.ca.

10. Reporting a Violation

Report violations of this policy to abuse@stormdevelopments.ca.

Tell us what you found, where you found it (a URL or a bucket address), and how to reach you. If you are reporting on behalf of someone else, tell us who and in what capacity.

For a copyright notice, also identify the work you hold rights in and your relationship to it.

We acknowledge every report within 48 hours of receiving it. What happens after the acknowledgement depends on what was reported. Illegal content and active threats to people are handled immediately. Copyright complaints follow the notice-and-notice process under the Copyright Act, which means we forward a valid notice to the customer responsible for the material. Forwarding a notice is not a finding that the complaint is correct. Other violations follow Section 11.

11. How We Respond

We use the least disruptive action that resolves the problem. Depending on what we find, we may:

Contact you and ask you to correct it.
Make specific content private, or disable public serving for a bucket or a site.
Restrict a bucket, which freezes access to it without deleting anything.
Remove specific content.
Suspend your account.
Terminate your account.

We will normally contact you first and give you a reasonable opportunity to respond. We act immediately and without prior notice where the content or conduct is unlawful, where it endangers a person, where it threatens the security or integrity of the service or of another customer, or where the law requires us to.

We will tell you what action we took and why, unless telling you is prohibited by law, would compromise an investigation, or would put someone at risk.

Repeated violations of this policy will result in termination, whether or not any single violation would have.

12. Preservation

Where the law requires us to preserve content, we preserve it. This overrides deletion.

Preservation applies even where you have closed your account or asked us to delete the data. We keep only what the law requires, only for as long as it requires, and then we delete it. Our Privacy Policy describes our ordinary retention periods and this exception to them.

13. Monitoring

We do not monitor or inspect the content our customers store.

We have the right, but not the obligation, to investigate a report or a suspected violation of this policy, and to take the actions described in Section 11. Nothing in this policy places us under a duty to monitor the service, and we do not accept responsibility for a customer's misuse of it.

14. Contact

Questions about this policy:
contact@stormdevelopments.ca

Reports of abuse or violations:
abuse@stormdevelopments.ca

Storm Developments
Ontario, Canada