Terms of Service

Version 3.2 (draft) · Last updated 18 May 2026 · Effective Date: pending — see draft banner above

At a glance

• You can sign up to GasPackᵐ if you have the legal capacity to enter a contract.
• You can publish open-source packages to the public registry, and you can install packages from it. Anything you publish must be yours to publish, under an open-source licence.
• You keep ownership of everything you publish. You grant us the limited licence we need to host it, serve it, and let other people install it.
• Packages on the registry are published by other users. We run security scans, publish security grades, and take down malicious Packages — but ultimately you choose what to install and you accept the risk. Review the source. See Section 7.5.
• Don't upload malware. Don't try to break the service. Don't impersonate other people. Don't infringe other people's rights. Full acceptable-use rules in Section 8.
• The service is provided as-is. To the extent the law allows, our liability is limited to what you've paid us in the last 12 months — and the service is currently free.
• If you're a school using GasPackᵐ with K-12 students, the educational protections in Section 15 apply, and we will sign a Data Processing Agreement.
• We are a United States company. United States law governs this contract. If you are outside the US and choose to use the service, you do so on that basis — see Section 24.
• If you don't agree with these Terms, please don't use the service.

1. Acceptance and the parties

These Terms of Service form a binding contract between you and VelocityDog, a United States company (the exact legal entity form will be identified here once entity formation is complete and counsel has reviewed this document). In this document, "GasPackᵐ", "we", "us", and "our" mean VelocityDog as the operator of the GasPackᵐ public registry, the gpm command-line tool, the GasPackᵐ Chrome extension and IDE integrations, our APIs, our documentation, and our public website (together, the "Service").

By creating an account, installing the CLI, installing the extension, calling our API, or otherwise accessing the Service, you agree to these Terms. If you do not agree, you may not use the Service.

If you are accepting these Terms on behalf of an organisation (a company, a school, a district), you represent that you have the authority to bind that organisation, and "you" means both you personally and that organisation.

These Terms incorporate by reference our Privacy Policy, the Acceptable Use Policy in Section 8, the DMCA policy in Section 10, and — for K-12 educational deployments — the educational addendum in Section 15.

2. Definitions

• "Account" — the credential we issue you to use the Service.
• "Content" — any data, code, text, or files that you submit to, publish on, or transmit through the Service.
• "Package" — a unit of software code (source files, manifest, documentation, metadata) that is published to or installable from the GasPackᵐ public registry.
• "Public Registry" — the publicly accessible portion of the GasPackᵐ package registry.
• "Open-Source Licence" — a software licence approved by the Open Source Initiative (OSI) and listed at opensource.org/licenses, or another licence we explicitly accept in writing.
• "User" — any natural person who accesses the Service.
• "Educational User" — a User who is a student, parent, educator, or school administrator using the Service in connection with a K-12 school or district. See Section 15.

3. Eligibility

To use the Service you must:

• Have the legal capacity to enter into a contract under the law of your jurisdiction;
• Be at least 13 years old (and be using the Service under a school authorisation under Section 15 if you are between 13 and the age of digital consent in your jurisdiction);
• Not be located in, organised under the laws of, or a resident of, any country subject to a comprehensive US embargo (as of the date of these Terms: Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, Luhansk, Kherson, and Zaporizhzhia regions of Ukraine);
• Not be a person identified on the US Treasury Department's Office of Foreign Assets Control (OFAC) Specially Designated Nationals list, the US Bureau of Industry and Security Entity List, or any equivalent US restricted-party list;
• Not be barred from receiving software services under the laws of the United States.

We may verify your eligibility at any time and we may suspend or terminate your Account if we reasonably believe you do not satisfy these requirements.

4. Accounts and security

4.1 Creating an Account

Creating an Account requires an email address and either a single sign-on credential from a supported identity provider (currently Google) or a password. We may require you to verify your email address before you can publish Packages.

4.2 Your responsibility

You are responsible for:

• Keeping your credentials confidential;
• Enabling and maintaining two-factor authentication where available;
• All activity that takes place under your Account, except activity caused by our negligence or a security failure on our side;
• Notifying us immediately at security@gaspackm.org if you suspect that your Account has been compromised, that a publish token has been leaked, or that any unauthorised person has gained access.

4.3 One human, one Account

You may not create multiple Accounts to evade rate limits, suspensions, or any other restriction we have imposed under these Terms. Organisations may create separate Accounts for distinct teams.

4.4 Inactive Accounts

We may close an Account that has been inactive for 24 consecutive months, after giving you at least 30 days' email notice and a chance to log in to keep it active. Closing the Account does not unpublish Packages you have published; those remain on the Public Registry under the original publisher handle unless you have asked us to unpublish them in line with Section 7.5.

5. The Service

5.1 What we provide

GasPackᵐ is a package registry and developer toolchain for Google Apps Script. The Service lets you discover, install, publish, and manage reusable code units ("Packages") for use in your Apps Script projects, and provides a CLI, web UI, and IDE integration to help you do that. The exact features available at any point are described at gaspackm.org.

We may add features, change features, and remove features. If we remove or materially reduce a feature on which you have come to rely, we will give you reasonable advance notice, unless removing it sooner is necessary for security, legal, or safety reasons.

5.2 What we do not provide

The Service is not a backup service for your code, not a hosting service for arbitrary files, not a private repository for code you do not intend to publish under an open-source licence, and not a substitute for your own version control. We do not promise that any Package you publish will remain available indefinitely. You are responsible for keeping your own copies.

5.3 Service availability

During the early-launch period and any feature labelled "beta", "preview", or "experimental", the Service is provided on a best-effort basis. We do not commit to a specific uptime target. If we publish a separate Service Level Agreement for paid plans in the future, that SLA will be linked from these Terms when it exists.

6. Your Content and the licence you grant us

6.1 You keep ownership

You own your Content. Nothing in these Terms transfers ownership of your Content to us. We make no claim to copyright, patent, trademark, or any other intellectual-property right in your Content beyond the limited licence you grant us in this Section.

6.2 The licence you grant to us

To run the Service we need permission to do certain things with your Content. You grant us a worldwide, non-exclusive, royalty-free, fully paid-up, sublicensable licence to host, store, reproduce, modify (only as needed to format, index, and serve), create derivative works (only as needed to generate metadata and search indexes), publish, publicly display, publicly perform, transmit, and distribute your Content for the sole purpose of operating, providing, and improving the Service. This licence ends when you remove the Content from the Service, except for backup copies that we will overwrite within our standard 35-day retention cycle, and except for cached or mirrored copies held by third parties beyond our control.

We do not use your Content to train artificial-intelligence or machine-learning models. We do not sell your Content. We do not licence your Content to third parties for purposes unrelated to operating the Service.

6.3 The licence you grant to other Users when you publish

When you publish a Package to the Public Registry, you must publish it under an Open-Source Licence that permits the Service and its users to download, use, modify, and redistribute the Package in line with that licence. The licence must be:

1. Listed in the Package's manifest as an SPDX identifier;
2. Included in the Package itself (typically as LICENSE or LICENSE.md);
3. Compatible with public redistribution.

If you publish a Package without a recognised licence, we will treat it as published under the MIT licence with attribution to your published username, and we may at our discretion either ask you to add a licence or remove the Package.

6.4 Your representations and warranties about Content

By submitting any Content to the Service, you represent and warrant that:

• You own the Content, or you have all rights, licences, consents, and permissions necessary to grant the licences in Sections 6.2 and 6.3;
• Your Content does not infringe, misappropriate, or violate any third party's intellectual property, privacy, publicity, contract, or other rights;
• Your Content does not violate any law;
• Your Content does not contain malware, an exploit, or hidden functionality intended to harm Users, their systems, the Service, or any third party;
• You will not publish secrets, credentials, API keys, passwords, personal information of any third party, or any other data that you do not have the right to make public;
• If your Content is or includes a Package, the Package's manifest accurately describes its dependencies, its runtime, its scopes, and its required permissions.

6.5 Removing Content

You may remove your Content from the Service at any time by unpublishing the Package or deleting your Account. We will action your request and remove the canonical copy from our infrastructure within 30 days, with these qualifications:

• Versions of a Package that are widely depended on by other Packages may be retained as a "tombstone" with a security-advisory marker, so that downstream consumers see a clear notice — this is necessary to protect the open-source supply chain from breakage;
• Caches, mirrors, and downstream copies held by third parties are outside our control;
• We will retain the Package metadata that the Public Registry needs to serve a tombstone (the Package name, the unpublished version numbers, and the unpublish date) indefinitely.

If you have a legal basis to require complete removal — for example, an enforceable takedown right under copyright law or a court order — write to legal@gaspackm.org and we will follow the process described in Section 10.

6.6 Feedback

If you send us suggestions, ideas, bug reports, or feature requests ("Feedback"), you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use the Feedback for any purpose without obligation or compensation to you. You are not required to send us Feedback.

7. Security mandate

GasPackᵐ is a security-first registry. We run static-analysis security scans on every published Package and we publish a security grade alongside it. You agree not to:

• Publish malicious code, malware, droppers, or "logic bombs";
• Engage in typosquatting (registering Package names confusingly similar to popular Packages to misdirect users);
• Engage in dependency-confusion attacks against the registry or its users;
• Bypass, manipulate, or attempt to defeat our automated security scanners;
• Obfuscate code in a Package to evade scanner detection.

Enforcement: we reserve the right to remove (take down) any Package that fails a security scan or that we reasonably believe is a threat to the ecosystem, with the procedure described at our published takedown runbook. Taken-down Packages return HTTP 410 Gone with the takedown reason, and the takedown is recorded in our admin audit log.

7.5 Installing and using Packages from the Public Registry

When you install a Package from the Public Registry, you are installing third-party code published by another User. By choosing to install it, you accept the following.

What we do. We run automated security scans on every published Package and publish a security grade for it. We will remove (take down) Packages that we determine to be malicious. We provide tools (gpm verify, gpm audit) to help you inspect a Package before installing it.

What we do not do. We do not pre-screen, hand-review, or audit the code in published Packages. The security grade is a signal generated by automated scanning — it is not a guarantee that a Package is safe, free of bugs, free of vulnerabilities, or fit for any particular purpose. Any scanner reports we surface about possible vulnerabilities are not guaranteed to be comprehensive.

What you accept. Installing a Package from GasPackᵐ is at your own risk. You are responsible for reviewing the source code, the security grade, and the publisher before installing. We are not liable for damage, loss, or claims arising from any Package you choose to install.

How to install carefully. We strongly recommend you:

• Review the security grade and the source code of every Package before adding it as a dependency;
• Use gpm verify <package> to inspect publisher reputation, version history, and scanner findings;
• Pin specific versions in your project's lock file rather than relying on an unpinned latest;
• Be especially careful with low-grade Packages, deeply nested dependencies, and Packages from publishers you do not recognise.

This Section 7.5 does not reduce the limitation of liability in Section 19, and the disclaimers in Section 18 still apply. It is a specific, positive-framed expansion of those general protections for Package installation.

8. Acceptable Use Policy

You may not, and you may not permit anyone else to, use the Service to:

1. Harm people, systems, or networks. Upload, host, or distribute malware, ransomware, spyware, rootkits, trojans, viruses, worms, exploits, or any other code designed to disable, damage, gain unauthorised access to, or interfere with any computer, system, network, or data.
2. Attack the Service. Probe, scan, stress-test, or reverse-engineer the Service except to the extent expressly permitted by mandatory law; attempt to bypass any rate limit, authentication, authorisation, or quota mechanism; perform a denial-of-service attack of any kind; circumvent the abuse controls in the CLI, the registry, or the API.
3. Smuggle harmful content into Packages. Publish a Package whose advertised behaviour differs from its actual behaviour, includes obfuscated or hidden code, includes a backdoor, exfiltrates data without disclosure, persists itself, escalates privileges, or installs additional Packages without the User's consent.
4. Publish data that is not yours to publish. Publish secrets, credentials, API keys, private keys, tokens, third-party personal information, or copyrighted material without authorisation. Republish another User's Package as your own without complying with its licence.
5. Impersonate or deceive. Impersonate any person, organisation, or Package; use a Package name that is confusingly similar to a well-known Package; misrepresent your affiliation with any person or organisation.
6. Spam. Send or facilitate unsolicited bulk messages, scrape User profiles for marketing, or use the Service to harvest contact information.
7. Break the law. Use the Service for any purpose that is unlawful in your jurisdiction or in ours; export the Service or any Content in violation of US export controls or sanctions; process personal information in violation of any applicable privacy law.
8. Hate, harassment, and abuse. Publish, host, or distribute Content that promotes violence against, threatens, or harasses any person or group based on race, ethnicity, national origin, religion, sex, gender identity, sexual orientation, disability, age, or any other protected characteristic; that constitutes child sexual abuse material; or that constitutes non-consensual intimate imagery.
9. Use the Service against students or schools. Use the Service in any way that violates FERPA, SOPIPA, COPPA, or the substantive student-privacy laws of any US state, or that is inconsistent with the educational protections in Section 15.
10. Resell the Service. Resell, sublicense, or commercially redistribute the Service itself (as distinct from your own Packages) without our prior written agreement.

Where appropriate we will warn you, restrict your access, remove offending Content, suspend your Account, terminate your Account, refuse future Accounts, refer the matter to law enforcement, or take any combination of these actions.

9. Reporting illegal or abusive content

If you believe any Content on the Service is illegal or violates the Acceptable Use Policy, send a notice to abuse@gaspackm.org. Your notice should include:

• An explanation of why you believe the Content is illegal or abusive;
• A clear indication of the exact location of the Content (the Package name and version, or the URL);
• Your name and email address;
• A statement confirming your good-faith belief that the notice is accurate.

We will acknowledge receipt without undue delay, assess the notice, and inform you of our decision. We will give the affected User a statement of reasons for any restriction we impose on their Content.

10. Copyright and the DMCA

We respect the intellectual property of others and we expect Users to do the same. We comply with the Digital Millennium Copyright Act (17 U.S.C. §512).

10.1 Submitting a DMCA notice

If you believe that Content on the Service infringes your copyright, send a written notice to our designated agent that includes:

• A physical or electronic signature of the copyright owner or an authorised agent;
• Identification of the copyrighted work claimed to have been infringed;
• Identification of the infringing material and information sufficient for us to locate it (the Package name, version, and file path);
• Your contact information (address, telephone number, email);
• A statement that you have a good-faith belief that the use is not authorised by the copyright owner, its agent, or the law;
• A statement, made under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorised to act on its behalf.

Send your notice to our designated DMCA agent. The agent's designation is registered with the United States Copyright Office under registration number DMCA-1072983:

10.2 Counter-notice

If we remove your Content in response to a DMCA notice and you believe the removal was a mistake or misidentification, you may file a counter-notice with the same agent. Your counter-notice must include the elements required by 17 U.S.C. §512(g)(3).

10.3 Repeat infringers

We will terminate, in appropriate circumstances, the Accounts of Users who are repeat infringers.

11. Trademarks

"GasPack", "GasPackᵐ", "VelocityDog", the GasPackᵐ logo, and other GasPackᵐ marks are trademarks of VelocityDog. You may not use them without our prior written permission, except for nominative fair use (for example, to truthfully say that your Package is compatible with GasPackᵐ).

If a third party's trademark is used in a Package name in a way that confuses users about the source of the Package, the trademark owner may submit a Trademark Dispute Notice to legal@gaspackm.org and we will follow the same process as for DMCA notices, adapted to trademark law.

12. Third-party services

The Service depends on, integrates with, and links to third-party services — including Google Apps Script, the Google Workspace platform, the Chrome Web Store, the Google Workspace Marketplace, GitHub, and the npm registry. Your use of those services is governed by the terms and policies of each provider. We are not responsible for the availability, content, accuracy, security, or practices of any third-party service.

When you grant the Service permission to act on your behalf with a third-party service (through OAuth, for example), you authorise the Service to take the specific actions described at the time of authorisation. You may revoke that authorisation at any time through our settings and the third party's controls.

13. Privacy

Our Privacy Policy explains what personal information we collect, how we use it, and the rights you have over it. By using the Service you acknowledge our Privacy Policy and agree that, to the extent we process your personal information as a controller, that processing is governed by the Privacy Policy.

If you are a school using the Service to process personal information of students, the K-12 educational addendum applies and we will sign a Data Processing Agreement.

14. Children under 13

The consumer Service is not directed to children under 13, and we do not knowingly create Accounts for children under 13 in a consumer context. If we learn that we have created such an Account, we will close it and delete the associated personal information in line with our Privacy Policy. The only context in which a child under 13 may use the Service is the educational context described in Section 15, and only with the appropriate school authorisation under the COPPA School Authorisation guidance from the Federal Trade Commission.

15. Educational use (K-12, FERPA, SOPIPA)

This Section 15 applies when GasPackᵐ is used in connection with a K-12 school or district. It is incorporated into these Terms automatically and overrides any conflicting provision elsewhere in these Terms with respect to Educational Users.

15.1 Roles

When GasPackᵐ is used by an Educational User in the course of school activities, the school is the controller of the personal information of its students. We act as:

• A "school official" with a "legitimate educational interest" under FERPA (34 CFR §99.31(a)(1)(i)(B)), performing an institutional service that the school would otherwise have to provide for itself, under the direct control of the school with respect to the use and maintenance of education records, and using education records only for the authorised institutional purpose;
• A "service provider" under the California CCPA/CPRA, prohibited from selling, sharing, or retaining personal information for any purpose other than performing the services specified in the school's contract;
• A "school service provider" or equivalent under California SOPIPA (Cal. Bus. & Prof. Code §22584), the Connecticut student data privacy statute, the Colorado Student Data Transparency and Security Act, the Illinois Student Online Personal Protection Act, the Texas student-privacy provisions, and equivalent statutes in other US states.

15.2 Our binding educational commitments

Regardless of any other provision of these Terms, with respect to personal information of Educational Users we will:

1. Not sell student personal information. Ever.
2. Not use student personal information to serve advertising of any kind.
3. Not use student personal information to build a profile of a student for any purpose other than the authorised educational purpose specified by the school.
4. Not use student personal information to train artificial-intelligence or machine-learning models — including our own models, our service providers' models, or any third party's models.
5. Not retain student personal information beyond the period necessary to provide the Service to the school, and delete it on the school's instruction or when the school's contract ends.
6. Apply the security measures described in our Privacy Policy and in our K-12 Data Processing Agreement to all student personal information.
7. Honour parental access rights through the school where required by FERPA, and respond to a school's data-subject requests within 30 days.
8. Notify the school without undue delay (and in any event within 48 hours) of any unauthorised access to or disclosure of student personal information held on our infrastructure.
9. Sign the school's reasonable Data Processing Agreement, the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement, or our standard K-12 DPA, on request.
10. Subscribe to the substantive commitments of the Student Privacy Pledge.

15.3 The school's responsibilities

By using the Service in an educational context, the school confirms that:

• It has the authority to permit its students to use the Service and, where the student is under 13 in a US K-12 context, that the school's authorisation satisfies COPPA's School Authorisation pathway as described in the FTC's COPPA guidance for ed-tech;
• It will provide and obtain (from parents) any notices and consents required by FERPA, COPPA, SOPIPA, Section 504, the IDEA, and any other applicable law before directing students to use the Service;
• It will not direct GasPackᵐ to process categories of student data that we have not agreed to receive — in particular sensitive personal information under the CCPA/CPRA or directory information that the school has not properly designated as such under FERPA;
• It is responsible for the choices of its educators about what student work to publish through the Service.

15.4 K-12 Data Processing Agreement

Our standard K-12 DPA is available on request from edu-privacy@gaspackm.org. When executed by an authorised representative of the school or district, it forms part of these Terms with respect to that school.

16. Fees and paid plans

The Service is currently free of charge. If we introduce paid plans, we will describe each plan, its features, its price, its billing cycle, and its renewal terms at the point of purchase. We will comply with the California Automatic Renewal Law, the federal Restore Online Shoppers' Confidence Act (ROSCA), and equivalent US state laws — including by providing clear cancellation mechanisms and renewal reminders. You will not be billed for the Service unless and until you choose a paid plan and authorise the charge.

17. Suspension and termination

17.1 Termination by you

You may stop using the Service at any time and you may delete your Account at any time. Deleting your Account will close your access to the Service and will trigger the deletion process described in our Privacy Policy. Sections of these Terms that by their nature should survive termination — including Sections 6.5, 6.6, 8, 10, 11, 18, 19, 20, 21, 23, 24, and 25 — survive.

17.2 Termination or suspension by us

We may suspend or terminate your Account or restrict your access to the Service if:

• You materially breach these Terms (including the Acceptable Use Policy) and either the breach cannot be cured or you have not cured it within a reasonable time after we have asked you to;
• We are legally required to do so by a competent US authority;
• Continued provision of the Service to you would expose us, our other Users, or the public to a serious security or safety risk;
• We discontinue the Service in your jurisdiction, in which case we will give you reasonable advance notice and an opportunity to retrieve your Content.

17.3 What termination does to your Packages

Termination of your Account does not automatically unpublish your Packages — see Section 6.5. We will, on request, unpublish your Packages under that Section.

18. Disclaimers

THE SERVICE AND ALL CONTENT MADE AVAILABLE THROUGH THE SERVICE ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL IMPLIED WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT ANY PARTICULAR PACKAGE IS FREE OF DEFECTS, MALWARE, OR INFRINGEMENT. THE PUBLIC REGISTRY HOSTS USER-PUBLISHED CODE AND YOUR USE OF ANY PACKAGE IS AT YOUR OWN RISK. WE STRONGLY RECOMMEND THAT YOU REVIEW PACKAGE SOURCE BEFORE INSTALLING IT, AND THAT YOU USE THE SECURITY-SCANNING FEATURES OF THE SERVICE.

19. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW:

1. No indirect damages. In no event will we be liable to you for any indirect, incidental, special, consequential, exemplary, or punitive damages, including damages for loss of profits, revenue, business, goodwill, data, or other intangible losses, arising out of or in connection with these Terms or the Service, even if we have been advised of the possibility of such damages.
2. Cap on direct damages. Our total cumulative liability to you arising out of or in connection with these Terms or the Service, regardless of the cause of action, will not exceed the greater of (a) the amount you have paid us for the Service in the 12 months immediately preceding the event that gave rise to the claim, and (b) one hundred US dollars (US$100).
3. Allocation of risk. You acknowledge that the limitations and exclusions in Sections 18 and 19 reflect a fair allocation of risk, and that we would not be able to provide the Service on the current terms without them.
4. Carve-outs. Nothing in Sections 18 or 19 limits or excludes our liability for (a) death or personal injury caused by our negligence; (b) fraud or fraudulent misrepresentation; (c) gross negligence or wilful misconduct; (d) any liability that cannot, as a matter of law, be limited or excluded; or (e) any liability under a separate K-12 Data Processing Agreement, which is governed by its own liability terms.

20. Indemnification

To the extent permitted by law, you agree to defend, indemnify, and hold harmless VelocityDog and its officers, directors, employees, contractors, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or related to:

• Your Content;
• Your use of the Service in breach of these Terms or any applicable law;
• Your violation of any third party's rights (including intellectual-property and privacy rights);
• Your violation of the Acceptable Use Policy.

We will give you prompt notice of any claim for which we seek indemnification, allow you to control the defence (provided you do not settle without our written consent for any settlement that imposes obligations on us), and reasonably co-operate with you in the defence.

21. Export controls and sanctions

The Service and any Package downloaded through it may be subject to US export-control and sanctions laws, including the US Export Administration Regulations. You agree to comply with all such laws. You will not use, export, re-export, transfer, or release the Service or any Package, directly or indirectly, in violation of those laws, and you will not make the Service or any Package available to any restricted party identified in Section 3.

22. Modifications to these Terms

When we make a material change to these Terms, we will:

• Update the "Last updated" date at the top of these Terms;
• Post the new version on our website;
• Email every Account holder at least 30 days before the new version takes effect, except where an immediate change is required by law, by an active security incident, or by a change to a third-party service on which the Service depends.

If you do not agree with the modified Terms, you may stop using the Service and delete your Account before the effective date. Your continued use after the effective date constitutes acceptance.

We will not modify these Terms in a way that retroactively reduces your rights with respect to Content you have already submitted, or in a way that retroactively narrows the licence we have granted you to use Packages you have already installed.

23. International users

GasPackᵐ is a United States service. If you are outside the United States and you choose to use the Service, you do so understanding that:

• These Terms are governed by United States law and by the law of the State of Texas, as set out in Section 24;
• Your data will be transferred to and processed in the United States. By using the Service you consent to this transfer. Where applicable, we rely on legally provided mechanisms — including the European Commission's Standard Contractual Clauses and equivalent transfer instruments — to lawfully transfer personal data across borders. See our Privacy Policy §10 for details;
• If your local consumer-protection law grants you mandatory non-waivable rights, those rights are not displaced by these Terms; they apply to the extent the law of your jurisdiction makes them apply.

24. Governing law and dispute resolution

24.1 Governing law

These Terms, and any dispute arising out of or in connection with them, are governed by the laws of the State of Texas, United States, without regard to its conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

24.2 Venue

Subject to Section 24.3, the state and federal courts located in [Texas county TBD on counsel review] have exclusive jurisdiction to hear any dispute arising out of or in connection with these Terms.

24.3 Consumer rights carve-out

If you are a consumer in a US state or in a foreign country whose law grants you mandatory non-waivable rights — including the right to bring proceedings in the courts of the country where you live, or the right to small-claims-court access — nothing in this Section 24 deprives you of that protection.

24.4 Informal resolution first

Before either party files suit, the parties agree to make a good-faith effort to resolve the dispute by writing to legal@gaspackm.org (if the User is bringing the claim) or to the User's registered email (if we are bringing the claim) and conferring for at least 30 days.

25. Miscellaneous

• Entire agreement. These Terms, together with the Privacy Policy, the K-12 DPA where applicable, and any separately executed order form, constitute the entire agreement between you and us about the Service, and they supersede all prior agreements and understandings about the same subject matter.
• No waiver. Our failure to enforce any provision of these Terms is not a waiver of our right to enforce it later.
• Severability. If any provision of these Terms is held to be unenforceable, that provision will be enforced to the maximum extent permitted, and the remaining provisions will remain in full force.
• Assignment. You may not assign or transfer these Terms without our prior written consent. We may assign these Terms to an affiliate or to a successor in connection with a merger, acquisition, reorganisation, or sale of substantially all of our assets, on notice to you.
• No agency. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between you and us.
• Force majeure. Neither party will be liable for any failure or delay in performance caused by events beyond its reasonable control.
• Notices to you. We will give you notices required under these Terms by email to the address associated with your Account or by posting on the public website.
• Notices to us. Legal notices to us must be sent to legal@gaspackm.org.
• Headings. Headings are for convenience and do not affect interpretation.
• Language. These Terms are written in English. Any translation we provide is for convenience only; the English version controls.

26. Contact

For questions about these Terms: legal@gaspackm.org

For abuse and content reports: abuse@gaspackm.org

For DMCA notices: dmca@gaspackm.org

For security reports: security@gaspackm.org

For privacy questions: privacy@gaspackm.org

For school-specific questions and DPAs: edu-privacy@gaspackm.org