Create a Helmsay account

DRAFT - pending attorney review These terms are a draft for [COMPANY LEGAL NAME], which expects to be a Washington limited liability company. They are not legal advice and they are not in effect until an attorney has reviewed them and the company adopts them. Words like "Helmsay", "we", and "us" mean [COMPANY LEGAL NAME]. "You" means the person who creates an account or uses the Helmsay desktop app, the Helmsay server, or the Helmsay website. Helmsay is a Windows desktop app for building VRChat and VTuber avatars. The public contact address is support@helmsay.com. [COMPANY LEGAL NAME], [COUNTY], and [CONTACT EMAIL] in this draft are TODO placeholders. 1. The app and the website These terms cover the Helmsay desktop application and the Helmsay server and website, including accounts, the public gallery, cloud sync, and paid plans. If you use Helmsay, you agree to these terms, the Privacy Policy, the Acceptable Use & Content Policy, and the Copyright/DMCA Policy. Those documents are separate. You accept each one on its own. 2. You must be 16 or older You must be 16 or older to create an account or to use Helmsay. By checking the age box you say that you are 16 or older. We do not direct Helmsay at children under 16. 3. The license we give you We give you a personal, limited, non-exclusive, non-transferable, revocable license to install and use the desktop app, and to use the website and server, for your own avatar work. Paid features follow the plan you buy. We keep all rights we do not expressly give you. Helmsay, the app, and the website are licensed, not sold. 4. What you may not do Except where a law says we cannot stop you, you will not: - reverse engineer, decompile, or disassemble the app or the server - crack the app, bypass a license check, or share a way to do that - resell, rent, sublicense, or redistribute the app or a paid plan - scrape Helmsay to build or train a competing product - copy the app except for one normal backup of your own install - remove a copyright or draft notice If a law in your area lets you reverse engineer for interoperability, that law controls that narrow activity. It does not let you crack a license or republish the app. 5. Your content and the gallery You keep ownership of the avatars, text, images, and other material you create. If you share a gallery post, you give [COMPANY LEGAL NAME] a non-exclusive, royalty-free license to host, store, reproduce, and display that post and its preview images for as long as the post stays on the service, including in backups we need to run the gallery. You can delete your post. Deleting it ends the public display license going forward. We may keep a copy for a short time where a copyright report, a legal duty, or a backup cycle requires it. You promise that you own or have the rights to anything you upload, including photos, videos, and gallery images, and that your upload does not violate someone else's rights. 6. Acceptable use The Acceptable Use & Content Policy is part of the deal. We may remove content or close an account that breaks it. 7. Copyright complaints The Copyright/DMCA Policy explains how a rights holder sends a takedown notice and how a poster sends a counter-notice. A gallery post that is reported is hidden right away. Unless a reporter confirms a lawsuit, sends proof, or we uphold the report, the post is published again after 14 days. That window is the same one described in the gallery rules (HELMSAY_GALLERY_RESTORE_DAYS, default 14). 8. Accounts You are responsible for your password and for what happens under your account. Give us accurate account information. We may refuse a name, close an account, or end a session if you break these terms, if we must do so to follow the law, or if the account is unused and unverified. An account that never confirms its email is deleted after 24 hours. You may stop using Helmsay at any time and ask us to delete the account. 9. Subscriptions, trials, and refunds Paid plans are sold through Paddle. Paddle is the merchant of record. Paddle charges you, handles tax and receipts, and handles refunds under Paddle's buyer terms. You enter card details on Paddle's pages. Helmsay does not receive your full card number. A free trial, when we offer one, does not ask for a card. Trials are one per account. Managing or canceling a paid plan happens in Paddle's customer portal. Canceling stops the next renewal. Access for a period you already paid for lasts until that period ends, unless a full refund or a chargeback removes it sooner. We do not control Paddle's refund decision. Render-minute credits, when cloud render packs are offered, do not expire. A failed cloud render job is refunded automatically. Cloud render is not sold as a dollar balance. A customer in the European Union may withdraw from unused credit within 14 days. Asking Helmsay to start a cloud render, or spending the credit, is consent that this withdrawal right ends for the credit that was used. Unused credit in that 14-day window can still be withdrawn by emailing support@helmsay.com. 10. AI-generated output and third-party tools Helmsay helps you run third-party tools, including AI model, texture, and voice tools, Blender, Unity, and VRChat's pipeline. Output can be wrong, incomplete, or similar to someone else's work. You decide whether to use it. Third-party tools and services have their own terms and their own outages. VRChat, Steam, and Unity can change their software, limits, or rules. We do not control those companies and we do not promise that a project you make today will upload or perform the same way later. 11. Disclaimers THE APP, THE WEBSITE, THE SERVER, AND ALL OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE EXTENT THE LAW ALLOWS, WE DISCLAIM WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT AI-GENERATED OUTPUT IS ACCURATE, ORIGINAL, OR SAFE TO PUBLISH, THAT THIRD-PARTY TOOLS OR SERVICES WILL KEEP WORKING, OR THAT VRCHAT, STEAM, OR UNITY WILL KEEP THE SAME BEHAVIOR. Some places do not allow an "as is" disclaimer. In those places it applies only as far as the law allows. 12. Liability cap TO THE EXTENT THE LAW ALLOWS, [COMPANY LEGAL NAME] AND ITS MEMBERS, WORKERS, AND SUPPLIERS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST DATA, OR LOST GOODWILL. OUR TOTAL LIABILITY FOR A CLAIM ARISING OUT OF HELMSAY WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US IN THE 12 MONTHS BEFORE THE CLAIM AROSE OR (B) $50. THIS CAP DOES NOT APPLY WHERE THE LAW DOES NOT ALLOW IT, INCLUDING LIABILITY THAT CANNOT BE LIMITED FOR WILLFUL MISCONDUCT. 13. Your indemnity You will indemnify, defend, and hold harmless [COMPANY LEGAL NAME] and its members and workers from claims, damages, losses, and reasonable legal costs that come from your content, your uploads, your gallery posts, or your misuse of Helmsay, including a claim that you infringed someone's rights or broke the acceptable use rules. We will tell you about a claim we want you to cover. You will not settle it in a way that admits our fault or binds us without our written OK. 14. Disputes, arbitration, and class actions Please write to [CONTACT EMAIL] first and give us a fair chance to fix the problem. Except for the small-claims option below, you and [COMPANY LEGAL NAME] agree that any dispute, claim, or controversy arising out of these terms or Helmsay will be resolved by binding individual arbitration, not in court. The arbitration will be individual only. You and we waive any right to a class action, a class arbitration, a collective action, or a representative action. A court or an arbitrator may not consolidate your claim with someone else's claim. You and we waive a jury trial to the extent the law allows. Either you or we may bring an individual claim in small claims court instead of arbitration, if the claim qualifies and stays in that court. The small-claims court must be in [COUNTY], Washington. The arbitrator will apply Washington law as these terms describe it. The hearing will be in [COUNTY], Washington, or by video if you and we both agree. Either party may ask a court in [COUNTY], Washington for temporary or provisional relief to protect intellectual property or to stop misuse of an account. This arbitration clause survives the end of these terms. A court must decide whether this section is enforceable. If a waiver of class claims is found unenforceable for a particular claim, that claim proceeds in court and the rest of this section still applies to other claims. Counsel must review this section before it is used, including under the Federal Arbitration Act and Washington law. 15. Venue For any dispute that is not arbitrated, including a small claim and any claim a court says cannot be arbitrated, you and we agree to exclusive venue in the state or federal courts located in [COUNTY], Washington, and you consent to personal jurisdiction there. You and we waive objections of inconvenient forum. 16. Attorney fees If a dispute between you and [COMPANY LEGAL NAME] goes to a final judgment or a final award, the prevailing party is entitled to recover its reasonable attorney fees and costs from the other party, in addition to any other relief. This clause is mutual. It is intended to meet RCW 4.84.330, which requires a one-sided fees clause to be treated as mutual. It applies in court and in arbitration. 17. Time limit for claims You and we must bring a claim within one year after the claim arose. If the law does not allow that limit for a particular claim, the shortest time the law does allow applies instead. After that time the claim is barred. 18. Governing law These terms are governed by the laws of the State of Washington, without regard to conflict-of-law rules. The Federal Arbitration Act governs the arbitration agreement to the extent it applies. Washington law governs everything else in these terms. 19. Ending the agreement You may stop using Helmsay at any time. We may suspend or terminate your account or this license if you break these terms, if we are required to by law, or if we discontinue the service. Sections that should survive do survive, including ownership, your content license for material already lawfully kept, disclaimers, the liability cap, indemnity, disputes, fees, the time limit, and governing law. 20. Changes to these terms We may change these terms by posting a new version and changing the version id. If the version changes, you must accept the new version before you continue to use the account. The desktop app shows a blocking dialog. The website does the same. The server rejects continued use until the new version, the content hash, the time, and the client type (desktop or web) are stored for your account. Using an older accepted version is not enough. If you do not agree, stop using Helmsay and ask us to close the account. 21. Severability If a court or arbitrator holds that one part of these terms is unenforceable, that part is severed or narrowed to the minimum extent required, and the rest remains in effect. The class-waiver sentence in the disputes section has its own rule, written there. 22. Contact [COMPANY LEGAL NAME] [COUNTY], Washington [CONTACT EMAIL]

DRAFT - pending attorney review This policy describes what [COMPANY LEGAL NAME] ("Helmsay", "we") actually does with information today. It is a draft for attorney review. It covers the Helmsay desktop app, the server, and the website. Contact: [CONTACT EMAIL]. The company expects to be a Washington limited liability company. Helmsay is a Windows desktop app for building VRChat and VTuber avatars. The public contact address is support@helmsay.com. [COMPANY LEGAL NAME], [COUNTY], and [CONTACT EMAIL] in this draft are TODO placeholders. 1. Accounts When you create an account we store: - your email address and username - a password hash (argon2id for new passwords; an older bcrypt hash is checked and then replaced with argon2id when you sign in) - whether your email is confirmed, and when - the age confirmation (16 or older), the threshold you accepted, and the time - the time you accepted the terms and the privacy policy - a role (user or admin), whether the account is disabled, failed sign-in counts, and lock times - created time, last sign-in, and password-change time We do not store your password itself. Confirmation codes and password-reset codes are 6 digits, kept only as a hash, and they expire after 15 minutes. An account that never confirms its email is deleted after 24 hours. Sessions store only the sha256 of the access token and the refresh token. "Keep me signed in" lasts 30 days of inactivity. A session without that choice lasts 30 minutes. The desktop app keeps the tokens in the operating system's credential store, not in a settings file. We do not write passwords, tokens, codes, emails, or password hashes to logs. Log lines pass through a redaction step first. 2. Policy acceptance records For each acceptance we store the policy name, the version, a hash of the policy text, the time you accepted it, and the client type (desktop or web). We keep that history so we can tell which text you agreed to. When a policy version changes, we ask you to accept the new text before you continue. 3. Billing and Paddle Paid plans are billed by Paddle, the merchant of record. You type card details into Paddle's checkout. Helmsay does not receive your full card number, card expiration, or card security code. Our server stores Paddle customer, subscription, transaction, and price identifiers, subscription status, period end times, and whether a charge was refunded. Webhook processing stores an event id so the same notice is not applied twice. Billing audit rows store an account id, a status, a tier, and a short detail code. They are not a copy of your card. A free trial does not ask for a card. It stores that the account used its one trial. 4. Logs and redaction The desktop app writes a rotating log on your computer under the local Helmsay logs folder. Before a line is written, the app redacts API keys and similar tokens, values assigned to secret fields, email addresses, password hashes, Paddle ids, and file paths under a Windows, macOS, or Linux home directory. Basic mode records warnings. Normal mode records info and warnings. Expert mode can raise the detail. On startup the app deletes managed log files older than 14 days, and if the folder is still over 100 MB it deletes the oldest backups until it is within 100 MB. The server logs account and gallery actions as ids and action names. It does not log emails, passwords, tokens, or copyright-proof text. Server log lines go through the same kind of redaction. 5. Crash reports Crash reports are optional and off until you opt in. The default is to ask you each time. The report dialog shows the exact text that would be sent, with paths, email addresses, keys, and tokens already removed. You can choose Send, Don't send, Always send, or Never ask. Never ask is the same as never send. A report can include the time, app version, Python and Qt versions, the operating system string, the GPU name and VRAM from your last local hardware scan, the project name and active step, the failure origin, the traceback, and the tail of the local log. The same redaction step runs on the whole report. File contents and the session token are not added. Nothing is sent unless you opt in (or you previously chose always send). The server accepts a report only if it is at most 64 KB and the client address is under the rate limit (5 an hour). The address is used only for that in-memory counter. It is not stored. The server redacts the report again and refuses it if a secret or a home-directory path remains. Accepted reports are held in memory only, as the redacted text, the time, and the size. Reports that share a stack signature are stored once, with a count of how many times that signature arrived. An admin view lists the most common crashes. That list has the signature, the count, the time, the size, and a short title from the redacted text. It does not add an account id, an email, a client address, or a file path. Reports are not written to the database or to disk. A process restart drops them. At most the newest 200 distinct signatures stay in memory. 6. Cloud sync Cloud sync is off until you turn it on and pick at least one group (avatar projects, settings, or keyboard shortcuts). The desktop encrypts what it uploads. The server stores the ciphertext and does not decrypt it. The account key is returned to your signed-in app and kept in the credential store. It is not written into the project. These stay on the computer: API keys, passwords, the session token, the refresh token, the device id, your email, and the plan token. Files whose names look like secrets are skipped. You can delete all cloud data for the account from the app. That delete removes the blobs, conflict copies, and the account key. Local projects stay on the computer. Sync is available only on plans that include it, and each plan has a storage cap. 7. Usage statistics Anonymous usage statistics are off unless you opt in. After onboarding, a direct download asks once. You can change the choice later in Settings. Steam builds leave this off and do not ask; you can still opt in from Settings. Turning it off stops further sends. If you opt in, the desktop app keeps coarse feature-usage counters on the computer (how many times a feature such as new project, pause, or help was used) and sends them as one batch, together with the app version and a random install id. The install id is not your email, username, account id, or device id. You can reset it. Resetting starts a new install id, and we cannot link the new one to the old one. You can view the exact text that would be sent before it goes out. We do not send project content, file paths, emails, usernames, account ids, device ids, or anything else that identifies you. Legal documents stay in English; this policy is one of them. The server accepts a batch only under a rate limit (10 an hour from one client address). The address is used only for that in-memory counter. It is not stored. The install id is checked and then dropped. Accepted batches are held in memory only as the counters, the app version, and the time. They are not written to the database or to disk, and they are not tied to an account. A process restart drops them. 8. Gallery If you publish a gallery post we store the title, description, tool names and license notes you included, and one to four preview images. We do not store local paths or job ids. Images are checked from their bytes. We strip EXIF, XMP, IPTC, and comment metadata. A public post shows your username, not your email. A copyright report stores the claimant's name, email, address, optional phone, a description of the work, the good-faith and accuracy statements, and any proof text the claimant sends. Those contact details are shown to admins, not on the public post, and they are not written to the log. The audit trail stores ids, actions, and a short detail code. 9. Diagnostics on your computer Help > Diagnostics builds a health summary (Blender, Unity, GPU, server reachability, plan, app version, log detail). It does not include your email or username. Exporting a diagnostics zip writes a file you choose. That zip is not uploaded. Help > Report a bug can copy a sanitized summary onto your clipboard and open the bug forum in the browser. The forum is a separate site. 10. How long we keep information - Unconfirmed accounts: deleted after 24 hours, along with their sessions, email codes, and acceptance rows. - Email codes: until they are used or they expire (15 minutes). - Sessions: until they expire or you sign out. - Acceptance history: kept with the account so we can show what you accepted. - Billing rows: kept while the account exists so we can tell whether a plan is active. - Server crash reports: memory only, dropped on restart. - Usage statistics: memory only on the server, dropped on restart. Nothing is sent unless you opt in. - Local logs: about 14 days, and a 100 MB cap. - Gallery posts: until you delete them, or longer if a report, the law, or a backup requires it. - Cloud sync blobs: until you delete them or delete the account's cloud data. 11. Deletion and export You can delete your own gallery posts in the app or on the website. You can delete cloud sync data from the app. You can delete local projects and logs on your computer without asking us. You can ask us to delete your account or to export the account data we hold (profile, acceptance history, and billing identifiers we store). Email [CONTACT EMAIL] from the address on the account. We will not ask you to send your password. We may refuse a request we cannot verify, and we may keep information the law requires us to keep, such as records of a payment dispute. There is not a self-serve "delete my account" button yet. Counsel should confirm whether one is required before launch. Closing the account does not by itself delete files that remain on your computer. 12. Washington My Health My Data Act Helmsay is an avatar tool. It is not a health-care service and it does not ask you for diagnoses, medications, reproductive or sexual-health information, or other consumer health data. Photos and videos you import are processed on your computer to build an avatar. We do not label them as health information and we do not use them to identify a health condition. Crash reports and sync payloads are not health records. This draft's position is that the Washington My Health My Data Act does not apply to the data Helmsay collects today. An attorney must confirm that, including whether any photo processing could be treated as biometric data. If a future feature collects consumer health data as that Act defines it, we will update this policy, ask for the consent the Act requires, and require you to accept the new version. 13. California privacy rights If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, may give you the right to know, delete, and correct personal information, and to appeal a refusal. Email [CONTACT EMAIL]. We will verify the request. Helmsay does not sell personal information and does not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. We do not offer a financial incentive for your data. Categories we collect, when you use the service, are identifiers (email, username, account id), commercial information (Paddle plan status and ids, not the card number), internet activity limited to security logs, rate-limit counters, and, only if you opt in, anonymous feature-usage counters that are not tied to your account, and the content you choose to upload. We do not collect precise geolocation. The client address used for rate limits is not written into the account record. 14. Children Helmsay is for people 16 and older. We do not knowingly collect personal information from anyone under 16. If you believe we have, email [CONTACT EMAIL] and we will delete the account. 15. Changes If this policy's version changes, you must accept the new version before you continue, the same way as the terms. The acceptance record stores the new version, the content hash, the time, and whether you accepted it in the desktop app or on the website. 16. Contact [COMPANY LEGAL NAME] [COUNTY], Washington [CONTACT EMAIL]

DRAFT - pending attorney review This policy is part of the Helmsay terms. It applies to the desktop app, the server, and the website. "We" means [COMPANY LEGAL NAME]. Contact: [CONTACT EMAIL]. Helmsay is a Windows desktop app for building VRChat and VTuber avatars. The public contact address is support@helmsay.com. [COMPANY LEGAL NAME] and [CONTACT EMAIL] in this draft are TODO placeholders. 1. Age and accounts You must be 16 or older. One person, one account. You may not share your password, sell your account, or create an account for someone who is not allowed to use Helmsay. You may not bypass a lockout, a rate limit, or an email confirmation. 2. Your uploads You may upload only material you own or have the rights to use. That includes photos, videos, reference images, textures, and audio. Do not upload a real person's face or likeness unless they agreed. Do not upload a copyrighted character, a trademarked design, or someone else's artwork and present it as yours. A local name check in the app is a courtesy reminder. It is not permission and it is not a legal opinion. The checkbox "I own or have rights to anything I upload" is required at sign-up. Checking it is your statement. We do not compare your files to other users' files. 3. Gallery posts A public post must follow this policy. Do not post sexual content involving anyone under 18, non-consensual intimate images, or content that exists to harass a real person. Do not post malware, scam links, or instructions whose purpose is to break into someone else's account. Tool and license notes on a post should be true. 18+ content is off for now. Do not upload, generate, or post sexual content. Do not upload a real person's face or likeness unless that person agreed. We may hide or remove a post that breaks this policy, including after a copyright report under the Copyright/DMCA Policy. 4. No abuse of the service You may not: - probe, scan, or attack the server except through a private report of a real flaw to [CONTACT EMAIL] - send malware or use Helmsay to deliver it - overload the service or work around a rate limit - scrape the gallery or the app to build a competing product - reverse engineer, decompile, crack, or redistribute Helmsay except where the law allows a narrow interoperability step - use another person's account without permission - misrepresent who you are in a copyright notice or a counter-notice 5. AI and third-party tools You are responsible for how you use AI output and for obeying the terms of the third-party tools you run (including Blender, Unity, VRChat, Steam, and hosted generators). Helmsay does not grant you a license to those products. Do not use Helmsay to hide the fact that output came from a tool whose license you do not have. 6. Enforcement We may remove content, refuse a post, end a session, or close an account that breaks this policy or the terms. We may keep an audit row that records the action, the account id, and a short reason code. We do not promise to monitor the gallery. If you think a post breaks this policy and it is not a copyright claim, email [CONTACT EMAIL]. Copyright claims use the Copyright/DMCA Policy, not this inbox alone. 7. Changes A new version of this policy must be accepted before you continue. The server stores the policy name, version, content hash, time, and client type.

DRAFT - pending attorney review This policy matches the gallery process used by the Helmsay server. It is a draft for attorney review, including whether a formal DMCA agent registration is required before launch. "We" means [COMPANY LEGAL NAME]. Contact for copyright notices: [CONTACT EMAIL]. The company expects to be a Washington limited liability company, in [COUNTY], Washington. Helmsay is a Windows desktop app for building VRChat and VTuber avatars. The public contact address is support@helmsay.com. [COMPANY LEGAL NAME], [COUNTY], and [CONTACT EMAIL] in this draft are TODO placeholders. A reported gallery post is hidden immediately. The owner can send a counter-notice. Unless a reporter confirms a lawsuit, sends proof, or the report is upheld, the post is published again after the restore window. 1. Your promise You may post to the gallery only if you own the material or have the rights to post it. Checking "I own or have rights to anything I upload" at sign-up is that promise. Helmsay does not hash one avatar against another. Two similar previews can both remain. 2. Who can report Only a signed-in account with a confirmed email can file a report, and you cannot report your own post. Send the notice from the post's report form or by email to [CONTACT EMAIL] with the same facts. A notice must include: - your name, email, mailing address, and phone if you want to give one - a description of the copyrighted work - the gallery post you mean (the post id or the page URL) - this good-faith statement: "I have a good faith belief that the use of the material is not authorized by the copyright owner, its agent, or the law." - this accuracy statement: "The information in this notice is accurate, and under penalty of perjury I am the copyright owner or authorized to act for the owner." - optional proof of ownership (text) 3. What we do with a report The first report on a published post hides the post immediately and tells the owner. The message names the post id, not the claimant's email. The hold lasts 14 days by default (HELMSAY_GALLERY_RESTORE_DAYS, allowed range 1 to 90). A later report from a different account on that same post joins the hold. It does not move the restore time and does not start a second hold. The same account cannot have two open reports on one post. A removed post cannot be reported again. Claimant contact details are stored for the report and shown to admins. They are not shown on the public post and they are not written to the log. 4. Counter-notice The owner can file one counter-notice while the post is hidden and a report is still open or waiting on detail. The counter-notice asks for the owner's name, address, and consent to jurisdiction. The post stays hidden. Each reporter on that hold is told that a counter-notice was filed. 5. The 14-day restore The reporter can send a case reference (a confirmed lawsuit) or proof while the report is open, waiting on detail, or countered. Either one stops the automatic restore. The post stays hidden. If the restore time passes and no report on that hold is a confirmed lawsuit, proof, or an upheld report, the post is published again and the open reports on that hold expire. This is the 14-day restore. It runs when a gallery page or API route is read, and about once a minute from the server sweep. Running it again does not add another audit row. 6. Admin decisions An admin may ask the reporter for more detail, uphold a report, or reject it. Upholding a report removes the post. A later sweep does not publish it. Rejecting a report publishes the post again only when that hold has no report left open, waiting on detail, countered, confirmed as a lawsuit, or proven. 7. Limits Reports are limited to 5 per account per day and 20 per client address per hour. Sharing is limited to 30 posts per account per hour. Every state change is an audit row: time, actor id, action, post id, report id, from state, to state, and a short detail code. The detail is not the claimant's email, the proof text, or a session token. 8. Misuse A notice or a counter-notice sent in bad faith can itself be unlawful. We may close an account that files repeated bad-faith reports. Repeat counts are available to admins as account ids and counts, not as a public list of avatars. 9. Changes A new version of this policy must be accepted before you continue. The acceptance record stores the policy name, version, content hash, time, and client type (desktop or web).