Acceptable and fair use policy

1.1This policy sets out what StormHost services must not be used for, how to use them fairly towards other customers (fair use) and how we act when it is breached. It is part of the contract under the Terms and Conditions.

1.2The policy applies to all services (VPS, game servers, Discord bot hosting, web hosting, rackhousing, domains, IP addresses, private networks, BGP and the customer API) and to everyone who uses the customer's service – members with shared access, players, website visitors and the customer's clients. The customer is responsible for compliance (clauses 11 and 13 of the Terms).

1.3We apply the rules objectively, proportionately and without discrimination, with due regard to the legitimate interests of everyone involved and to fundamental rights such as freedom of expression.

1.4Our role under the DSA. For VPS, game servers, Discord bots and web hosting we provide a hosting service within the meaning of Regulation (EU) 2022/2065 on digital services (DSA): we store information the customer entrusts to us. We are not an online platform – we do not disseminate customers' content to the public ourselves; the customer decides what to make available and to whom. For rackhousing and internet connectivity we only transmit data. We do not check or systematically monitor content in the services in advance; we act when we become aware of illegal content or a breach of this policy.

2.1It is prohibited to store, distribute or make available in the services, in particular:

• a)child sexual abuse material – without exception; we immediately disable access to it, terminate the service, secure the data for law enforcement authorities and report it to the Police of the Czech Republic;
• b)terrorist content (inciting, glorifying, recruiting for or instructing on terrorist offences) – see clause 8;
• c)content inciting violence or hatred against groups of people, threats and doxxing (publishing someone's personal data to harm them);
• d)fraud, phishing (imitating someone else's login pages or brands), fake online shops and other deception;
• e)content infringing copyright, trademarks or other intellectual property rights (e.g. illegal copies of games, films, music and software, leaked or stolen paid scripts, plugins and maps for game servers), including distribution via BitTorrent and other P2P networks;
• f)offering or selling illegal goods and services (drugs, weapons, counterfeits, stolen data and credentials);
• g)operating gambling for real money or items with monetary value without a licence under Czech law;
• h)personal data processed in breach of the law.

2.2Copyright. We handle notices from rights holders like other notices under clause 14 of the Terms: we assess the content and inform both the notifier and the customer of the outcome. The customer may show that they are authorised to use the content. If a customer infringes rights repeatedly (repeated justified notices), we may suspend or terminate the service under clause 9.

3.1In particular, the following are prohibited:

• a)DDoS attacks, operating “stressers” and “booters”, and load testing of other parties' systems without the demonstrable consent of their operator (your own services with us only by prior arrangement);
• b)port and vulnerability scanning of other networks without their administrator's consent, password guessing (brute force) and intrusion attempts;
• c)spoofing source IP or MAC addresses and using IP addresses not assigned to you;
• d)for rackhousing and BGP, announcing prefixes the customer is not authorised to announce and breaching RIPE NCC rules;
• e)running open services that can be abused for amplification attacks or anonymous abuse (open DNS resolvers, NTP, memcached, SSDP, open proxies and SMTP relays);
• f)Tor exit nodes without prior arrangement; relay and bridge nodes are allowed;
• g)running public VPN or proxy services for third parties without prior arrangement (a VPN or proxy for your own use and for your own business is fine).

3.2Scanning and testing your own services with us is fine as long as it does not restrict other customers. Tell us in advance about a load test that creates a large volume of traffic; otherwise the network protection may treat it as an attack. Internet-wide scanning for security research is only possible by prior arrangement, with meaningful reverse DNS, a description of the purpose and an opt-out for network administrators.

4.1It is prohibited to distribute or host malware, ransomware, spyware and exploits intended for attacks, to run botnet command-and-control (C2) servers, to involve the service in a botnet, and to host tools for unauthorised access (e.g. stolen credentials, “cheats” circumventing the protection of other game servers).

4.2If your service has been compromised and abused without your knowledge, this is also a breach that must be remedied; we will help you with it. Security research is only allowed on your own systems or with the owner's permission.

5.1It is prohibited to send unsolicited commercial communications (spam) and other bulk messages without the recipients' consent, including messages via Discord. Commercial e-mail may only be sent in accordance with Czech Act No. 480/2004 Coll. (with consent or to your own customers, always with an opt-out). Spoofing the sender address is also prohibited.

5.2Anyone running a mail server must have correctly configured reverse DNS, SPF and DKIM, process unsubscribes and bounces, and must not use purchased or harvested address lists.

5.3If spam leaves a service (including because it was compromised), we may block its outgoing mail (port 25) until it is fixed.

5.4Web hosting lets you send mail from website scripts (e.g. forms and notifications) through our mail gateway within the plan's hourly limit (clause 6.9). The gateway rejects messages over the limit; they can be sent once the limit frees up. If an account tries to send more than five times its hourly limit within 10 minutes, the gateway automatically pauses sending, because this is a typical sign of abuse. A person lifts the pause after a check at your request (clause 9.3).

General rules

6.1We state the parameters of a service (vCPU, RAM, disk, number of IP addresses, web hosting limits, port speed) with the service and in the order; you can see the values for your service in the customer account. You may use what your plan includes. The fair use rules only concern long-term load on shared resources that restricts other customers, and use of a service for a purpose it is not intended for.

6.2“No limit” and “unlimited”. We only use these words where we set no plan limit for the parameter. Even then, its use is limited by the actual capacity of the shared server, which customers on the same server share, and by the rules in this clause. On game packages with “CPU unlimited”, the server may use the node's spare capacity, but it is only entitled to the performance stated in the package description.

VPS

6.3A vCPU is a thread of the host server's physical processor assigned to your VPS. VPS of several customers run on one host server. On no plan are processor cores reserved (pinned) for your VPS alone, unless the service expressly says so.

6.4VPS Performance – you may use the assigned vCPUs, RAM and disk fully, including long-term (e.g. game servers, databases, software builds). The procedure under clause 6.13 only applies to load that endangers the stability of the host server (clause 6.6) and to prohibited activities.

6.5VPS Budget has shared CPU performance (we point this out in the order, clause 3.2 of the Terms): several VPS share the processor threads and performance varies with the load of others. Short and longer peaks are fine. If a VPS uses on average more than 50% of all its assigned vCPUs continuously for more than 72 hours and thereby restricts others, we will notify you and offer a move to VPS Performance. If such load continues after a period of 7 days, we may limit the VPS's CPU performance, but to no less than 50% of the assigned vCPUs and only for as long as the load would restrict others.

6.6VPS disk and network. A VPS shares the storage and network connection of the host server. Load that permanently slows down other VPS (e.g. continuous full-speed disk writes for many hours) is handled under clause 6.13.

Game servers and Discord bots

6.7Game servers and Discord bots run on a shared game node. Each package has a technical limit on CPU (e.g. 2 vCPU = the performance of two threads), RAM and disk that the system enforces automatically; within it you may use the performance fully and long-term. The service is intended for running a game server (including a proxy and add-ons the server needs) or a Discord bot. It must not be used to run other applications, such as web hosting for third parties, a VPN or proxy, file sharing, torrents, mass downloading of data from other websites or cryptocurrency mining. The disk is for the server's or bot's data, not for storing backups of other systems or files for download.

Web hosting

6.8Web hosting is intended for running websites and web applications (PHP, MySQL). It must not be used for storing backups or archives of other systems, mass sharing of large files for download, video streaming, running a VPN or proxy, torrents, cryptocurrency mining, or permanently running background processes outside scheduled tasks (cron).

6.9The system enforces web hosting limits automatically. When the CPU, RAM or process limit is reached, the website slows down or the server rejects the request; the service is not suspended because of it. When the storage or file count is full, no more data can be written. Default plan limits as of the effective date of this policy:

You can see the values that apply to your service in the customer account. During the contract we will not lower them without your consent other than by the procedure under clause 17 of the Terms.

Data transfer and connection speed

6.10We do not meter or charge for transferred data and there is no monthly data volume limit. The connection speed is limited, however: the data centre is connected by a 20 Gbit/s line shared by all customers, one VPS can use at most 10 Gbit/s according to its network interface settings, and for rackhousing the speed of the assigned port applies. That is why we do not describe data transfer as unlimited.

6.11If a service uses a substantial part of the shared line long-term (e.g. sustained traffic of several Gbit/s for many hours a day) and thereby restricts others, we will notify you and offer a solution (e.g. rackhousing with its own port or individual terms). If such load continues after a period of 7 days, we may limit the service's speed to the extent necessary, but to no less than 1 Gbit/s. Short peaks and traffic during an attack on your service are not affected (attacks are covered by the SLA).

Backups, IP addresses, rackhousing and the API

6.12The following also applies:

• Backups. The scope of our backups is set out in the SLA. They are meant for recovery after a failure, not as a long-term archive; we keep them only in the stated number and for the stated period.
• IP addresses. IPv4 addresses are scarce and we assign them according to RIPE NCC rules. On request, tell us what you need additional IPv4 addresses for. Assigned addresses remain ours (clause 8.8 of the Terms): you must not sublet, sell, transfer or announce them from another network. Set reverse DNS truthfully. If an address ends up on blocklists because of your service's traffic, remove the cause; we will request delisting once it is fixed.
• Cryptocurrency mining (including storage-based mining) is always prohibited on game servers, Discord bots and web hosting. On VPS only with our prior consent sent by e-mail. On rackhousing it is allowed on your own hardware within the agreed power draw. Full nodes and validators of blockchains that do not mine are fine on VPS.
• Torrents and P2P networks are allowed on VPS and rackhousing only for legal content (e.g. Linux distributions or your own files); not on game servers, Discord bots or web hosting. Proxies, VPN and Tor are covered by clause 3.1(f) and (g).
• Rackhousing. The agreed power draw is the limit for sustained consumption; short peaks (e.g. at start-up) are fine. We measure sustained overruns on the power distribution unit (PDU); we will notify you and offer a higher power allowance. We may switch off an outlet without notice only if the overload directly endangers the circuit breaker or the power supply of other equipment (clause 9.2).
• The customer API accepts at most 300 requests per minute per key; some actions have a stricter limit. Do not circumvent the limits, for example by spreading requests across several keys.
• Circumventing limits. It is prohibited to circumvent the technical limits of the service (resource limits, number of IP addresses, speed) and protective mechanisms (e.g. form protection or rate limiting).

What happens when the rules are exceeded

6.13When the fair use rules are exceeded, we proceed as follows:

• a)a warning by e-mail describing what we measured and proposing a solution;
• b)a period to remedy the situation or move to a more suitable plan, of at least 7 days;
• c)a restriction of performance or speed to the extent stated above, only as far as necessary and only for as long as the problem lasts;
• d)suspension only if the load seriously restricts other customers and you refuse a solution.

We intervene without prior warning only if the stability of a server, the network or the power supply is directly endangered (clause 9.2). We never delete data because of fair use and never charge anything extra without your consent. If you do not agree with a restriction under this clause, you may terminate the contract free of charge with immediate effect; we will refund the price paid for the unused period.

7.1The customer complies with the licence and commercial terms of games and platforms, in particular the Minecraft EULA and the Mojang guidelines for commercial use (server monetisation), the Cfx.re terms for FiveM, the Facepunch terms for Rust, the terms of the Hytale game operator, and Discord's Terms of Service and Developer Policy.

7.2Discord bots must not send spam, carry out “raids”, control user accounts (self-bots), mass-collect user data or otherwise breach Discord's rules.

7.3It is prohibited to run, in a game, sales or exchanges of in-game items for real money in a way that breaches the game's terms, and gambling for real money.

7.4Minors may play on a server. The customer is responsible for the content and communication on their server being lawful and appropriate for its audience.

8.1Spreading terrorist content within the meaning of Regulation (EU) 2021/784 is prohibited. If we become aware of such content, we disable access to it and suspend or terminate the service.

8.2We comply with a removal order for terrorist content issued by the competent authority within one hour of receipt. We preserve the content and related data for 6 months as the regulation requires and inform the customer to the extent the authority allows. The point of contact for orders is set out in clause 14 of the Terms.

9.1We respond to a breach in proportion to its severity, usually in this order:

• a)a warning by e-mail describing the problem with a deadline for remedy – for breaches of clauses 2 to 5 and 7 usually 24 to 72 hours depending on severity, for fair use at least 7 days (clause 6.13);
• b)a restriction of part of the service (e.g. blocking a port or IP address, limiting performance, disabling access to specific content);
• c)suspension of the service or account until the problem is fixed;
• d)termination of the service or account under clause 8.6 of the Terms, only for a serious or repeated breach.

9.2We intervene without prior warning only where serious harm is imminent or the law requires it – in case of an ongoing attack from the service, distribution of malware or phishing, child sexual abuse material or terrorist content, an order of a public authority, and a direct threat to our network, power supply, other customers or third parties. We choose the narrowest possible measure (e.g. blocking one port or disabling access to specific content instead of the whole service) and lift it once the threat is removed, unless the service is terminated.

9.3Automated measures. Measures are decided by a person. Only the following work automatically (without human intervention):

• the network's protective systems – DDoS filtering, temporary null-routing of an attacked IP address and rate limiting;
• the plan's technical limits – limits on CPU, RAM, disk and number of processes, and the hourly limit on mail sent;
• pausing mail sending from web hosting in case of sudden bulk sending (clause 5.4).

Automated measures are temporary or follow from the plan's parameters. We do not assess content automatically.

9.4Statement of reasons. For every measure (other than the ordinary effect of plan limits) we inform you by e-mail, at the latest when it is taken, with a statement of reasons under Article 17 DSA. It states:

• a)what the measure is, its scope and how long it will last;
• b)the facts it is based on and whether we acted on a notice or on our own initiative;
• c)whether we used automated means;
• d)for illegal content the legal ground, for a breach of contract the specific provision of the Terms or this policy;
• e)how you can object to the measure and what other redress options you have.

We give the same reasons for measures based on fair use. We do not send a statement of reasons only where a public authority prohibits it.

9.5Objection. You may object to a measure free of charge by e-mail to [email protected] within 6 months, as described in clause 14.5 of the Terms. The objection is assessed by a person and, where possible, by someone other than the person who took the measure; we lift an unjustified measure without undue delay. A consumer may also turn to an out-of-court dispute resolution body, and anyone may go to court.

9.6We do not delete data when a service is restricted or suspended. On request we will let you download your data, unless that would restore an unlawful situation (this does not apply to child sexual abuse material, terrorist content and malware). After the service ends, data is handled under clause 8.3(c) of the Terms.

9.7We do not charge contractual penalties for breaches. We may charge a business customer for the actual costs the breach caused us (e.g. delisting our IP addresses from blocklists). The right to compensation for damage under the law is not affected.

10.1Report abuse of the services or illegal content by e-mail to [email protected]. What the notice should contain and how we handle it is described in clause 14 of the Terms.

10.2For network abuse (attacks, scanning, spam), please include the IP address, the exact time with time zone and log excerpts or e-mail headers.

10.3We assess reports without undue delay; attacks originating from our network are handled with priority.

11.1We cooperate with public authorities on the basis of their decisions or requests to the extent provided by law. If we become aware of information giving rise to a suspicion of a criminal offence threatening the life or safety of persons, we inform the law enforcement or judicial authorities of the Member State concerned (in the Czech Republic the Police of the Czech Republic) or Europol (Article 18 DSA).

12.1This policy takes effect on 11 November 2026 (version 2026-11-11). Changes are announced in the same way as changes to the Terms (clause 17 of the Terms). For contracts concluded before this date, provisions that are less favourable to the customer than the previous version of 1 October 2026 apply only once 30 days have passed since they were announced. We will send you the previous version on request.