Legal

Four pages, each about a different promise: what you may do with the software, what this website records about you, what you agree to by using it, and what may be published in its marketplace. They are written in plain language on purpose — a legal page nobody reads protects nobody.

The four pages

• License — dev3d is AGPL-3.0-or-later. This page explains the licence, why it was chosen over a permissive one (the project is designed to be operated as a server, so a permissive licence would let someone host a modified fork and never publish the changes), what section 13's network clause asks of you in the cases that actually come up, why a plugin is separate work, and what to do if the AGPL does not suit you. There is an FAQ covering commercial use, hosting as a service, your plugin's own licence, and what "Corresponding Source" means.
• Privacy — what this site records and, just as importantly, what it deliberately does not. No advertising pixel and no cross-site tracker. No IP address is stored in the analytics tables: an address is hashed with a salt that rotates daily, so visitors can be counted within a day and nothing links them across days. No country is recorded, because a geo-IP lookup would mean sending the address to somebody else. A third-party Matomo tag manager is available but loads only if you allow it, and the page sets out exactly what changes when you do — including the parts of the answer that are weaker than a privacy page usually admits.
• Terms — the terms for using this site and the marketplace it serves. Documentation is provided as-is and the software's licence is not altered by anything here. Publishing to the marketplace is a set of promises: that you have the right to distribute the bundle, that the manifest is accurate, and that declared permissions describe what the plugin reaches for. Installing a code plugin runs someone else's code in the orchestrator process with its authority, and the permission list is a consent record rather than a runtime sandbox. Removal and yanking are described for what they can and cannot reach.
• Marketplace policy — what may be published and what is refused, with the complete table of the eight keys a manifest may contribute under and the fields each one requires. It separates what the site refuses automatically when an archive is uploaded (oversized bundles, unsafe paths, a mismatched API version) from what is enforced as policy by review and reports (a manifest that hides code, permissions that understate behaviour, a shipped credential). It also states the versioning rules, and the real limitation that follows from them: a bad version cannot be recalled from installations that already have it.

The posture in one paragraph

The software is AGPL-3.0-or-later, deliberately, because it is built to be run as a server; running it unmodified asks nothing of you, and modifying it while letting other people use it over a network obliges you to offer them your version's source. The site's analytics are first-party and aggregated: one small beacon posts a path and a referrer, addresses are hashed with a daily-rotating salt and never stored, visits are grouped by a random cookie rather than a fingerprint, and a 90-day retention window is applied by hand because there is no background worker to apply it for you. A third-party Matomo tag manager is offered as an opt-in on top of that, and it stays off until a visitor allows it. The marketplace's permission model is a consent record, not a sandbox: a plugin's declared permissions are shown, in plain language, before anyone enables it, and nothing enforces them afterwards — which is why the manifest is published verbatim, the checksum is published with it, and the documentation says plainly that installing a code plugin means trusting its publisher.

What these pages are not

• They are not the software's licence. The licence is the LICENSE file in the dev3d repository, and it is the authority on what you may do with the software. Nothing on this site adds to or subtracts from it.
• They are not legal advice. They are careful plain-language descriptions of how the licence and the code actually behave, written by the people who made both. If a question matters commercially, read the licence text and, where it is still ambiguous for your situation, ask someone qualified.
• They are not a substitute for reading the code. The privacy and marketplace pages describe specific files and specific behaviour — the collection endpoint, the schema, the bundle checks — so that you can check them. If a page and the code disagree, the code is right and the page is a bug worth reporting.

Asking about any of it

Licensing differently, a question about what this site stores, a report of a plugin that does something its listing does not disclose, or a documentation error that contradicts the source — all of it goes through contact. Reports about a malicious bundle are acted on first and discussed afterwards, as the marketplace policy sets out.

If you want the technical documentation rather than the legal one, it starts at Documentation.