Ari-web statement

This is nothing official. Just a personal website. You can contact [email protected] on email if you want to use any services (or sign up for them), but I cannot guarantee anything, because there is no legal entity (like a company) that gives me any liability. You're just shoving your data into a random server online administrated by a random person, so keep that in mind if you want to use anything on ari-web :)

"No warranty" disclaimer:

THERE IS NO WARRANTY FOR THE SERVICES, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING, I PROVIDE THE SERVICES "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SERVICES IS WITH YOU. SHOULD THE SERVICES PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL I BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SERVICES (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SERVICES TO OPERATE WITH ANY OTHER SERVICES), EVEN IF I HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Hosting provider: ETH-Services (eth-services.de (includes DDoS protection, which means traffic is analysed for suspicious patterns!)
Location: Germany
Cats: many
Annual cost: 180 euro
Service list: https://ari.lt/#services

Kept logs include:

Nginx (access and error logs): IP address, user agent, remote user (if applicable), request method and URI, request time, request length, HTTP status code, size of response, response time, and http referrer, error logging (timestamp, error level, error message, and context). - analyzed by fail2ban and also kept for any possible reports of abuse to identify and block any abusers.
Forgejo (HTTP logging): Timestamp, IP address, route, timing information, network port and protocol, network status. - same purpose as Nginx logs
Email (Mailcow): IP address (sender (IP of who sent it, either a server or a person) and receiver (IP of an email server)), email delivery status, error messages, authentication attempts, system messages, failed authentication attempts, spam filtering (and status), DNS and DNSSEC verification, web activities, virus scanning, Nginx and PHP logs, IMAP and POP3 interactions (including login and access). - Mailcow keeps these and also uses fail2ban and other software (such as rspamd) to function as an email suite.
XMPP: IP address and authentication attempts as well as error reporting information. - analyzed by fail2ban to protect from brute-force attacks.
SSH: IP address and ports, timestamps, hostname, event type (authentication, connection attempts, ...) - protect from brute force attacks in SSH which grants administrators shell access to the server.
Rate limiting: IP address, email address (if applicable), access time. - rate limiting is a normal part of an application to limit access to resources.
Firewall: Firewall events (blocked, limited), attacks, and related information (IP addresses, timestamp, hostname, timestamp, network interface, MAC addresses, IP and packet details (source and destination IPs, packet length, type, time to live, packet ID, packet protocol), source and destination ports, packet window size, protocol flags) - standard UFW firewall logging (the firewall software I use). - analyzing of attacks by automated (fail2ban) and manual means, identifying abuse, and safekeeping in detecting anomalies.

Most logs are retained for a week, although certain logs (such as SSH logs) are kept for a month. This retention is based on legitimate interest, aiming to ensure stability and service quality, protect IT infrastructure, data security, and integrity at both software and firewall levels, and facilitate moderation and administration of services. This helps prevent abuse and allows for the identification and banning of abusers to safeguard the services. Note that some logs are kept in memory and some in disk, meaning that not all logs persist.

When it comes to data, your data is protected through multiple layers of security that I implement and configure. These measures include data encryption both at rest (when possible) and in transit (when possible), HSTS preloading (HTTPS-only), hashing (when possible), firewall rules, monitoring and moderation, regular system updates, and system hardening (when possible). As a solo operator, I acknowledge that while I strive to ensure the highest level of security, there are limitations, however, I am deeply invested in maintaining the security of my services, as any data breach would also compromise my own data. I continue to improve security over time and, although I cannot provide absolute guarantees, my personal stake in protecting these systems motivates me to do my best :)

Also please note the community standards (rules):

Abide by International, Lithuanian, and German laws.
Maintain a healthy environment.
Uphold human decency, which includes:
- Tolerance;
- Ensuring non-discrimination. This covers racism, homophobia, transphobia, sexism, xenophobia, fatphobia, and other negative attitudes;
- Avoiding the spread of misinformation and disinformation;
- Being responsible and accountable for your actions;
- Prohibiting the spread of Child Sexual Abuse Material (CSAM), which includes forms such as Lolicon and Shotacon. Additionally, avoid any discussions that might imply a positive view of CSAM or related content;
- Respecting other users;
- Adhering to other generally accepted norms of behaviour.
Do not share anyone's (not even yours, please!) personal and/or sensitive information.
Do not engage in activities that infringe on the intellectual property rights of others.
No spam.
No harassment or stalking. Engaging in harassment or stalking of other users is strictly prohibited.
Avoid harmful behaviours and do not partake in actions that could harm individuals, jurisdictions, or systems.
Do not send sexually explicit or suggestive messages or content. We do not host such things nor do we know how to deal with it nor want to.
Follow admin guidelines - any behaviour deemed abusive by the administrators will be considered a violation of these guidelines.

Just be sane, thanks (: If you have an issue with any of it contact me.

Status page: https://status.ari.lt/