Acceptable Use Policy

Effective date: 18 August 2026 Last updated: 18 August 2026

This Acceptable Use Policy (the "AUP") lists what you may and may not do on PZStack ("the Service"). It is part of, and incorporated by reference into, our Terms of Service. A breach of this AUP is a breach of the Terms and may lead to suspension or termination without refund under section 11 of the Terms.

We keep this policy broad on purpose - the list of prohibited things below is not exhaustive. If in doubt, email [email protected] and ask.

1. You are responsible for your server and your players

When you rent a PZStack server, you are the administrator of that server. You control the Steam Workshop mods you install, the sandbox variables, who has admin / moderator powers, who is allowed to join, and what your players are allowed to do. If a player under your roof breaks the law, breaks this AUP, or abuses someone, it is your job to handle it - ban them, adjust your rules, pull the plug. We can and will act if you don't, but the first line of defence is you.

2. Absolutely prohibited - instant suspension, no warning

Doing any of these gets your server taken offline immediately and your account terminated for cause:

1. Child sexual abuse material (CSAM) or any sexualised content involving a real or depicted minor. We report CSAM to law enforcement and to NCMEC (or the equivalent in our jurisdiction) without prior notice to you.
2. Terrorism and violent extremism. Hosting, recruiting for, or organising attacks on behalf of organisations sanctioned by the UN, EU, UK, US, or a government with jurisdiction over us.
3. Malware, cryptominers, botnet command-and-control, remote access trojans - whether shipped inside a mod, an RCON script, or the server binary itself.
4. Attacks launched from our infrastructure - DDoS, port-scanning, credential stuffing, spam, SIP fraud, SMS pumping, SSH brute-force, Telegram / Discord abuse pivots, anything like it.
5. Attempts to break out of your container, escalate privileges on the host, or access another customer's server. This includes running a mod that probes /proc, calls setns / unshare, tries kernel-level tricks, or scans the internal network.
6. Doxxing another person - posting real-world personal data (address, phone number, government ID, nude image without consent) of a person who has not agreed to it.
7. Trafficking in stolen credentials / carding / fraud marketplaces.

If we see any of the above, we suspend the server, preserve logs for law-enforcement cooperation, and terminate the account with no refund.

3. Content you post on the server (MOTD, name, description)

The server name, description, message-of-the-day, and welcome text are visible to anyone who can see your server and, if you marked it public, in listings. Don't put there - or anywhere in Your Content - anything that is:

• Unlawful in your jurisdiction or the jurisdiction of players you accept;
• Harassing, threatening, or hate speech targeting a protected class;
• Sexual content presented to minors, or sexualising minors;
• Someone else's trade mark, copyright, or personal data without permission;
• A phishing lure impersonating PZStack, Steam, The Indie Stone, a payment provider, or any other service.

4. Game-integrity: cheats, exploits, and paid cheat services

You may run a private server with any house rules you like, including "admin-only creative mode", experimental mods, or PvP variants. What you may not do:

• Operate a "cheat-as-a-service" business - i.e. selling access to a server whose sole value proposition is giving players unfair advantage against unsuspecting opponents on other servers, teaching cheat development, or distributing cheats, aimbots, or bypasses for anti-cheat software;
• Use PZStack to reverse-engineer, crack, or re-distribute Project Zomboid itself, or to host a pirated build of the game;
• Modify the game's multiplayer protocol in a way that attacks vanilla players connecting from the public Internet (exploiting parser bugs, causing crashes, etc.);
• Sell in-game advantages for real money in a way that violates The Indie Stone's end-user terms or applicable consumer-protection / gambling law (loot boxes targeted at children in the EU/UK, etc.).

5. Mods

You install mods by referencing their Steam Workshop ID. The Service will fetch, cache, and apply that Workshop item. You agree that:

• You will not install a mod whose content or purpose violates this AUP (malware, scraper for player PII, illegal content, cryptominer, etc.);
• You will not use the Service to repackage or re-host someone else's mod without that author's permission - Workshop licences vary, and some are no-derivative;
• If a mod is removed from the Workshop for a DMCA / IP / content reason, we will stop serving it and may remove it from the mod cache;
• You take the risk. Our Mod Intelligence warns about file / Lua conflicts; it is not a malware scanner. If a mod trashes your save, that is not a service-failure refund.

6. Players and moderation

You must comply with all applicable laws when running your server, including laws about:

• Illegal content (CSAM, terrorist propaganda, incitement);
• Hate speech and harassment - specifically the EU Digital Services Act duty to act expeditiously on illegal content once you (as the server admin) know about it;
• GDPR / CCPA / KVKK duties to your own players if you collect personal data from them (Discord IDs, emails, IP addresses in player lists). You are a separate controller for that data - we are not your processor for it.
• Monetisation regulation - paid admin / perk / "VIP" systems must comply with consumer, tax, and, where relevant, gambling law. Running a PZStack server as a loot-box-style gambling platform aimed at EU/UK players is not allowed.
• Age-gate - the game is rated for mature audiences. If you admit minors, you are responsible for protecting them in your community.

Report illegal content or AUP-breaking behaviour on another PZStack server to [email protected] (subject: "abuse"). Include the server name / slug, what you saw, and when.

7. Fair use of shared resources

Your plan comes with published limits (RAM, CPU share, storage, mod count, players, backup slots, RCON rate, API rate). You will not:

• Attempt to circumvent these limits through multiple accounts co-ordinated to look like separate customers;
• Run tasks designed to soak idle CPU on our hosts (protocol fuzzers, mining, password cracking);
• Hold a server provisioned purely to hoard an IP / slug / name you do not actively use, then resell it;
• Script the dashboard or the API in a way that exceeds the published rate limits.

If your legitimate workload genuinely needs more than a plan provides, email us - we would rather sell you the right plan than throttle you.

8. Payments and account identity

• One human per account unless you run a gaming community - in which case the account owner is the community's responsible adult.
• Pay with a method you are legally entitled to use. Card fraud leads to immediate termination and cooperation with law enforcement.
• Do not use PZStack to launder money through chargeback roundtrips, mule subscriptions, or deliberate payment disputes. See [Refund Policy §6] (/legal/refund) for how we treat chargebacks.

9. Research and security testing

We welcome responsible-disclosure security research against your own account - poking at the dashboard, your agent, your server. We do not authorise testing that targets:

• Another customer's data;
• Our billing / admin systems;
• Anything beyond the reach of your own access;
• Denial-of-service testing.

Report findings to [email protected] with subject "security". We do not currently run a paid bug-bounty programme but will credit responsible disclosures.

10. Enforcement

For breaches of this AUP we may, depending on severity:

1. Warn you by email and ask you to remediate;
2. Throttle or temporarily suspend the server;
3. Suspend or terminate the account with loss of access to data;
4. Preserve logs and cooperate with law enforcement.

Decisions are made by humans when practical. We are not obliged to give advance notice before acting on the "absolutely prohibited" list in §2.

11. Changes

Material changes to this AUP will be emailed to registered users and shown in the dashboard at least 14 days before they take effect.

Questions, reports, or a grey-area use case? [email protected].