Terms of Service

1. Acceptance of Terms

By creating an MU Auth account or using MU Auth to sign in to Mega Utilities services or third‑party applications, you agree to these Terms of Service. MU Auth provides identity, authentication, and single sign‑on (SSO) functionality across the Mega Utilities ecosystem.

2. Account Responsibilities

You are responsible for maintaining the security of your account and authentication methods.

• You must keep your password, passkeys, TOTP secrets, recovery keys, and backup codes confidential.
• You must notify us immediately if you suspect unauthorized access.
• You may not share your account or allow others to authenticate as you.
• You may not attempt to bypass or disable multi‑factor authentication or security checks.
• You understand that MU Auth uses essential security cookies (including sid and csrf_token) to maintain session integrity and protect your account from unauthorized actions.

3. Acceptable Use & Prohibited Behavior

To maintain platform integrity, you agree not to:

• Perform credential stuffing, brute‑force attacks, or automated login attempts.
• Exploit, reverse engineer, or attempt to bypass MU Auth’s security systems.
• Use MU Auth to impersonate others or create fraudulent identities.
• Interfere with MU Auth’s infrastructure, rate limits, or session systems.
• Use MU Auth to access services in violation of their own Terms of Service.

4. Authentication Methods

MU Auth supports multiple authentication methods. By using them, you acknowledge the following:

• Passwords: Never stored in plaintext; processed using zero‑knowledge proofs or PAKE envelopes.
• Passkeys: Only public keys are stored; private keys remain on your device.
• Nostr Login: We receive your npub and nprofile; your nsec never leaves your device.
• TOTP 2FA: TOTP secrets are encrypted; backup codes are stored as salted hashes.
• Recovery ID & Support ID: Used solely for account recovery workflows.

5. OAuth2/OIDC Applications

MU Auth allows you to sign in to third‑party applications using OAuth2/OIDC. When you approve an application:

• You grant access only to the scopes you explicitly approve.
• You may revoke access at any time through your MU Auth dashboard.
• Mega Utilities is not responsible for third‑party application behavior or data handling.

6. Administrative Actions

MU Auth administrators may perform limited actions to maintain platform security and assist with account recovery:

• Reset account email addresses (for recovery purposes).
• Reset passwords or disable compromised authentication methods.
• Place a temporary law hold on accounts when legally required.
• Suspend accounts involved in abuse, fraud, or security violations.

7. Account Suspension & Termination

We may suspend or terminate accounts that:

• Violate these Terms of Service.
• Engage in malicious or abusive behavior.
• Attempt to compromise MU Auth or other users.

You may delete your account at any time. Deletion includes a 30‑day grace period before permanent removal.

8. Service Availability

MU Auth is provided on an "AS IS" and "AS AVAILABLE" basis. We do not guarantee uninterrupted service, error‑free operation, or compatibility with all applications.

9. Limitation of Liability

To the maximum extent permitted by law, Mega Utilities is not liable for:

• Indirect, incidental, or consequential damages.
• Loss of data, lost backup codes, or inability to access your account.
• Unauthorized access resulting from compromised devices or credentials.
• Third‑party application misuse of OAuth2/OIDC data you approved.

10. Dispute Resolution

If you experience issues or disputes, please contact us through the Help Center. We will work with you to resolve problems quickly and fairly.

11. Changes to These Terms

We may update these Terms of Service periodically. Significant changes will be announced through your MU Auth dashboard or email (if provided).