Terms of Service

Effective date: 2026-09-06. These terms are written in English; the Portuguese translation, when it exists, is a courtesy and this text prevails.

These terms govern the use of the mc package registry and of the website that serves it (minicompiler.dev, pkg.minicompiler.dev, together "the service"). By signing in, registering a repository or consuming the registry index you agree to them.

1. Who operates the service

The service is operated by the minicompiler organisation, through its owner, in Brazil. Legal notices go to legal@minicompiler.dev; the details are on the legal notice page.

2. What the service is, and what it is not

The registry stores and serves metadata about packages written in the mc language: a name, a description, the address of a public source repository, and one row per published version with its tag, its commit, a tree hash and the address of the archive.

The registry does not host your code. The archive of a published version is fetched from the forge that already holds it (today GitHub); the registry records where it is and what its contents hash to. The code remains yours, remains on the forge, and remains under the licence you put in the repository. Nothing in these terms transfers a licence to the operator beyond what is needed to fetch a public repository, validate it and publish the metadata described above, which includes storing and displaying the package name, description, version numbers, dependency list and the report of the validation run.

A published version is a promise to everyone whose lock file pins it. Availability of the code itself is the forge's: if a tag or a repository is deleted there, the metadata stays and the download stops working. The service checks published versions periodically and shows the result on the package page.

3. Accounts

• An account is created by signing in with GitHub. There is no password here and none is stored; what is stored is listed in the privacy policy.
• You must be able to enter into a binding agreement in your jurisdiction. If you act for an organisation, you state that you may bind it.
• One person, one account. Automated account creation is not permitted.
• You are responsible for what happens under your account, including what any token you issue does.
• Before an account may register or publish anything, it must accept these terms, the privacy policy and the package policy. The acceptance is recorded with the version of each document, the date, the address the request came from and the user agent.

4. Registering a repository

• Public repositories only. The service registers the address of a public git repository on an allowed forge (today github.com alone) and refuses anything else. It never asks for, and never accepts, credentials that would let it read a private repository.
• You must control the repository you register, or be permitted by its owner to publish it.
• A version is a release. A tag vX.Y.Z is published only when the forge has a corresponding published release for it.
• Validation happens in a sandbox. The service clones the tag and compiles and runs the package's own checks with no network and no view of the host machine. A run that is refused or that fails publishes nothing, and its report is shown to you.
• The service imposes limits on clone size, build time, memory and request rate. They are part of the service, and circumventing them is a breach of these terms.

5. Package names

• A name matches [a-z][a-z0-9_]{0,31} -- the language's own rule.
• The names mc, anything starting with mc/, deps and build are reserved by the language and are refused.
• Any name matching mc* or minicompiler* -- as a glob, case insensitive, and equally after removing - and _, so that m-c and mini_compiler are covered -- is reserved for the administrator. These are the names that would look official.
• First registration wins. A name is assigned to the account that registered it and does not change hands except by the transfer process below.
• A name is never renamed and never recycled. Deleting a repository does not free its name, because a lock file somewhere may still resolve it.
• Squatting is not allowed. Registering names you do not intend to publish under, or registering names close to an existing project in order to mislead, is a breach; see the package policy.
• A transfer of a name is an administrative action, requested at legal@minicompiler.dev by both parties, or by one party with evidence that it holds the source repository the name points at.

6. Publishing, yanking and delisting

• A published version is immutable. Its version number, tag, commit, hash and dependency list never change. The database refuses to change them.
• Yank marks a version as one that new projects should not pick. It stays in the index, it stays resolvable, and a lock file that already pins it keeps working. You may yank your own versions at any time.
• Delist removes a version from the index. It is reserved for legal takedowns -- a court order, a valid copyright claim, a data-protection order -- and for malware. It is an administrative action, and the reason and the reference of the order are recorded.
• Deleting a repository or an account does not unpublish what was already published; the rows remain, attributed as described in the privacy policy.

7. Acceptable use

The package policy is part of these terms. In short: do not publish malicious code, do not publish someone else's code as your own, do not squat names, do not use the service to attack anyone, and do not try to defeat the sandbox, the rate limits or the isolation the service is built on. You also agree not to:

• scrape or download beyond the published rate limits, or in a way that degrades the service for others (the index is a static file tree: mirror it instead);
• probe, scan or test the security of the service except as the security policy permits;
• impersonate another person, project or organisation, here or in a package's metadata;
• use the service where doing so would breach sanctions or export control that apply to you.

8. Suspension and termination

The operator may suspend an account, disable a repository or delist a version when these terms or the package policy are breached, when a valid legal order requires it, or when a package is actively harming users. Where the situation allows it you are told which rule was applied and may reply to legal@minicompiler.dev; where it does not -- active malware, a court order -- the action comes first and the notice follows. Every such action is recorded in an internal audit log.

You may stop using the service at any time and delete your account from /me. What survives a deletion is described in the privacy policy: published version rows and acceptance records, because they are commitments to third parties.

9. Availability and changes

The service is provided as it is, with no promise of availability. It runs on a single modest server, it is free of charge, and it may be interrupted, rate-limited or withdrawn. Interfaces may change; the registry file layout is the one the compiler's own documentation describes, and a breaking change to it is announced on the site before it happens.

10. No warranty

The service and everything it serves are provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement. The operator does not endorse, audit or vouch for any package published through the registry. Validation under the sandbox proves that a package compiled and ran under a set of restrictions; it is not a security review. Any automated analysis shown beside a package is an opinion, is never the gate, and must not be read as a guarantee. You decide what you install and run, and you are responsible for that decision.

11. Limitation of liability

To the maximum extent permitted by applicable law, the operator is not liable for indirect, incidental, special or consequential damages, for loss of data, profit or business, or for damage caused by a package published through the registry or by the unavailability of the service. Where liability cannot be excluded, it is limited to the amount you paid for the service, which is zero. Nothing here excludes liability for wilful misconduct or for anything else that cannot be excluded under Brazilian law, including consumer rights that apply to you.

12. Your content and your responsibility

You state that you have the right to publish what you register and that its licence permits the distribution the service performs. You agree to hold the operator harmless from third-party claims arising out of what you published, to the extent permitted by law.

13. Changes to these terms

Each of the legal documents carries a version, which is its effective date. When a document changes, the version changes, and the next time you sign in you are asked to read and accept the new version before you may register, publish, yank or issue a token; reading the site, the package pages and the registry index is never affected. The acceptance is recorded. Your previous acceptances are listed on /me.

14. Governing law and forum

These terms are governed by the laws of the Federative Republic of Brazil, including the General Data Protection Law (Lei 13.709/2018, "LGPD"). The forum is the courts of the operator's domicile in Brazil, except where the law grants you the right to sue elsewhere -- a consumer, for instance, may sue in the forum of their own domicile.

15. Contact

legal@minicompiler.dev for anything in this document, security@minicompiler.dev for a vulnerability (see the security policy).

Change log

• 2026-09-06 -- first version, effective from the day the login opened.

Document version 2026-09-06. The other documents: Terms of Service, Privacy Policy, Package Policy, Security Policy, Legal notice.