Privacy information and terms covering MAUL-operated custom Among Us regions, lobby posting, live lobby access, rankings, and related services.
Last updated October 24, 2026
This server is not affiliated with Among Us or Innersloth LLC, and the content contained therein is not endorsed or otherwise sponsored by Innersloth LLC. Portions of the materials contained herein are property of Innersloth LLC. © Innersloth LLC.
example#1234. An external or platform account ID, sometimes called an EAID in region tools, identifies an account on a connected game platform. These are different identifiers for accounts, not passwords.MAUL is the Modded Among Us Lobbies community service, operated by Sarha (Sarhadactyl). The MAUL operator decides how the MAUL region services use personal data and is the data controller for that processing.
Contact the operator at [email protected]. The website is moddedamong.us and the Discord community is discord.gg/maul. You do not need to join Discord or submit a public message to make a privacy request.
This notice covers MAUL NA/EU regions, region-linked lobby posting, the region lobby website, rankings, and region moderation. The Discord bot also runs community events, administration, and verification. This notice explains how the regions use its existing verification records. For information about unrelated Discord-only features, contact the operator.
By using the Website, joining a MAUL Region, using lobby posting, logging into a MAUL website feature, or using a related MAUL Service, you agree to the Terms of Service. If you do not agree to the terms, do not use the Service.
The Privacy Policy explains data processing; it does not turn every use of MAUL into consent. Accepting the terms does not waive your data-protection rights. Where consent is the legal basis for a feature, it must be a separate, informed choice that you can withdraw.
MAUL may update these policies as the Website, Regions, bot features, moderation tools, or legal needs change. A published revision will show its effective date. Material changes to data uses or recipients will be explained through the Website, Discord, or region notices before they take effect where required. A new use that requires consent needs a new consent choice; a changed policy date is not enough.
MAUL Regions are provided for custom Among Us gameplay and MAUL community features. You are responsible for using mods, tools, and game clients that do not disrupt the Service, unfairly affect other players, bypass moderation, or violate applicable rules.
MAUL may block, restrict, or remove mods, tools, clients, traffic, or behavior that disrupts Regions, creates abuse risk, causes compatibility problems, or is used to exploit the game or Service.
You agree to:
Lobby posting is for genuine, active lobbies. Do not knowingly submit false lobby information, impersonate another host, misuse reserved codes, spam posting requests, or bypass posting controls.
Live lobby website access is limited to verified MAUL members. Public rankings and statistics may be corrected by staff when needed to fix downtime, errors, abuse, or obvious inaccuracies.
Do not use the Service to:
MAUL may monitor Region activity, logs, reports, lobby posts, website activity, and related Service activity to operate the Service, investigate abuse, enforce rules, prevent exploits, and protect users and systems.
Authorized MAUL staff may warn, remove, restrict, disable, temporarily ban, permanently ban, or otherwise limit access when needed. Circumventing sanctions may result in additional restrictions.
MAUL Services are provided as available. Regions, website features, bots, panels, rankings, lobby posting, and compatibility with game versions or mods may change, restart, move, break, or become temporarily unavailable.
Third-party services such as Discord, hosting providers, DNS providers, storage providers, security tools, mods, launchers, and game services are operated separately from MAUL unless MAUL specifically says otherwise.
You may stop using the Service at any time. MAUL may suspend or end access to any part of the Service when needed for rule enforcement, abuse prevention, service integrity, security, or technical operations. Certain moderation and security records can remain after access ends, under the limits and criteria in Retention.
The Service is provided as available and without any promise that every Region, website feature, bot, ranking, mod, game version, browser, or network setup will always work without interruption or errors.
| Information | When it is obtained and where it comes from |
|---|---|
| Connection and technical information | IP address, request and connection details, timestamps, and region/node information are obtained when you try to connect or successfully connect to a region, use a MAUL API, or request a website page. They come from the connection and the game client or browser. For example, a failed login or blocked connection can create a security record. |
| Game account and client information | Names, friend codes, PUIDs, platform IDs, internal data IDs, game version, language, and reported mod identifiers/versions come from the client handshake, game messages, authentication services, and MAUL's account database. For example, the region checks an account identifier against a ban when you connect. Reported mod details are not a general inventory of files on your device. |
| Lobby and gameplay information | Lobby code, host, region, status, player count, start/end events, and elapsed hosting/game time come from the running region. For example, starting or ending a round updates lobby status and can update XP and activity totals. |
| Region chat | Message text, time, lobby details, and available sender/recipient identifiers come from chat messages and commands that the region receives. A retained message can later be used to investigate a report or explain an automatic moderation action. |
| Verification status and Discord account links | The regions and posting service consult existing Discord verification records to check status or resolve an account link. Those records originate in MAUL's separate Discord verification process; the region does not ask you to upload fresh verification proof as part of a connection. Discord supplies account IDs, usernames, display names, and interaction details when you use the connected bot features. |
| Website account and login information | A login setup token, Discord account link, chosen password, and session information are processed when you set up or use lobby website access. The bot's account database stores a salted password hash rather than the readable password. Setup uses a Discord modal, so Discord also processes that submission. Use a password you do not use for Discord or another account. |
| Reports, flags, bans, and appeals | Reports and submitted evidence come from players, witnesses, and the operator. Flags and blocked-connection records come from region checks. Bans, review notes, and action outcomes come from moderation tools. Appeals come from the email or Discord message you send. A report about you can therefore contain information supplied by someone else, not only information you submitted. |
| Preferences and feature records | Posting preferences, notification opt-ins, custom-code assignments, account eligibility, ranking profiles, and opt-out keys are created when you use those features or the operator changes an assignment. Examples include enabling #post always, clicking Notify, or confirming #level optout. |
| External ban-list entries | The regions check maintained ban lists containing friend codes, PUIDs or derived account identifiers, and ban information. Some entries originate in earlier imports from another region provider. A match identifies a listed account; it does not establish that every allegation about that account is correct. Contact MAUL to challenge an inaccurate entry. |
Where EU GDPR or UK GDPR applies, each use of personal data needs an applicable legal basis. A server rule, a privacy-policy link, or a player's continued use of MAUL does not supply every legal basis.
| Purpose | Basis and limits |
|---|---|
| Provide the service or feature you request | Article 6(1)(b), contract, where the processing is objectively needed to provide the requested service under valid terms. Examples are authenticating a game connection, routing a lobby, providing a requested lobby post, and maintaining a website login. Merely writing a data use into the terms does not make it necessary. |
| Protect the region and investigate incidents | Article 6(1)(f), legitimate interests, subject to a necessity and balancing assessment. The specific interests are listed below. This is not permission to collect unrelated data or keep entire histories indefinitely. |
| Optional uses that rely on consent | Article 6(1)(a), consent, where MAUL asks for an informed opt-in for that use. You can withdraw through the feature's available controls or by contacting [email protected]. Withdrawal does not affect processing that was lawful before consent was withdrawn. |
| Comply with a specific legal duty | Article 6(1)(c), legal obligation, only where an applicable law imposes that duty. MAUL's own lobby rules are not a legal obligation. Any required disclosure or legal hold must identify the relevant obligation and affected records. |
Reliance on legitimate interests requires the information to be necessary for the stated purpose and the use to respect players' rights, including the particular interests of younger players. You can object to a use based on your situation. Feature choices explain the controls available to you.
Legal references: Your Europe: data protection under GDPR and ICO guidance on legitimate interests for UK processing.
Discord lobby advertisements show host details, game code, region, language, mods, player count, and lobby status to people who can access the posting channel. The live lobby website shows similar details to members allowed to log in. A logged-in viewer can still copy or share what they see.
The public rankings and their related API show player names and activity totals. The response can also include a persistent account-derived ranking key and last-activity time. These can relate to a player even without showing the player's readable PUID. Use #level optout to remove your region ranking profile as explained below.
Region logs, private review notes, IP-match lookup tools, and management functions are restricted to Sarha at present. If another person is given access later, their access must be limited to the tasks they need to perform. Evidence shared for an incident can contain relevant messages, times, reasons, and identifiers; unrelated people and credentials must be excluded.
MAUL NA and EU can exchange ban information through configured synchronization. That is a data flow between MAUL services, not a promise that the records remain on only the region where they originated.
The MAUL ban list is public. It can disclose banned accounts' friend codes, PUIDs or derived account identifiers, and a short ban category so regions and compatible moderation tools can recognize listed accounts. These identifiers are personal data, even without a real name. Public exports exclude IP addresses, private notes, report text, and chat evidence. Previously imported bans are not automatically republished in new exports unless their origin is confirmed.
A public list can be copied, indexed, or retained in repository history. MAUL can correct or remove its own published entries, but cannot guarantee removal of every third-party copy. When the law requires it, MAUL will take reasonable steps to notify recipients or other controllers about a correction or erasure request. Contact [email protected] to challenge an entry.
MAUL NA and EU use a private-key IP hash in saved client and flag records, IP-ban fields, and blocked-connection history. The management panel displays that hash rather than the readable address. Authorized lookup tools can hash an address entered by the operator to compare it with saved records. A shared private key allows matching between the two MAUL regions.
The region still processes your live IP address to receive and return game traffic. Linode, Cloudflare, and other providers handling a connection can also process the readable address. Their network and access logs are separate from MAUL's hashed region records. Older console logs, backups, or IP addresses someone types into message text are not automatically changed by hashing a connection field.
A keyed hash reduces exposure but remains pseudonymized personal data; it is not a claim of anonymity. MAUL restricts access to the hash key and applies the same retention rules to hashed identifiers. EDPB: pseudonymisation.
These privacy rules cover both MAUL NA and MAUL EU. The region label does not change your rights under applicable data-protection law.
MAUL uses the schedule below for records it controls. A limit starts from the event shown, not from the date a record is viewed, copied, or exported. Automated stores are checked hourly; records reaching their limit are removed on the next successful pass, normally within one additional hour. Sarha handles copies outside those stores, including mail, staff messages, transcripts, and downloads.
| Record | Retention period |
|---|---|
| Ordinary session chat and connection records | Delete when the round ends or the lobby closes. Connection registration records are also removed on disconnect. Low-level diagnostic flags for those players are removed unless they are being investigated, have a private review note, or have been actioned. This does not remove account verification, active bans, feature preferences, or activity totals needed for the features described here. |
| Incident flags and other non-essential technical records | 30 days from the recorded event. Serious anti-cheat flags and reviewed incident records follow this limit unless one relevant record is separately attached to an active ban. A later write to the same file does not restart an older entry's period. |
| Reports, attached evidence, and case notes | 30 calendar days from submission, with older source messages removed sooner under their event-date limit. A report can save up to five recent messages sent by the reported player from the current session. This includes MAUL-controlled exports and earlier versions of notes. A necessary ban identifier and one relevant evidence line can remain separately under the active-ban rule. |
| Appeals and attachments | MAUL-controlled case copies are deleted 30 days after the final reply, and no later than 90 days after receipt. The seven-day deadline for submitting an appeal is separate. Platform-held conversations and delivered transcripts are explained below. |
| Active ban enforcement and one evidence record | Keep the friend code, PUID or derived matching identifier, necessary ban category, dates, status, and one relevant triggering message or flag record while the ban is active. The evidence record stays private. Any IP or other matching identifier is kept only where needed to enforce that restriction. An active permanent ban has no fixed end date, so these limited records may be retained indefinitely while the ban remains necessary. Remove them within 30 days after expiry or revocation; a minimal action audit may remain for its separate period. |
| Blocked-connection history and surrounding incident logs | 30 days from the blocked attempt or recorded event. The active-ban exception covers one relevant evidence record, not the whole chat history, all flags, or every rejected connection. Keeping a report open does not extend retention of its other contents. |
| Moderation action history | 12 calendar months from the action. After 30 days, keep the action type, necessary account reference, ban category, dates, and outcome rather than copied incident text. Report and flag notes follow their shorter evidence deadline. |
| Website accounts and personal statistics | 12 calendar months without that user's relevant activity, or earlier where a valid deletion request applies. Relevant activity means the user's login, authenticated website use, connection, or recorded hosting/game activity, depending on the record. Background synchronization does not count as new user activity. This does not delete separate Discord verification records or an active custom-code assignment. |
| Region rankings and opt-outs | Confirming #level optout deletes the current region profile and stops further tracking. A minimal derived suppression key remains while needed to honor that choice; it is removed when the feature ends or an applicable request requires removal. This key is still personal data. The command does not delete separate bot hosting statistics. |
Ordinary session deletion does not preserve the rest of a lobby's chat because one player was reported or banned. Report an incident while the lobby is active; later reports may no longer have surrounding chat available. Cleanup failures are retried hourly. Files left by an interrupted process follow the 30-day event-date backstop; new-format abandoned session chat files are also cleared on restart.
The normal validity periods are 15 minutes for website setup tokens, seven days for website sessions, and ten minutes for an unrefreshed website lobby listing. A listing stays active while the region refreshes it. Used or expired token records, expired sessions, and stale listings are removed on the next hourly cleanup. Logging out deletes the current session. Pending lobby confirmations expire after five minutes; notification opt-ins end when the notification is sent or the related post is removed, with a 30-day backstop for stale records.
Deleting a report from MAUL's stores does not delete the original conversation from everyone's Discord history. Ticket bots can deliver a transcript to MAUL and to the person who opened the ticket. MAUL's downloaded or archived transcript follows the relevant report or appeal deadline. Copies already delivered to another person are outside MAUL's control.
Sarha removes MAUL's own messages and stored attachments where the platform allows this. Discord does not let a recipient delete another person's messages from a direct-message conversation. Those messages can remain in Discord's history until the sender or Discord removes them; MAUL stops using them as an active case record after the applicable deadline. You can ask MAUL to review accessible copies and can use Discord's controls or contact Discord about platform-held records. This limitation does not exempt MAUL's separate archives, exports, or bot-controlled channels from deletion.
Maintenance and upgrade backups can contain user data as well as source code. Copies on MAUL's devices, in staff channels, and in evidence exports keep the original deletion deadline. Copying, renaming, or restoring a file does not restart it. A backup that cannot be selectively cleared must be removed by the earliest applicable deadline, and restored data must be checked before it is used again.
An exception needs a named legal obligation, court order, or specific legal claim and only the records needed for that matter. An open report, a general concern about security, or the phrase "service integrity" is not a blanket extension.
The operator records the reason, scope, and review date for a hold, reviews it every 30 days, and deletes the held copy within 30 days after the obligation or claim ends unless a specific law sets a different period.
Providers may retain separate records for their own legal or security purposes. Their independent records have their own policies. That does not remove MAUL's responsibility to arrange deletion of data a processor holds on MAUL's instructions.
These controls apply to different features. Removing a Discord post does not automatically delete ranking data, and hiding a website listing does not erase region logs.
| Feature | How to use it or stop it |
|---|---|
| Discord lobby posting | Use #post as the eligible host, or reply Yes when the region prompts you. Reply No to decline that prompt. Before a game starts, #post always toggles remembered automatic posting; read the response to see whether it is enabled or disabled. Use #post remove to close/remove the current advertisement. Disabling future automatic posting and removing the current post are separate actions. |
| Website lobby listing | A lobby can become visible when it is public in-game, when the host uses #public, or through #public always. The host can use #private before the game starts to hide the current website listing and clear the remembered always-public setting. A future lobby made public in-game can still be eligible. This command does not remove a Discord post or hide traffic from the region. |
| Lobby notifications | Click Notify on the Discord lobby post to request an alert for that lobby. Clicking again does not unsubscribe you. To cancel a pending alert, contact Sarha through Discord or [email protected] with the lobby code. |
| Region XP and rankings | Region tracking is currently on by default for eligible accounts. Run #level optout, then reply Yes to the confirmation, to delete the current region level profile and stop new tracking. This is permanent in the current command interface; there is no self-service opt-in/recovery command. A minimal derived opt-out key remains. Check each region separately; do not assume the choice synchronizes between NA and EU. |
| Bot auto-post hosting statistics | These are separate from the region level profile. #level optout does not erase them. Contact Sarha to request removal or raise an objection. Deleting these records can affect evidence of custom-code eligibility. |
| Lobby website account | You can avoid creating the account, log out to end the current session, or request account/link deletion by email. Logging out or clearing cookies alone does not delete the server-side account or every record associated with it. Blocking the login cookie prevents authenticated lobby access. |
| Verification, custom codes, and identifiers | Do not submit Discord verification proof unless you want the related verified access. Ask the operator to correct or remove an account link, remembered preference, or custom-code assignment. Removing information needed to establish eligibility can remove access to that optional feature; it does not erase unrelated ban evidence automatically. |
Basic connection, authentication, and necessary security processing cannot all be switched off while keeping a working connection to the region. You can stop connecting, and you can still exercise the rights below, including objecting to a use based on legitimate interests. A rights request is assessed on its facts, not rejected merely because you used MAUL.
MAUL decides how its region records are used. Infrastructure providers handle data needed to deliver their services; some also process separate account, network, or security records for their own purposes. A provider is not automatically an independent controller for every record, or automatically a processor for every purpose.
| Provider | Role and information involved |
|---|---|
| Linode / Akamai Cloud | Hosts the NA/EU region infrastructure and handles player connections, network addresses, and traffic. Region databases and files stored on those servers are also on that infrastructure. MAUL controls the application records; provider network/security records are a separate layer. Akamai privacy information. |
| Sparked Host | Hosts the existing MAUL Discord bot and the lobby-posting API. The regions send lobby metadata and posting requests to that API; this is separate from their read of existing verification records. Data stored by the bot and its application logs remain on the configured bot/database infrastructure. Sparked Host privacy information. |
| Cloudflare | Provides domain/DNS management and reverse-proxy/security protection for the website and bot API. It handles request metadata such as network addresses, timestamps, paths, and security signals for proxied requests. HTTPS requests terminated by the proxy can also be processed there as needed to deliver the request. Managing the domain's email DNS records does not itself give Cloudflare the email body; the current public mail-routing records point directly to iCloud Mail. Cloudflare privacy information. |
| GitHub Pages | Hosts the static website files, reached through Cloudflare. GitHub processes information needed to serve requests and protect its platform. Website hosting does not mean region logs or verification databases are automatically stored in the website repository. Any deliberately published ban-list file is a separate disclosure. GitHub privacy statement. |
| Discord | Handles Discord identities, messages, bot interactions, login setup submissions, lobby advertisements, notifications, and DMs used for appeals. MAUL receives the relevant account IDs and interaction content through the bot. Discord also controls its own platform processing under its privacy policy. Discord privacy policy. |
| Apple iCloud Mail | Receives contact and appeal emails for [email protected] in the operator's iCloud mailbox. The domain's public mail-routing records point to Apple's iCloud Mail servers. Apple handles your email address, message, attachments, and delivery metadata to provide the mailbox service. Do not send a password or unrelated sensitive documents. Apple privacy information. |
| Epic Online Services and Innersloth | The region authentication code uses these services to validate game credentials and resolve game account/friend-code information. Relevant authentication tokens/account identifiers and the server's request metadata are processed for those checks. Their game/platform services also operate under their own privacy notices. |
| Page fonts and icon CDN | This HTML loads Google Fonts and Font Awesome styles from cdnjs. Loading them makes requests from your browser to those providers, with the network/browser information needed for delivery. These requests are separate from the region's IP-hashed logs. Browser blocking can prevent these requests but can change how the page looks. |
Discord verification records originate in the separate Discord verification process. The region uses the result needed to check access or eligibility; it does not collect new verification proof when you connect. Contact the operator about the underlying Discord verification records as well as any region copy linked to you.
Sharing relevant evidence with another region operator is a separate disclosure, not an automatic entitlement to receive an IP address. It needs a specific incident, an appropriate legal basis, a limited recipient and data set, and a record of why the disclosure was needed.
A player using EU can still use a Discord service, bot API, email provider, or synchronized ban service processed elsewhere. Cloudflare and the other providers can use international infrastructure. Selecting EU does not by itself keep every related record inside the EEA.
Where applicable law restricts an international transfer, the transfer needs a valid legal mechanism. This can include an applicable adequacy decision or appropriate contractual safeguards and any required additional assessment. Contact [email protected] for information about the recipients, locations, and safeguards relevant to your records, including how to obtain a copy of applicable safeguards.
Legal reference: European Commission: rules on international data transfers.
Where the GDPR applies, you can:
These rights have legal conditions and exceptions. They are not limited by the seven-day ban-appeal window. The same contact route is available to users in other locations; the law that applies can differ.
Official explanation: European Commission: information for individuals.
Email [email protected] with what you want reviewed and an account reference that helps locate the records, such as a friend code or Discord ID. Do not send a password, game login token, or government ID with the first message.
MAUL can ask for proportionate proof that the account or records are yours where there is a reasonable doubt. Information about other people can be redacted from an access response; "private staff note" alone is not a blanket reason to exclude personal data about you.
For requests covered by GDPR, MAUL must respond without undue delay and within one month. Complex or numerous requests can justify up to two additional months, with an explanation within the first month. A refusal needs reasons and information about complaint and court remedies. Requests are normally free; any permitted fee or refusal for a manifestly unfounded or excessive request needs a specific justification.
You do not have to use a ban appeal to exercise a privacy right. You can complain to the authority for your habitual residence, place of work, or place of an alleged infringement where applicable. The EDPB authority directory lists EEA regulators; the ICO handles UK data-protection complaints.
Request-handling reference: EDPB: respecting individuals' rights.
Region checks can automatically reject or disconnect a connection, enforce a listed ban, or create a chat/name autoban when a configured rule matches. They use submitted text, account/connection information, and the relevant rule or ban entry. The consequence can be losing access without a person first reviewing that specific event. A flag can be wrong or lack context.
To appeal a ban, contact [email protected] or Sarha through Discord within seven calendar days after receiving the ban notice. Include the ban ID if available, relevant account details, and your explanation. Do not send someone else's private information unless it is needed as evidence.
Ask for Sarha to review the actual rule match and evidence rather than repeat the automatic result. That review route is available even where a game-access decision does not meet GDPR Article 22's threshold for legal or similarly significant effects. The seven-day community appeal window does not shorten a statutory right or privacy-request deadline.
Users must meet the game and Discord age requirements that apply to them. Public usernames, activity records, and moderation evidence can concern younger players too. Their privacy interests need particular care; a public display name or a game account does not remove that protection.
A parent or guardian can contact the operator about a child's information. Any authority or account check must be proportionate. If a feature needs parental authorization under applicable law, publishing a policy or assuming that every player is an adult does not supply it.
Management access uses authenticated credentials. The current operator is Sarha. Credentials and raw records must not be posted in public repositories, lobby messages, or public support channels. A redacted evidence export is still checked before it is shared, because free text can contain personal information.
Access restrictions, IP pseudonymization, and log cleanup address different risks; none guarantees that every copy is protected or deleted. There is no guarantee of perfect security. Where GDPR requires notice of a personal-data breach, the operator must assess and make the required regulator and affected-person notifications.
MAUL owns or controls its own website code, region configuration, bot configuration, branding, documentation, and original service materials. Do not copy, modify, distribute, or interfere with MAUL systems without permission.
Content you submit through the Service, such as chat messages, reports, lobby information, usernames, and gameplay-related information, remains yours where applicable. You allow MAUL to use that content as needed to operate, moderate, secure, display, and troubleshoot the Service.
To the fullest extent permitted by law, MAUL is not responsible for indirect, incidental, special, or consequential damages, including lost data, lost access, service interruption, mod issues, or third-party service problems.
You agree to hold MAUL harmless from claims, damages, or expenses arising from your violation of these policies, your misuse of the Service, your mods or tools, or content you submit through the Service.
Nothing in these policies limits rights that cannot legally be limited.
For questions about these policies, MAUL custom regions, or related MAUL services, contact MAUL through discord.gg/maul or [email protected]. Use email for privacy requests if you cannot access Discord. Privacy rights and ban appeals are separate processes.