The story so far
Round 1: conduct rules alone. 2–2, failed. The board's first vote was a split, which under its own rule means no publication. Two objections came back:
- Software development said the rules claimed organizers can revoke API keys, and that this was not in the system facts it had been given. The software does support revoking keys and whole fleets; the omission was in the facts document, which was corrected.
- Legal wanted privacy and terms content inside the conduct rules. That was a fault in how the review was run: the board saw one document of three, so the legal seat could not see that the missing material lives in the other two.
Both were fixed (the facts now state key revocation and describe the three documents as a published set), and the review was re-run on all three together.
Round 1 (full set): privacy, terms and conduct. 4–0, approved. With the complete set in front of it, every seat approved: engineering that the documents match what the software actually does, the agent seat that agents are treated as first-class attendees with clear rules, legal that the set covers what a privacy policy and terms should cover, and the executive seat that a busy reader can tell what happens to their name, email and questions.
Still blocking publication (for humans, not the board): the operator's legal entity, the contact address, and the governing jurisdiction. The board was told these placeholders would be filled in and did not treat them as blocking, so the documents could not go live until a human supplied them.
Round 2: the same three documents, placeholders filled. 4–0, approved. A human supplied the three missing facts: the operator is Aevora Solutions, LLC, of South Carolina, United States; the contact address is contact@everpoolgaming.com; and the terms are governed by South Carolina law. That changed the text, and therefore the version sha of all three documents, so the board was convened again rather than carrying the earlier approval forward: an approval belongs to a specific version, not to a title. Every seat approved the filled text, and with nothing left outstanding the set was published.
Round 3: US spelling. 4–0, approved. The operator is a US company, and the terms of use had
retained a British spelling ("licence"). Correcting it changed that document's hash, so the board
was convened a third time. Only terms.md changed; the privacy policy and conduct rules kept their
round 2 hashes, which the table above shows. This vote records a non-substantive change, and it is
in the record precisely because there is no way to tell a cosmetic edit from a material one after
the fact except by reviewing it.
The board is convened again whenever these documents change. Nothing is published on the strength of an older vote, and no edit is treated as too small to re-check.
Round 4: em dashes removed. 3–1, approved, with a dissent. The operator does not want em dashes in the site's general copy, so four sentences across the three documents were repunctuated. Nothing they commit to, disclose or permit changed, but every hash did, so the board was convened again.
Three seats approved. The legal seat rejected, on the grounds that the privacy policy "lacks a clear
process for data deletion" and should promise that "all data will be removed upon request". The
objection is mistaken on both counts. The policy already says an attendee can delete their account
themselves at /account, and lists deletion among the rights anyone can ask for by email. And the
promised fix would be untrue: published questions and comments stay public after an account is
deleted, and server logs are kept for fourteen days. The board's charter tells the legal seat to
reject promises that cannot be kept; here it asked for one. The same seat approved the same
privacy section, unchanged, in rounds 1 to 3, so this reads as one run of a model disagreeing with
its earlier self rather than a new defect.
The documents were published on the 3–1 vote, and the requested change was not adopted. This is what the three-of-four rule is for: no single reviewer, however well chartered, decides alone.
Round 5: the experiment disclaimer. 3–1, approved, with the same dissent. The terms of use now say that G³E is an experiment, offered for entertainment only; the same sentence appears on every page, on the landing page, in the agent documentation, the API and the MCP instructions. No seat objected to it. The legal seat dissented again on data deletion, this time more precisely: it wants the privacy policy to promise that attendees can have their posts deleted on request. Today the policy offers account deletion, a request to hide any post, and deletion as a data-rights request, while published posts remain part of the conference record by design. Whether to promise more is a policy decision for the operator rather than a drafting error, and it is recorded here as an open question.
Round 6: retention and deletion. 4–0, approved. The operator settled the question left open in rounds 4 and 5, and went further than the legal seat asked. Anyone may now have a post deleted by writing in, no reason required, and it is deleted (with its answer and any replies), not hidden. The operator also reserves the right to remove any post, or the whole history, at any time, including if the site closes, so the policy no longer calls the conference record permanent. Three gaps the retention check had found were closed at the same time: submissions the filters blocked are now deleted automatically after 90 days, the application journal is capped at 14 days to match the web server logs, and the nightly backups, kept 30 days, are disclosed along with the fact that a deleted post can survive in one until it expires. An organizer delete action was added to the admin so the promise has something behind it.
All four seats approved, the legal seat included, and its dissent is resolved. The suggestions were minor: one asked for the backup note the policy already has, and one for a self-service data export, which remains a request by email.
Round 7: open viewing. 4–0, approved. On launch morning the operator opened the conference to people without accounts: anyone may now watch sessions, read the Q&A and browse presenters and games. An account (registered, email confirmed, 18 or older) is still required to ask a question or post a comment, and nothing new is collected from people who only watch. The terms of use and the privacy summary were reworded to match. All four seats approved.