# Tribe Marks & User-Generated Content Policy

Effective: 2025-10-22 (Updated: Encryption now active)

This policy governs short textual tribe mark content stored in EF-Map Cloudflare KV. Personal marks (saved only in your browser) are out of scope and never leave your device.

## 1. What Is Stored
- Tribe mark: title (≤60 chars) + note (≤160 chars) plus optional folder metadata in a single JSON document per tribe: `tribe_marks_v1/<tribe>.json`.
- **End-to-end encryption (Active):** Tribe marks are now encrypted using keys derived from wallet signatures. During the phased rollout, both plaintext and encrypted versions are stored temporarily. Once all tribe members have re-signed their wallets, the system transitions to encrypted-only storage and plaintext copies are deleted.
- **Operator access during transition:** During the parallel-mode phase, operators can access plaintext fallback data for maintenance and abuse handling. After full encryption activation (all members re-signed), only encrypted data remains and operator access is limited to metadata (tribe id, timestamps, entry counts) without the ability to read content.

## 2. Visibility & Access
- All current authenticated members of a tribe can read and modify that tribe's marks (decryption automatic after wallet signature).
- Cross‑tribe access is blocked server-side via membership verification.
- Operator access: permitted for maintenance and abuse handling during transition phase; limited to metadata after full encryption.

## 3. Sanitization
Input is normalized to reduce incidental risk:
- Control chars removed; whitespace collapsed.
- HTTP/HTTPS links replaced with `[link removed]`.
- Discord invite links replaced with `[invite removed]`.
- Length limits enforced (title 60, note 160).
Limitations: Does NOT automatically detect harassment, hate speech, PII, or defamation beyond the above transformations.

## 4. Prohibited Content
You must not store in titles or notes:
- Illegal content or instructions facilitating unlawful acts.
- Personal data about real individuals (addresses, phone numbers, emails, full names without consent) or doxxing.
- Threats, targeted harassment, hate or discriminatory slurs.
- Private keys, credentials, access tokens, or other secrets (encryption protects from third parties but not tribe members).
- Copyrighted or third‑party confidential material you lack rights to share.

**Note:** While encryption protects tribe marks from operator and external access, all tribe members can still decrypt and read shared content. Use appropriate judgment when sharing sensitive tactical information.

## 5. Enforcement & Reporting
- Report violations: email `abuse@ef-map.com` with tribe id and (if possible) the mark title/note excerpt.
- Review target: best‑effort within 72 hours.
- Actions: edit or removal of offending mark; repeated or severe abuse may lead to tribe mark feature suspension for involved accounts.
- Escalation: Clearly illegal or credible threat content may be preserved for legal/security follow-up.

## 6. Encryption Technical Details
- **Key Derivation:** User encryption keys are derived from wallet signatures using HKDF-SHA256. Keys are stored in browser sessionStorage (24-hour expiry) and never transmitted to servers.
- **Algorithm:** AES-GCM-256 with 96-bit IVs and authenticated additional data (AAD) including tribe identifier.
- **Phased Rollout:** The system operates in parallel mode during transition—storing both plaintext and encrypted versions. Once all tribe members have re-signed (or after the December 2025 wallet reset), tribes automatically transition to encrypted-only mode.
- **Indicator:** A 🔒 padlock icon appears in the UI when your tribe is fully encrypted.
- **Migration:** No user action required. Encryption activates automatically as users authenticate with their wallets.

## 7. Roadmap (Informational)
Planned/considered: basic offensive term filtering, mutation rate limiting, lightweight audit buffer (encrypted metadata only). These future items are not yet active.

## 8. Disclaimer
Tribe marks are a collaborative tactical convenience feature. They are short, sanitized, and encrypted end-to-end against operator access (after full activation). During the transition phase, plaintext fallback data exists for backward compatibility. By using them you agree not to store sensitive, personal, or unlawful information. Content that violates this policy may be removed without notice (requires access to plaintext fallback or court order for encrypted-only data).

## 9. Contact
Primary: `abuse@ef-map.com`
Fallback: `support@ef-map.com`

---
Archived verbose draft retained at `docs/archive/policy/` for historical context.