Tribe Marks & User-Generated Content Policy

Effective: 2025-10-22  |  Updated: 2026-10-06 (adds the 30-day Recently deleted list and daily versions for tribe and alliance bookmarks; alliance bookmarks added 2026-10-01; the encrypted-at-rest v3 model replaced wallet-signature encryption in June 2026)

This policy governs short textual tribe and alliance bookmark content stored in EF‑Map Cloudflare KV. Personal marks (saved only in your browser) are out of scope and never leave your device. For what EF‑Map stores about you (accounts, subscriptions, analytics), see the separate Privacy Policy.

1. What Is Stored

• Tribe bookmark: title (≤60 chars) + note (≤720 chars) plus optional folder metadata in a single JSON document per tribe: tribe_store_v3/<tribeId>.json.
• Encryption at rest (server-managed): Tribe bookmarks are encrypted with AES-256-GCM before being written to storage. The encryption key is derived from a server-held secret per tribe. This protects the stored data, but it is not end-to-end encryption: the server holds the key material and the operator can technically decrypt stored content. An earlier wallet-signature end-to-end scheme was retired in June 2026; this document previously described that scheme.
• Alliance bookmark: the same fields and limits in a single JSON document per alliance (alliance_store_v1/<allianceId>.json), encrypted the same way with a separate per-alliance key. The alliance list itself (alliance name and member tribe ids) is stored unencrypted because it holds no user-written content.
• Operator access: Technically possible (see above); exercised only for maintenance and abuse handling under section 5.

2. Visibility & Access

• All current authenticated members of a tribe can read and modify that tribe's bookmarks; membership is verified against the chain on every request.
• Cross‑tribe access is blocked server-side via membership verification.
• Alliance bookmarks can be read and modified by current authenticated members of any tribe listed in that alliance. The EF‑Map operator curates the list; it is checked on every request, so removing a tribe revokes its access within about a minute.
• Deleted tribe and alliance bookmarks and folders stay in that space’s Recently deleted list for 30 days, where its members can see who deleted them and restore them. EF‑Map also keeps one daily version of each tribe and alliance space for 30 days so members can restore what was lost. Both are encrypted at rest like the live bookmarks and expire automatically.
• Operator access: limited to maintenance and abuse handling.

3. Sanitization

Input is normalized to reduce incidental risk:

• Control chars removed; whitespace collapsed.
• HTTP/HTTPS links replaced with [link removed].
• Discord invite links replaced with [invite removed].
• Length limits enforced (title 60, note 720).

Limitations: does NOT automatically detect harassment, hate speech, PII, or defamation beyond the above transformations.

4. Prohibited Content

You must not store in titles or notes:

• Illegal content or instructions facilitating unlawful acts.
• Personal data about real individuals (addresses, phone numbers, emails, full names without consent) or doxxing.
• Threats, targeted harassment, hate or discriminatory slurs.
• Private keys, credentials, access tokens, or other secrets (storage encryption protects against third-party access to the data store, not against your tribe members or the operator).
• Copyrighted or third‑party confidential material you lack rights to share.

Note: All tribe members can read shared content, and the operator can technically decrypt it (see section 1). Use appropriate judgment when sharing sensitive tactical information.

5. Enforcement & Reporting

• Report violations: email [email protected] with tribe id and (if possible) the mark title/note excerpt.
• Review target: best‑effort within 72 hours.
• Actions: edit or removal of offending mark; repeated or severe abuse may lead to tribe mark feature suspension for involved accounts.
• Escalation: clearly illegal or credible threat content may be preserved for legal/security follow-up.

6. Encryption Technical Details

• Key derivation: A per-tribe AES-256-GCM key is derived server-side (HMAC-SHA256) from a server-held secret and the numeric tribe ID. Clients never handle key material.
• Algorithm: AES-GCM-256. Data is encrypted before every storage write and decrypted only on authenticated reads by verified tribe members.
• Transport: Client-server traffic is protected by TLS; the client sends and receives plaintext JSON over that encrypted connection.
• What this is and is not: This is encrypted-at-rest storage with seamless tribe-scoped access (no passphrases to manage). It is not operator-blind end-to-end encryption. The earlier wallet-signature scheme was retired in June 2026: its phased rollout never completed, so plaintext fallback copies remained in storage in practice; the current model encrypts all stored data unconditionally.

7. Roadmap (Informational)

Planned/considered: basic offensive term filtering, mutation rate limiting, lightweight audit buffer (encrypted metadata only). These future items are not yet active.

8. Disclaimer

Tribe bookmarks are a collaborative tactical convenience feature. They are short, sanitized, and encrypted at rest with a server-managed key. By using them you agree not to store sensitive, personal, or unlawful information. Content that violates this policy may be removed without notice.

9. Contact

Primary: [email protected]
Fallback: [email protected]

A raw Markdown version of this policy is available at /POLICY.md for machine consumption.