Tribe Marks & User-Generated Content Policy
Effective: 2025-10-22 | Updated: 2026-08-08 (reflecting the encrypted-at-rest v3 storage model that replaced wallet-signature encryption in June 2026)
This policy governs short textual tribe bookmark content stored in EF‑Map Cloudflare KV. Personal marks (saved only in your browser) are out of scope and never leave your device. For what EF‑Map stores about you (accounts, subscriptions, analytics), see the separate Privacy Policy.
1. What Is Stored
- Tribe bookmark: title (≤60 chars) + note (≤720 chars) plus optional folder metadata in a single JSON document per tribe:
tribe_store_v3/<tribeId>.json. - Encryption at rest (server-managed): Tribe bookmarks are encrypted with AES-256-GCM before being written to storage. The encryption key is derived from a server-held secret per tribe. This protects the stored data, but it is not end-to-end encryption: the server holds the key material and the operator can technically decrypt stored content. An earlier wallet-signature end-to-end scheme was retired in June 2026; this document previously described that scheme.
- Operator access: Technically possible (see above); exercised only for maintenance and abuse handling under section 5.
2. Visibility & Access
- All current authenticated members of a tribe can read and modify that tribe's bookmarks; membership is verified against the chain on every request.
- Cross‑tribe access is blocked server-side via membership verification.
- Operator access: limited to maintenance and abuse handling.
3. Sanitization
Input is normalized to reduce incidental risk:
- Control chars removed; whitespace collapsed.
- HTTP/HTTPS links replaced with
[link removed]. - Discord invite links replaced with
[invite removed]. - Length limits enforced (title 60, note 720).
Limitations: does NOT automatically detect harassment, hate speech, PII, or defamation beyond the above transformations.
4. Prohibited Content
You must not store in titles or notes:
- Illegal content or instructions facilitating unlawful acts.
- Personal data about real individuals (addresses, phone numbers, emails, full names without consent) or doxxing.
- Threats, targeted harassment, hate or discriminatory slurs.
- Private keys, credentials, access tokens, or other secrets (storage encryption protects against third-party access to the data store, not against your tribe members or the operator).
- Copyrighted or third‑party confidential material you lack rights to share.
Note: All tribe members can read shared content, and the operator can technically decrypt it (see section 1). Use appropriate judgment when sharing sensitive tactical information.
5. Enforcement & Reporting
- Report violations: email [email protected] with tribe id and (if possible) the mark title/note excerpt.
- Review target: best‑effort within 72 hours.
- Actions: edit or removal of offending mark; repeated or severe abuse may lead to tribe mark feature suspension for involved accounts.
- Escalation: clearly illegal or credible threat content may be preserved for legal/security follow-up.
6. Encryption Technical Details
- Key derivation: A per-tribe AES-256-GCM key is derived server-side (HMAC-SHA256) from a server-held secret and the numeric tribe ID. Clients never handle key material.
- Algorithm: AES-GCM-256. Data is encrypted before every storage write and decrypted only on authenticated reads by verified tribe members.
- Transport: Client-server traffic is protected by TLS; the client sends and receives plaintext JSON over that encrypted connection.
- What this is and is not: This is encrypted-at-rest storage with seamless tribe-scoped access (no passphrases to manage). It is not operator-blind end-to-end encryption. The earlier wallet-signature scheme was retired in June 2026: its phased rollout never completed, so plaintext fallback copies remained in storage in practice; the current model encrypts all stored data unconditionally.
7. Roadmap (Informational)
Planned/considered: basic offensive term filtering, mutation rate limiting, lightweight audit buffer (encrypted metadata only). These future items are not yet active.
8. Disclaimer
Tribe bookmarks are a collaborative tactical convenience feature. They are short, sanitized, and encrypted at rest with a server-managed key. By using them you agree not to store sensitive, personal, or unlawful information. Content that violates this policy may be removed without notice.
9. Contact
Primary: [email protected]
Fallback: [email protected]
A raw Markdown version of this policy is available at /POLICY.md for machine consumption.