Privacy & Data Governance Charter
Effective Date: October 20, 2026 · Universal Lore Protocol v2.5
1. Martial Accord & Scope
Welcome to MurimVerse ("the Project", "we", "our"). We respect your digital sanctity as fiercely as a master defends their sect's secret pavilion. This Privacy Policy details how we collect, process, safeguard, and disclose information when you traverse our interactive maps, query our lore database, and authenticate as a cultivator.
By accessing MurimVerse, you acknowledge and consent to the data practices described herein, designed in accordance with global data protection standards (including the European Union's GDPR and the California Consumer Privacy Act CCPA).
2. Information Collected Across the Jianghu
We strictly gather only the telemetry and credentials necessary to render your experience:
- Authentication Personas: When registering or selecting a predefined demo cultivator (e.g., Plum Blossom Sword Saint, Heavenly Demon), we store your identifier, chosen cultivator alias, and role designation (
READER,EDITOR, orADMIN). - OAuth Credentials (Optional): If you authenticate via GitHub or Google, we receive only public profile tokens (name, email, avatar image). We never request or store your external passwords.
- Cartography & Session Data: Viewport coordinates, zoom levels, and search filter tokens stored locally in your browser to maintain smooth WebGL Pixi.js map state.
- Network Telemetry & Rate-Limiting: Anonymized IP addresses and timestamp buckets used exclusively to combat automated scraping, DDoS assaults, and API flooding.
3. Purpose & Principles of Data Processing
Your information is processed under legitimate grounds for:
Core Navigation & Search
Delivering fast keyword retrieval across 24 historical strongholds and martial arts techniques.
Role-Based Access Control
Authorizing access to editorial archives and administrative dossier management tools.
Security & DoS Mitigation
Distributed sliding window rate-limiting to protect server nodes from malicious exhaustion.
Zero Commercialization
We never sell, rent, monetize, or trade cultivator telemetry to advertising syndicates.
4. Cryptographic Defenses & Security Standards
In alignment with OWASP Top 10 web application security principles, MurimVerse implements strict infrastructure controls:
- Zero Secrets in Client Code: Environment keys are stored strictly in server-side vaults and excluded from repository commits.
- Strict Content Security Policy (CSP): Prevents unauthorized script injections, cross-site scripting (XSS), and clickjacking attacks.
- HTTP Strict Transport Security (HSTS): Enforces TLS 1.3 encryption across all communication pathways.
- Secure Cookie Flags: Authentication tokens are issued with
HttpOnly,SameSite=Lax, andSecureattributes. - Strict Path Sanitization: Built-in boundary checks guard against directory traversal and unauthorized file reads.
5. Cookie & Storage Directives
We avoid invasive third-party tracking cookies. We utilize strictly functional storage:
- authjs.session-token / sb-*-auth-token: Encrypted JWT maintaining your logged-in cultivator identity.
- theme: Remembers your preference between Ink (Dark) and Parchment (Light) realms.
- murim_cookie_consent: Remembers your cookie preference choice.
For complete details on browser storage keys and controls, consult our dedicated Cookie Policy.
6. Your Sovereign Rights (GDPR & CCPA)
Every cultivator retains complete dominion over their recorded footprint. You maintain the right to:
- Access & Portability: Request an export of your profile records.
- Correction & Erasure: Purge your account, sessions, and associated telemetry upon request.
- Withdrawal of Consent: Sever linked OAuth providers at any instant.
7. Sanctum Inquiries & Contact
For security disclosures, privacy requests, or domain questions, contact the Murim Alliance Secretariat at karkiprabin198@gmail.com or file an issue via our GitHub Security Advisory portal.