Join Chat
Data Protection & Rights

Socioverse Privacy Policy

We believe privacy is an inviolable fundamental right. Learn how our data minimization architecture safeguards your digital footprint.

Effective Date: November 1, 2024 • Data Controller: Socioverse Network

1. Introduction & Core Philosophy

At Socioverse ("we", "our", or "us"), we prioritize pseudonymous, respectful communication. Unlike traditional ad-tech networks that harvest contacts, track location, and compile personal dossiers, Socioverse operates under strict Data Minimization by Design principles in full compliance with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act, and Brazilian LGPD.

2. Information We Collect

We collect only the bare minimum technical data required to deliver real-time chat functionality:

  • Guest Users: Temporary session token, user-chosen ephemeral handle, and temporary IP address (held in volatile server memory solely for rate-limiting and DDoS defense, then discarded).
  • Registered Accounts: Chosen username, salted & hashed password (using argon2/bcrypt), optional avatar URL, and user interface preferences (such as dark/light mode and sound toggles). We do not require real names, phone numbers, or physical addresses.
  • Chat Communications: Public channel messages are relayed to connected clients in real-time. Private direct messages are transmitted securely over TLS 1.3 encryption. We do not sell, scrape, or monetize chat transcripts.
  • Automated Telemetry: Aggregated, anonymized statistics such as browser user-agent and connection latency to balance server loads.

3. Legal Bases for Data Processing (GDPR Article 6)

We process your data strictly under recognized lawful bases:

  • Performance of a Contract: To establish your WebSocket connection, transmit messages, and provide the interactive chat services you request.
  • Legitimate Interests: To detect bot attacks, mitigate distributed denial of service (DDoS) attempts, enforce community safety, and prevent spam.
  • Legal Obligation: To comply with mandatory statutory directives (such as court orders or reporting requirements regarding child safety to NCMEC).

4. Third-Party Services & Advertising

To sustain our worldwide server infrastructure without charging users, we display non-intrusive advertisements served through trusted advertising partners (such as Google AdSense). These third parties may use cookies or web beacons to display personalized or non-personalized advertisements based on standard publisher policies. You can manage your ad preferences via our Cookie Policy or through the Network Advertising Initiative (NAI) opt-out tool.

5. Comprehensive Data Minimization & Processing Ledger

To provide complete transparency, our Data Protection Officer maintains this detailed ledger cataloging every data category, processing rationale, and retention lifecycle:

Data Element Classification Lawful Basis (GDPR Art. 6) Retention Window Deletion Trigger
Guest Session Token Pseudonymous Identifier Contractual Necessity (Art. 6(1)(b)) Session Lifetime Browser Tab Close
Registered Username User Identity Handle Contractual Necessity (Art. 6(1)(b)) Account Lifetime User Deletion Request
Cryptographic Password Hash Argon2id Salted Hash Contractual Necessity (Art. 6(1)(b)) Account Lifetime Account Termination
Ingress IP Address Hash Truncated SHA-256 Hash Legitimate Interests (Art. 6(1)(f)) 24 Hours (Volatile RAM) Rolling Daily Flush
Public Chat Messages Ephemeral Text Payload Contractual Necessity (Art. 6(1)(b)) Rolling 100-Message Buffer Buffer Overwrite (Sub-Hour)
WebRTC Audio Packets Opus Encrypted Stream Contractual Necessity (Art. 6(1)(b)) Zero Storage (In-Transit Only) Instant Packet Relay
User Interface Preferences Theme / Audio Levels Consent (Art. 6(1)(a)) Persistent LocalStorage Browser Cache Purge

6. Sub-Processors & Infrastructure Infrastructure Partners

To deliver secure global WebSocket relay and WebRTC audio, Socioverse engages carefully audited third-party infrastructure sub-processors under strict Data Processing Agreements (DPAs) incorporating standard contractual clauses:

  • Edge Anycast & Cloud Infrastructure: Tier-4 data centers located in Frankfurt (Germany) and Northern Virginia (USA) providing physical hardware, Anycast edge routing, and DDoS mitigation. Sub-processors are certified under ISO/IEC 27001 and SOC 2 Type II standards.
  • Digital Advertising Networks: Google AdSense is utilized to display non-intrusive contextual display advertisements. Google acts as an independent data controller under its published privacy terms for ad delivery. Google may use advertising cookies or mobile ad identifiers in compliance with publisher standards. Users can adjust ad personalization at Google Ad Settings.
  • Zero Sale of Personal Data: We do not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate personal information to any third party for monetary or other valuable commercial consideration.

7. International Cross-Border Data Transfers

Because Socioverse operates a globally distributed edge network, your encrypted data packets may traverse servers located outside of your home country. For transfers originating in the European Economic Area (EEA), the United Kingdom, or Switzerland:

  • All transfers to infrastructure outside the EEA are governed by the European Commission's approved Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914.
  • We deploy supplementary technical safeguards, including end-to-end TLS 1.3 transit encryption and in-memory cryptographic key isolation, ensuring unauthorized third parties or foreign intelligence services cannot intercept user messages.

8. California Consumer Privacy Act (CCPA / CPRA) Disclosures

This section applies exclusively to California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020:

Notice at Collection for California Residents:

  • Categories of Personal Information Collected: Identifiers (chosen handle, temporary IP hash), Internet or other electronic network activity information (connection timestamps, browser type).
  • Purposes of Use: Operating real-time chatrooms, detecting automated bot spam, and maintaining platform uptime.
  • Zero Sale or Sharing of Sensitive Personal Information: Socioverse does not collect or process sensitive personal information (such as Social Security numbers, precise geolocation, racial or ethnic origin, or genetic data). We do not "sell" or "share" personal information as defined under California law.
  • Right to Non-Discrimination: We will never discriminate against you (via price changes, degraded service, or account denial) for exercising any of your CCPA/CPRA privacy rights.

9. Automated Decision-Making & Algorithmic Profiling

Socioverse firmly pledges that it engages in zero automated profiling, credit scoring, or psychological behavioral categorization. Our chronological chat streams contain no predictive algorithms designed to manipulate mood, trigger outrage, or influence purchasing behavior. Automated systems are limited strictly to heuristic rule-based rate limiting (detecting automated DDoS bursts) and known phishing link interception.

10. Children's Online Privacy Protection (COPPA / GDPR-K)

Socioverse is strictly designed for individuals aged 13 and older (or 16 and older in jurisdictions governed by GDPR-K). We do not knowingly solicit or harvest personal information from children under 13. If a parent or guardian discovers that their child has registered an account without appropriate consent, contact our Privacy Office immediately at privacy@socioverse.me; we will permanently erase the account and all associated tokens within 24 hours.

11. Your Privacy Rights (GDPR & CCPA)

Regardless of where you reside, Socioverse extends full data control rights to you:

  • Right to Access & Portability: You may request an export of all data associated with your registered handle.
  • Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and associated profile settings at any time.
  • Right to Rectification: You may update or correct your handle or profile settings via your user dashboard.
  • Right to Opt-Out of Sale / Sharing: We do not sell personal data. CCPA California residents retain the statutory right to confirm zero personal data monetization.

To exercise any of these rights, email our Data Protection Officer at privacy@socioverse.me. We fulfill verified requests within 30 days without fee.

6. Data Security & Retention

All network communication between your client browser and our nodes is encrypted using TLS 1.3 with forward secrecy. Access to backend systems is restricted via multi-factor authentication (MFA) and audited security logs. Ephemeral session logs are cleared every 7 days.

12. Step-by-Step User Rights Exercise Procedures

We ensure that exercising your statutory privacy rights is frictionless and transparent:

  1. Submission: Email your request directly to privacy@socioverse.me from the email associated with your registered account, specifying the right you wish to exercise (Access, Erasure, Portability, or Rectification).
  2. Identity Verification: To protect account security from fraudulent deletion requests, we verify account ownership via a secure confirmation token sent to your registered session or email address. We do not demand government IDs for verification.
  3. Processing SLA: Once verified, our Privacy Office fulfills your request without delay and within a maximum of 30 calendar days.
  4. Zero Cost: All statutory data subject requests are processed completely free of charge.

13. Recourse to Independent Supervisory Authorities

If you are a resident of the European Union, United Kingdom, or Switzerland and believe that our data processing infringes your statutory rights, you retain the legal right to lodge a formal complaint with a competent Data Protection Authority (DPA):

  • Germany (Lead EU Representative Jurisdiction): Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), Graurheindorfer Str. 153, 53117 Bonn, Germany (Website: bfdi.bund.de).
  • United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (Website: ico.org.uk).
  • France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris, France (Website: cnil.fr).
  • United States: California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov or file consumer complaints with the California Attorney General's Office.

14. Security Incident & Data Breach Response Protocols

While our radical data minimization architecture ensures our servers hold virtually no sensitive personal information, we maintain an emergency Incident Response Team on continuous standby:

  • 72-Hour Statutory Notification: In the unlikely event of a security breach involving unauthorized access to registered profile hashes, Socioverse will notify relevant lead supervisory authorities within 72 hours of becoming aware of the breach, pursuant to GDPR Article 33.
  • Direct Member Communication: If a breach poses a high risk to user security, a prominent notice will be broadcast across all active chat channels, accompanied by instructions for resetting authentication credentials.
  • Post-Mortem Transparency: Following any security event, a comprehensive technical post-mortem report detailing root causes and permanent mitigations will be published in our public engineering log.

15. Policy Version History & Material Change Notifications

We periodically review and update this Privacy Policy to reflect evolving technical features, operational improvements, and international statutory developments. When material changes occur, we update the “Effective Date” at the top of this document and post a prominent advisory banner inside all public chatrooms 14 days prior to implementation. Continued use of Socioverse after the effective date constitutes acknowledgment of the revised terms.

17. Brazilian LGPD & Canadian PIPEDA Compliance Notice

For participants connecting from Brazil and Canada, our operations adhere strictly to the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados - LGPD, Law No. 13.709/2018) and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA):

  • LGPD Rights (Brazil): Brazilian participants may exercise rights under LGPD Article 18, including confirmation of processing, anonymization of non-essential data, and revocation of consent, by contacting our Data Protection Officer at privacy@socioverse.me.
  • PIPEDA Accountability (Canada): Canadian residents are informed that personal data is handled under PIPEDA principles of accountability, limiting collection, and individual access, with recourse to the Office of the Privacy Commissioner of Canada (OPC).

18. Cookie-Less Session Handling & Local Storage Mechanics

Unlike typical modern web applications that rely on third-party tracking cookies to maintain user identity, Socioverse utilizes modern client-side storage sandboxes:

  • sessionStorage: Temporary guest session tokens exist exclusively in memory within your current browser tab's sessionStorage partition. Closing the tab or browser window immediately destroys the token, leaving zero residual identification data on your device.
  • localStorage: Saved interface configurations (such as dark theme preferences, mute states, and volume levels) are stored locally in your browser's localStorage. This data is never transmitted to our backend servers or shared with external analytics networks.

19. Contact Our Data Protection Officer

If you have questions, concerns, or complaints regarding our data handling, contact us:

Socioverse Privacy Office / Data Protection Officer
Email: privacy@socioverse.me
General Inquiries: support@socioverse.me