The short version
Community data with clear boundaries
The Hive uses a local browser identity and a shared Supabase database. There is no login of any kind. The global Hive click total, community posts, and public profile details are meant to be shared; country, personal click total, personal Space data, and draft state are returned only to the matching verified identity. There are no ad trackers, behavior analytics, payment details, or service-level database secret in the browser. No system is perfectly secure, and an unsaved anonymous identity cannot be recovered on another device.
1
What is kept and who sees it
Data is kept only to provide the features a person chooses to use, protect the community, and keep the service working. The line between shared and viewer-only data matters:
Shared with Hive visitors
- Gamertag, aliases, alumni or guest status, favorite or current game, and optional DHG year, Division, and squad.
- Check-in time and status, family notes, guestbook entries, memories, flights, visible Wall combs, board threads, and replies.
- Public moderation state needed to show contained or removed content without exposing private reports or evidence.
Only your browser identity
- Your country of origin, which tunes life guides and is omitted from the public roster payload.
- Your Space widgets, notes, tasks, saved links, RSVP choices, reaction best, unfinished Wall drafts, and Wall viewing state.
- Your token ledger, paused reward records, balance, and whether you personally reported a post or comb.
The browser also keeps a local copy of your session, preferences, and recently loaded Hive state so the installable app can remember you and remain useful during a connection problem. Clearing browser or app storage removes that device copy, but it does not automatically delete matching records from the shared database.
Public means public to Hive visitors. A gamertag is less formal than a legal name, but posts and profile details can still identify someone. Share accordingly.
2
What is deliberately not collected
- No email address, password, or account record exists, because the Hive has no login of any kind.
- No payment card or billing information is collected because the Hive is free.
- No ad identifiers, tracking pixels, cross-site profiles, or third-party behavior analytics are used.
- No central clickstream or activity-history table is retained. The original alpha activity table was removed and its recorder is a no-op.
- Community posts are not read for advertising or used to train an AI model.
- Camera, microphone, and geolocation browser permissions are disabled at the public edge.
This follows the basic security principle of knowing what data exists and keeping only what the service needs.1
3
Controls in place today
- Encrypted transport: the public site uses HTTPS. The private Pi-to-VPS tunnel also uses TLS, and the origin listens only on loopback.
- Deny-by-default database access: Row Level Security is enabled on every Hive table, browser roles have no direct table grants, and writes go through narrowly granted database functions.2
- Browser-safe credentials: the app contains only a Supabase publishable key. A secret or service-role key, which could bypass Row Level Security, is not shipped to the browser.3
- Server-owned rules: the database validates identity, field lengths, allowed entry types, cooldowns, token balances, one-identity reports, the narrow three-person Board attack quorum, and allowlisted human Wall moderation. A reporter-selected reason cannot impose a global Wall takedown or ban.
- Output and browser boundaries: user text is escaped before display. Security headers block framing, MIME sniffing, dangerous browser permissions, and connections outside the small allowlist needed by the site.
- Recoverable releases: production uses immutable Git-based releases, an atomic live pointer, health checks, and automatic rollback when a release fails locally.
4
Providers and ordinary network data
The Hive is not completely isolated from infrastructure providers. Supabase provides the anonymous browser identity and the hosted database. No email address or password is ever held, because there is no sign-in to hold one for. Hostinger provides the domain and VPS edge. Google Fonts currently serves the typefaces used by the page. A privately operated Raspberry Pi serves the site through the dedicated encrypted tunnel.
Those providers necessarily receive ordinary network information needed to answer a request, such as an IP address, request time, browser headers, and requested path. Supabase also processes the profile and community data sent to its service. Google Fonts receives a font request from the browser, but the Hive does not send community posts or profile fields with that request.
No provider is used by the Hive for targeted advertising or behavior profiling. Their own handling of network data is governed by their terms and privacy notices.
5
Known alpha limitations
- No perfect security: a vulnerability, provider incident, compromised device, or human mistake can still expose or lose data.
- Anonymous identities are device-bound: clearing browser storage can separate an unsaved identity from its records. Saving a profile to an email address can carry it to another browser, but it does not recover an anonymous identity that was never saved.
- Limited browser export: My Space can download the profile and private data available to the current browser. Complete shared-data export and deletion controls are still being built.
- Shared content can be copied: deleting a future database record cannot erase screenshots or copies made by another visitor.
- Device access matters: someone with an unlocked phone or browser profile may be able to read viewer-only data or post as that identity.
- Security is ongoing: controls and dependencies need review as the code, providers, and threat landscape change.
Do not place passwords, recovery codes, private keys, precise home addresses, government identifiers, private medical files, or other high-risk secrets in a post, message, or Space widget.
6
Retention, correction, and deletion
Shared profile and community records are currently kept while they remain part of the Hive's community history or are needed to operate and moderate the service. Viewer-only state remains until it is replaced, manually removed, no longer needed, or the project is reset. Moderation and security records may need to remain after ordinary content is removed.
My Space can download the profile, private Space, scores, heartbeat count, and token history available to the current browser. A fixed retention schedule and complete shared-data export, correction, and deletion tools are not finished. Until the ticket system is live, contact the maintainer privately through the DHG or Hive channel you already use. Include the gamertag and browser involved, but never send a password, session token, recovery code, or private key.
7
Report a security concern
Please report a suspected vulnerability privately and give the maintainer reasonable time to investigate. Describe what you observed, the affected page, the date and time, and safe reproduction steps.
- Do not access, alter, download, or publish another person's data.
- Do not run denial-of-service tests, automated scanners against production, social engineering, or destructive tests.
- Do not publicly disclose working exploit details before the issue can be contained.
A dedicated suggestion, bug, and security ticket system is planned. Until then, use the private maintainer channel described above. This brief will be updated when that reporting path is live.