At TapHoaMMO, user privacy and data security are fundamental priorities. This policy details how we collect, store, safeguard, and process your personal and transactional information.
We manage user identities through our self-hosted Logto authentication infrastructure, ensuring authentication tokens never transit through third-party advertising brokers:
Email address, chosen username, profile avatar, and assigned RBAC permissions.
Passwords are protected using one-way Argon2/bcrypt cryptographic hashing. Plaintext passwords are never stored, logged, or accessible by staff.
To enable seamless coordination between Buyers and Sellers and facilitate support interactions:
Messaging infrastructure is hosted on self-hosted Rocket.Chat instances authenticated via server-side service tokens.
Chat transcripts are retained strictly for transaction verification and dispute adjudication. Logs are redacted of sensitive tokens and systematically pruned following dispute-free order closure.
Every balance modification involving Credits is recorded in our double-entry financial Ledger:
All ledger entries (top-ups, debits, escrow holds, releases, and withdrawals) are strictly append-only, revoking UPDATE and DELETE capabilities to guarantee absolute auditability.
Transactional history is maintained solely for accounting and regulatory compliance; financial data is never sold or used for cross-site behavioral targeting.
Digital accounts and license credentials deposited by sellers are safeguarded under strict isolation:
Credentials in stock are encrypted at rest using AES-256-GCM authenticated encryption with master keys held exclusively in server environment memory.
Credentials are decrypted strictly upon automated delivery or when a verified buyer triggers the reveal action. Every credential access generates an immutable audit record.
The Personal Vault (Két sắt cá nhân) feature operates under complete Zero-Knowledge cryptographic principles:
Your master encryption key and master password NEVER touch our servers. The backend only stores ciphertext and salt parameters. Even database administrators or infrastructure operators cannot decrypt your private vault items.
Your private vault entries are encrypted and decrypted directly in your browser using standard Web Crypto APIs (AES-256-GCM with PBKDF2 key derivation).
You maintain comprehensive authority over your personal information:
You possess the right to inspect, correct, and export your personal profile data and order history directly within your dashboard.
You may request account closure and data anonymization via privacy@taphoammo.dev. Statutory financial ledger entries must be preserved pursuant to commercial accounting laws, and verified scam identities in the Scam List are permanently retained to protect public safety.