Privacy & data security

This page explains what information Murmur collects, why we collect it, how it is stored, and the steps we take to keep it reasonably secure. Murmur is a co-working / chill product; we aim to collect only what we need to run rooms and accounts.

When you register we store:

• Email address (for sign-in)
• Password (handled by our auth provider; we do not store plaintext passwords)
• Auto-assigned username (for example Murmur1234567)
• Optional display name, bio, gender, and birthday
• Avatar style derived from username and gender (generated, not an uploaded photo by default)

You can update profile fields from the Account page. Deleting your account removes the auth user and associated profile data we control; residual copies in backups may take additional time to clear.

To make rooms work across devices we may store:

• Room settings (title, tags, join rules, feature flags)
• Chat messages and board notes you post in a room
• Presence signals (who is currently in a room) while you are online
• Saved workspace preferences (mixer, visual mood, goals) when you choose Save

Hosts own their room configuration. Dissolving a room deletes that room’s settings and related messages/notes we store for it.

Some state stays in your browser (for example guest id mirrors, temporary unlocks, or cached UI). Clearing site data on your device removes those local copies. It does not erase your cloud account.

Authentication, database, realtime presence, and file storage are provided through infrastructure partners (currently Supabase and related cloud providers). Avatar images may be loaded from a public avatar CDN (DiceBear) using a non-secret seed such as your username.

Those providers process data under their own security and privacy practices. We configure access controls (for example row-level policies) so users can only change their own profile and rooms they host, except where a feature is intentionally shared (public lobby, room chat).

We apply practical safeguards, including:

• Encrypted transport (HTTPS) between your browser and our services
• Hashed / managed credentials via the auth provider
• Database access rules so profiles and private settings are not world-writable
• Length limits and validation on user-generated text to reduce abuse
• Least-privilege service keys on the client (publishable keys only)

No online service is perfectly secure. Protect your password, avoid reusing it elsewhere, and sign out on shared computers. If you believe your account was compromised, change your password immediately and contact us if a support channel is available.

Account and room data are kept while your account / room exists. Ephemeral presence data is short-lived. We may purge inactive demo data or rotate logs as part of operations.

You may update profile information, leave rooms, dissolve rooms you host, and request account deletion. For privacy questions related to Murmur, use any contact method published on the product site when available.

We may update this policy as features evolve. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.