Private by construction, not by setting

# minting (API, on GET /api/rooms/:id/playback-urls)
exp  = now + 120s
msg  = f"{object_key}|{room_id}|{session_id}|{exp}|{ip_prefix}"
sig  = base64url(hmac_sha256(MEDIA_SIGNING_KEY, msg))
url  = f"https://partmov.example/media/{object_key}?e={exp}&s={session_id}&r={room_id}&sig={sig}"

# verifying (media gate, per segment request)
1. exp has not passed                     → else 403 expired
2. sig matches recomputed HMAC            → else 403 bad_signature
3. session is an active participant of room → else 403 not_in_room
4. room.status = 'active' and asset not taken down → else 403 unavailable
5. ip_prefix matches /24 (v4) or /48 (v6) → else 403 moved
6. proxy the byte range from MinIO; never redirect to a storage URL

# rotation: two signing keys are live at once (current + previous) so key
# rotation never invalidates a film that is already playing.

• Why not presigned S3 URLs? A presigned MinIO URL is valid for its whole TTL to anyone who holds it and cannot be revoked. A gate can check room membership, takedown status, and revocation on every single request.
• Stopping casual downloads. Segment URLs are short-lived and IP-prefix bound, and the master playlist is signed separately. Someone determined can still reassemble segments they are authorised to watch — that is true of every non-DRM player on the web, and the design says so rather than pretending otherwise.
• Where DRM would fit.If licensed catalogue content ever requires it, the path is Widevine or PlayReady with an open-source licence server such as Shaka Packager plus an EME integration. It costs a per-title packaging step, browser-specific failure modes, and — decisively — the loss of fine-grained playback control on some platforms, which is the product’s core promise. So DRM stays out until a contract requires it, and never applies to user uploads.

• Structural isolation. Object keys embed the owner id, every asset query is scoped by owner_id, and the media gate re-derives ownership from the room rather than trusting the request.
• Deletion is a pipeline, not a flag. DELETE /api/assets/:id marks the asset deleting, closes dependent rooms with reason: asset_removed, revokes their invitations, then a purge worker deletes the originals prefix, the renditions prefix, subtitle objects, poster, and sprites — verifying with a list call that zero objects remain before writing asset.purged to the audit log.
• Backups respect deletion. Media backups are prefix-synchronised with mc mirror --remove, so a purge propagates. Database backups older than the purge are the only place a title reference survives, and they age out on a 30-day schedule.
• Account deletion. Cascades to assets, rooms, invitations, and sessions; enqueues purge jobs for every prefix; and leaves behind only anonymised audit rows with a null actor.

The verification step matters. A purge that does not confirm an empty prefix is a promise, not a deletion — so the job fails loudly and retries rather than reporting success.

• No third-party scripts, no advertising or analytics SDKs, no fingerprinting, no cross-site cookies.
• Access logs store an IP prefix rather than a full address, and are dropped after 14 days.
• Metric labels are bounded: room and user ids never become label values, so cardinality stays flat and dashboards cannot become a viewing history.
• Client telemetry is aggregate-first: the browser reports buffer and drift numbers, never a list of titles.

Threat model, stated plainly. Partmov defends against link leakage, room enumeration, cross-tenant reads, direct storage access, casual scraping, and operator over-collection. It does not defend against a participant recording their own screen, and it does not claim to.