Building MyZubster World: A Privacy-First Metaverse Connected to a Circular Marketplace
MyZubster is evolving from a marketplace into a connected digital ecosystem where identity, communities, real-world projects, and virtual spaces can interact.
We are building this progressively and transparently. The current metaverse is still experimental: it is not a finished 3D universe, and we do not want to present prototypes as completed products.
Our goal is to create a privacy-conscious social environment connected to the MyZubster marketplace.
What is MyZubster World?
MyZubster World is an experimental metaverse layer where registered users can enter a shared environment using a verified MyZubster character.
Instead of creating an unrelated virtual identity every time, an authenticated account can be linked to a persistent character. For example, my account is connected to my verified character, H4x0r.
The server—not the browser—determines which character belongs to the authenticated account. This helps prevent users from claiming another person’s identity by simply modifying local browser data.
Explore the current metaverse:
Enter MyZubster World
What we have implemented
Verified character identity
Authenticated accounts can be connected to persistent metaverse characters.
The system currently distinguishes between:
- Verified account-linked characters
- Unverified guest identities
- Local browser profiles
- Canonical server-side identities When an authenticated user enters the metaverse, the platform retrieves the verified character from the database instead of trusting a name submitted by the client. Persistent mission progress Users can visit landmarks and progressively explore the virtual environment. For verified characters, completed landmark visits are saved server-side. This means progress can follow the account across devices and browser sessions. Shared presence and synchronization MyZubster World currently uses a database-backed polling system for shared presence. It supports:
- Player presence
- Position synchronization
- Chat messages
- Emotes
- Reconnection states
- Temporary presence expiration
- Short-term chat retention This is an intentionally pragmatic solution for a serverless deployment. A dedicated realtime infrastructure may replace it when the number of concurrent users justifies that complexity. Server-authoritative virtual rooms We have introduced virtual rooms with a controlled lifecycle: Draft → Published → Scheduled → Live → Ended → Archived Transitions are validated by the server and cannot arbitrarily move backwards. Room hosts can currently:
- Create a room draft
- Select an access policy
- Configure room capacity
- Publish the room
- Schedule a session
- Start the session
- End the session
- Inspect a privacy-safe event timeline Participants can join and leave live sessions, while capacity and authorization are enforced server-side. Public, authenticated, and private rooms Rooms can use three access policies:
- Public: visible without authentication
- Authenticated: available to signed-in users
- Private: accessible only to explicitly authorized accounts Private rooms do not appear in public discovery results. Unauthorized requests receive a generic “not found” response, reducing the amount of information disclosed about private spaces. Secure private invitations Hosts can generate invitation links for private rooms. The invitation system includes:
- Cryptographically generated codes
- SHA-256 hashed storage
- Constant-time code comparison
- A 24-hour expiration
- One-time redemption
- Immediate host revocation
- Automatic invalidation of the previous link
- Login redirection that preserves the invitation
- Continued rejection of blocked accounts The API used to inspect invitation status exposes only whether the invitation is active and when it expires. It never returns the original code or its stored hash. Privacy is part of the architecture Privacy is not only a slogan or visual setting. We are designing boundaries directly into the system:
- Private rooms are excluded from discovery.
- Participant identifiers are not shown in public session events.
- Authentication tokens are short-lived.
- Invite codes are not stored in plain text.
- Character identities are verified by the server.
- Sensitive request contents are excluded from production logs.
- Access rules are revalidated when joining a session.
- Expired authentication sessions return users to a fresh login path. These controls do not make the platform “perfectly private.” They are concrete foundations that can be reviewed, tested, and improved. Connecting the metaverse to the marketplace The metaverse is not intended to be an isolated virtual world. It will become a visual gateway into the MyZubster marketplace: Explore the MyZubster Marketplace The marketplace explores several interconnected communities and activities, including:
- Underground and alternative subcultures
- Kefir and community-based cultivation
- Plant documentation and exchange
- University assistance and knowledge sharing
- Creative and technical collaboration
- Privacy-conscious digital services The central idea is a circular system. A user may discover a community in the metaverse, learn from it, contribute to a project, offer or request help through the marketplace, and bring the resulting knowledge back into the virtual community. Discover → Learn → Collaborate → Exchange → Document → Share → Discover again For example, a cultivation project could document its progress, connect with contributors, share knowledge through a virtual room, and eventually offer related resources or services through the marketplace. Where Monero may fit We are also evaluating Monero as a possible payment option for suitable marketplace transactions. The objective is not to add cryptocurrency merely as a label. We first need to evaluate:
- Secure payment verification
- Wallet architecture
- Refund and dispute workflows
- Pricing and exchange-rate handling
- Regulatory responsibilities
- Data minimization
- Operational security Monero payments are therefore part of the research and development roadmap, not a claim that the complete production payment infrastructure already exists. What we want to build next Our current roadmap includes: Better room moderation Hosts will need tools to manage participants without publicly exposing account identifiers. This may include:
- Participant removal
- Access revocation
- Block and unblock controls
- Moderation events
- Role-based permissions Stage and speaker requests Rooms already define a stage policy. The next step is turning it into an interactive workflow where participants can request permission to speak and hosts can approve or reject requests. Connection to the immersive client The current room page validates identity, permissions, invitations, capacity, and lifecycle state. The next major milestone is connecting an authorized live session to the immersive environment while preserving the same server-side rules. Marketplace destinations inside the world Marketplace categories may become explorable destinations rather than ordinary navigation cards. A user could walk into areas dedicated to:
- Kefir and cultivation
- Underground culture
- University collaboration
- Digital creators
- Privacy technology Each destination should lead to real marketplace content instead of being decorative scenery. Realtime infrastructure Our polling implementation is appropriate for the current experimental phase. Future versions may introduce a dedicated realtime transport for:
- Faster movement synchronization
- Room-scoped chat
- Presence updates
- Moderation events
- Collaborative activities We will make this transition only when it produces a measurable benefit. Building in public MyZubster is an open-source project, and we are building it one verifiable component at a time. Recent development has focused on the less visible but essential foundations: identity, authorization, lifecycle rules, private access, invitations, session history, and safe failure handling. The visual experience will continue to grow, but it must be supported by reliable rules underneath. If you are interested in privacy, open-source communities, virtual spaces, circular marketplaces, Monero integration, or experimental social platforms, we would love your feedback.
- Try MyZubster World
- Explore the Marketplace
- View the project on GitHub
- Learn how MyZubster works What kind of community or marketplace experience would you want to enter through a privacy-first virtual world?
