BestVTT

Privacy notice

Alpha

In short

BestVTT is an early alpha. This notice describes what the software running this site does with your data. It is a description, not a certification: it makes no claim of legal compliance.

Contact details have not been configured by the operator yet.

01 / Your account

Username, password and email

  • Your account stores a username and a password hash. The password itself is never stored.
  • Email is optional and unverified. It is not used for account recovery, and there is no password recovery: keep your password somewhere safe.
  • New accounts are not open yet; existing users can log in.

02 / Uploads

Uploaded files are public by link

Files you upload (maps, images and other assets) are stored under a name derived from their content and served at that address without a login. Anyone who has the link can open the file. Do not upload anything you would not want seen by someone who obtains the link.

03 / Sessions

One encrypted session cookie

  • Logging in sets an encrypted session cookie. A session lasts at most 30 days from the moment you log in, however active you are; then you log in again.
  • Changing your password signs out every other device. Sign out everywhere in your settings ends every session of your account.
  • The cookie is marked Secure and SameSite=Lax only when the operator enables PA_SECURE_COOKIES. The provided Docker deployment enables it by default; serving the site over HTTPS does not set these flags by itself.

04 / Logs

What the server records

  • Application logs go to the server container's standard output.
  • Web server access logs: the Caddy reverse proxy logs each request, including your IP address. The documented configuration keeps 10 log files for at most 720 hours (30 days).
  • fail2ban: when installed on the host, it blocks addresses that repeatedly fail to log in and exports its ban records, including the banned IP addresses, to the operator's dashboard.
  • Traffic metrics: the operator's dashboard counts requests and response times per route. These counters are aggregate and do not record who made a request.

05 / Retention

How long things are kept

  • Game session transcripts (the room's chat and rolls) keep the latest 20 sessions per room by default; older ones are deleted.
  • The deployment keeps the last 10 database backups by default.
  • Rooms, characters, uploads and the rest of your game data stay until they are deleted.

06 / Deleting your account

What account deletion does

Deleting your account in your settings removes your account's database records and signs out its sessions. It does not promise to erase uploaded files, existing backups or logs.

07 / Third parties

Google Fonts

The app (not these public pages) loads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address to Google when you open it. There is no advertising or third-party analytics.

AI features (map and NPC generation) are disabled.