Privacy and safety
What leaves your computer, what does not, and why your operating system warns you on first run.
What leaves your machine
Three things, and only these:
| Goes out | Why |
|---|---|
| The TikTok LIVE connection | To read your room. It is a read connection: Vfinity never posts, comments, follows or sends gifts |
| The gift catalog fetch | To get gift names, images and diamond values, cached afterwards so it works offline |
| Text-to-speech requests, if you use a paid provider | Only the message text, only to the provider you chose, only if you turn it on. The default Edge voices are local |
What stays
- Your settings, mappings, throwing scene and themes, on your disk
- The overlay server, bound to
127.0.0.1and refusing non-local origins. Other machines on your network cannot reach it - The VTube Studio connection, which is local
- Viewer names and stats
There is no Vfinity account, no telemetry, and no server of ours for anything to be sent to.
No password, ever
Vfinity does not ask for your TikTok password, and there is no field to type one into. Reading a public LIVE room does not require signing in.
If a program claiming to be Vfinity ever asks for your TikTok credentials, it is not Vfinity.
Why your computer warns you
Vfinity is not code-signed. Code signing certificates cost money per year, and this is a free project.
That means:
- Windows shows a SmartScreen warning on first run. More info, then Run anyway.
- macOS refuses to open it from a double-click. Right-click and choose Open.
Those warnings mean "this publisher has not paid for a certificate", not "this file is known to be harmful". Download only from the itch.io project page; a copy from anywhere else is a copy nobody here can vouch for.
The one file to be careful with
A settings backup can optionally include your VTube Studio authentication token.
With the token, anyone holding that file can control your VTube Studio plugin. The export leaves it out by default and labels it SENSITIVE. Do not post a backup that includes it anywhere public.
Without the token, a restored backup works fine. VTube Studio just asks you to approve Vfinity once more.
Custom widgets run your code
The Custom Widget overlay runs HTML, CSS and JavaScript in a sandbox. It is your code running on your machine, so treat a widget someone sends you the way you would treat any script: read it first.
Commercial streams
Nothing stops you using Vfinity on a monetised stream. There is no licence fee and no revenue share.