Privacy
What stays on your computer, what goes over the internet, and how passwords stay out of backups
Vfinity runs on your computer, and so does almost everything it keeps. This page lists what does leave it, where it goes, and how your passwords are kept apart from everything else.
What stays on your computer
Your settings, events, overlays, throwing scene, themes and Quick Deck pads are saved on this computer. So are your stream numbers, leaderboards and point balances.
Stream history keeps a summary of each LIVE, with your top supporters and their platforms, on this PC only. Nothing is uploaded. Open Past streams on the Dashboard to turn off Save stream history, or to delete one stream or all of them.
The alert history, with who sent what, is kept in memory only and is never written to disk.
What goes over the internet
| Where | What it gets | When |
|---|---|---|
| TikTok | Your username, to read your LIVE | While TikTok is connected |
| Twitch | Your sign-in, approved in your browser with a short code | While Twitch is connected |
| Kick | The channel you watch. Signing in, only needed to send chat, uses your own Kick developer app, and its secret goes straight to Kick | While Kick is connected |
| YouTube | The channel or stream link you enter. Vfinity reads the public chat the way a logged-out viewer does, with no sign-in, and sends no messages to YouTube | While YouTube is connected |
| Your text-to-speech provider | The text to be read aloud | While TTS is on |
| streamtoearn.io | Your gift region, to fetch gift names, pictures and values | When the saved catalog is over a week old, or you refresh it |
| Vfinity's release-notes service | A request for the latest release notes, and for the list of supporters shown with them | When Vfinity starts, and when you open What's New |
| Addresses you enter | Whatever a webhook step sends | When that step runs |
The TikTok helper is built on the open-source TikTok-Live-Connector library, which can use the Euler Stream signing service when it joins a LIVE.
For text to speech, the free voices are Microsoft Edge's online voices. The other providers, ElevenLabs, Speechify, Murf, Cartesia and Fish Audio, use your own account and API key.
YouTube needs no sign-in, so there is no YouTube password or token for Vfinity to keep. There is no Vfinity account to sign in to either.
Keep passwords and tokens apart
The OBS and Streamer.bot passwords, webhook authorization headers, and your Twitch and Kick sign-ins are each kept on this PC in a place of their own, never in your settings. That way a settings file you share cannot hand them to anyone.
Choose what goes into the backup file.
A backup leaves every password and token out unless you tick Include passwords and tokens. That covers the VTube Studio token and the Local API token too; a backup without them turns the Local API off when you restore it. Text-to-speech API keys are never included.
Keep that file private
A backup made with passwords and tokens lets anyone who has it use them: control VTube Studio as Vfinity, sign in to OBS or Streamer.bot, act as your Twitch or Kick account. Do not post it or send it to someone for help.
The debug log never records the VTube Studio token. When you copy logs from the Debug Console, passwords, tokens, webhook URLs, API keys and request headers are blanked out, so a log is safe to share.
Who can reach your overlays and the API
Your overlays and the Local API answer only programs on this computer. Nothing else on your network can open them.
Turn on Let OBS on another PC use these overlays and your overlays open on your home network, each URL carrying a private access key. This puts chat text, gift values and viewer names on your network, so use it at home, never on shared or public Wi-Fi.
A new access key retires every overlay URL that carries the old one. The Local API never opens to the network, even with overlay access on: it needs your API token, answers only this computer, and refuses web pages. See Local API.
Code and files from other people
The Custom Widget overlay runs HTML, CSS and JavaScript you paste into it. Read code someone sends you before you use it, the way you would any script.
Download Vfinity only from its itch.io page. It is not code-signed yet, so Windows and macOS warn you the first time; see Troubleshooting.