# Privacy & limits

What the server enforces, what players can learn, and what no resource can prevent.

## What players can learn

A player only ever receives:

- **In their book:** their own aliases and notes. Never real character names, account names, IDs, locations or whether someone is online.
- **Overhead:** an alias, **Unknown** or **Face covered** for people close by and visible, only while the key is held. Never notes or IDs.

A memory opens from someone's face only when that face can currently be recognized. Targeting a masked person never reveals that you have a memory of them.

## What the server enforces

- **Ownership.** Every memory belongs to one character. Editing, forgetting and reading are all checked against the character doing it, so no one can touch another character's book.
- **Character identity.** Only the server works out who a character is. Anything a client sends in its place is ignored.
- **Distance and routing buckets.** Remembering and labels are checked against real player positions and buckets on the server.
- **Fresh checks.** Opening someone's memory from their face gives a short-lived ticket that is checked again when saving. Logging out, switching character, changing bucket or disconnecting cancels it.
- **Clean input.** Lengths, valid text and forbidden characters are checked on the server. Aliases cannot contain control characters or GTA's `~` formatting codes, and nothing a player types is ever run as HTML.
- **Rate limits.** Each player has a request budget (`Config.RateLimit`), and only one request per character runs at a time.

## Clothing checks

Most appearance resources do not tell the server what someone is wearing right now; they save outfits from the player's game. So by default, before showing an alias or opening a memory, the server asks **the other player's game** whether their face is clear. No answer within `Config.ProbeTimeoutMs`, or an invalid answer, counts as a covered face.

The person looking also checks the clothing they can see every frame, and hides an alias the moment a covering or disguise appears.

This is not anti-cheat. A modified game client could lie about its own outfit.

## Server-side clothing checks

If your server keeps trusted, up-to-date data about what each player is wearing, you can check clothing on the server instead. Edit `bridge/appearance_server.lua`:

```lua bridge/appearance_server.lua
AppearanceServer = {}
function AppearanceServer.status(source)
    -- Return 'clear', 'covered' or 'disguised' from server-owned data.
    -- Return nil to ask the player's game instead (the default).
    return nil
end
```

The data must follow what is equipped at every moment, not just the last saved outfit. Return `'covered'` when you cannot tell. Player-writable state bags are not trustworthy for this.

## Limits no resource can remove

- A player who has already seen an alias can write it down. Modified clients can keep what they were legitimately shown.
- Line of sight and whether someone is on screen are checked in the observer's game. The server still checks distance, buckets and clothing.
- Labels follow normal network timing. A mask put on hides the alias immediately; one taken off can take up to a refresh (`Config.RefreshMs`) to show it again.
- In a very large crowd, labels are capped by `Config.MaxLabels` and spaced apart, but not every label can be readable from every camera angle.

## Where data is kept

Memories, with their aliases and notes, are stored in your database in `wolfden_rememberme`. They stay until a player forgets them or your server calls [`DeleteCharacterData`](#/docs/wd_rememberme/exports?section=character-deletion). The database holds character IDs and private notes, so treat its access like any other player data.

If you change rows directly in the database, restart `wd_rememberme` so it reloads them.