Privacy & limits

What players can learn#

A player only ever receives:

• In their book: their own aliases and notes. Never real character names, account names, IDs, locations or whether someone is online.
• Overhead: an alias, Unknown or Face covered for people close by and visible, only while the key is held. Never notes or IDs.

A memory opens from someone's face only when that face can currently be recognized. Targeting a masked person never reveals that you have a memory of them.

What the server enforces#

• Ownership. Every memory belongs to one character. Editing, forgetting and reading are all checked against the character doing it, so no one can touch another character's book.
• Character identity. Only the server works out who a character is. Anything a client sends in its place is ignored.
• Distance and routing buckets. Remembering and labels are checked against real player positions and buckets on the server.
• Fresh checks. Opening someone's memory from their face gives a short-lived ticket that is checked again when saving. Logging out, switching character, changing bucket or disconnecting cancels it.
• Clean input. Lengths, valid text and forbidden characters are checked on the server. Aliases cannot contain control characters or GTA's ~ formatting codes, and nothing a player types is ever run as HTML.
• Rate limits. Each player has a request budget (Config.RateLimit), and only one request per character runs at a time.

Clothing checks#

Most appearance resources do not tell the server what someone is wearing right now; they save outfits from the player's game. So by default, before showing an alias or opening a memory, the server asks the other player's game whether their face is clear. No answer within Config.ProbeTimeoutMs, or an invalid answer, counts as a covered face.

The person looking also checks the clothing they can see every frame, and hides an alias the moment a covering or disguise appears.

This is not anti-cheat. A modified game client could lie about its own outfit.

Server-side clothing checks#

If your server keeps trusted, up-to-date data about what each player is wearing, you can check clothing on the server instead. Edit bridge/appearance_server.lua:

AppearanceServer = {}
function AppearanceServer.status(source)
    -- Return 'clear', 'covered' or 'disguised' from server-owned data.
    -- Return nil to ask the player's game instead (the default).
    return nil
end

The data must follow what is equipped at every moment, not just the last saved outfit. Return 'covered' when you cannot tell. Player-writable state bags are not trustworthy for this.

Limits no resource can remove#

• A player who has already seen an alias can write it down. Modified clients can keep what they were legitimately shown.
• Line of sight and whether someone is on screen are checked in the observer's game. The server still checks distance, buckets and clothing.
• Labels follow normal network timing. A mask put on hides the alias immediately; one taken off can take up to a refresh (Config.RefreshMs) to show it again.
• In a very large crowd, labels are capped by Config.MaxLabels and spaced apart, but not every label can be readable from every camera angle.

Where data is kept#

Memories, with their aliases and notes, are stored in your database in wolfden_rememberme. They stay until a player forgets them or your server calls DeleteCharacterData. The database holds character IDs and private notes, so treat its access like any other player data.

If you change rows directly in the database, restart wd_rememberme so it reloads them.