JonKazama-Hellion
6e24885241
Removing BetterTTV took out the plugin's only outbound network call, and five documents were still describing it as present. PRIVACY.md led with "one outbound network call exists by design" -- the opposite of what shipped an hour ago, and the one claim in that file people actually check. PRIVACY.md now opens with none at all. The section that described the call is kept and marked as removed rather than deleted, so the claim can be read against what it replaced: the startup fetch meant BetterTTV saw an IP as soon as the plugin loaded, whether an emote ever appeared or not. Worth leaving visible. BetterTTV also comes out of the third-party table, which now lists only the two parties nobody using this plugin through Dalamud can avoid. SECURITY.md listed the EmoteCache HTTP client as in scope for reports. There is nothing there to report on. THIRD_PARTY_NOTICES.md named the call as current; both entries it has ever carried are now historical. README dropped the pointer to the outbound call and the switch for it, a stability bullet about a crash fix in code that no longer exists, and the line in the Chat 2 migration that moved an emote cache directory nothing reads. ROADMAP gained 2.0.1 and 2.0.2, and a section for what the 2.0.0 push left behind: 47 overlong comment blocks, channel names translated in only ten of the 25 languages, an orphaned EmoteCacheV1 directory on anyone who ran an older build, and the deprecated GlobalScaleSafe call that is the last compiler warning in the build.
243 lines
12 KiB
Markdown
243 lines
12 KiB
Markdown
# Privacy notice
|
|
|
|
HellionChat is a Dalamud plugin for FINAL FANTASY XIV, focused on giving the user explicit control
|
|
over what their chat client stores locally. This document describes what the plugin does with your
|
|
data, what it does not do, and how you exercise the rights the GDPR gives you over data you generate
|
|
yourself.
|
|
|
|
This document is informational. The maintainer of HellionChat is **not** a controller or processor
|
|
of your data in the GDPR sense, because no data ever leaves your machine on the maintainer's
|
|
infrastructure. Independently of that, the plugin is built so that you can act on your own data the
|
|
way the GDPR expects.
|
|
|
|
Last reviewed: 2026-08-18 (HellionChat v1.12.0).
|
|
|
|
---
|
|
|
|
## TL;DR
|
|
|
|
- All chat data the plugin stores stays on your machine, in your Dalamud
|
|
`pluginConfigs/HellionChat/` directory.
|
|
- The plugin does not phone home. No telemetry, no analytics, no crash reporter, no usage counter,
|
|
no remote update check beyond what Dalamud itself does.
|
|
- As of v2.0.2 the plugin makes **no outbound network requests at all**. The one that existed, the
|
|
BetterTTV emote service, was removed along with the feature it served.
|
|
- You can export every message the plugin has stored, in Markdown, JSON or CSV. You can delete it by
|
|
channel, by age, or all of it at once.
|
|
|
|
---
|
|
|
|
## What the plugin stores locally
|
|
|
|
HellionChat keeps three kinds of state on your machine, all under
|
|
`%appdata%\XIVLauncher\pluginConfigs\HellionChat\` on Windows
|
|
(`~/.xlcore/pluginConfigs/HellionChat/` on Linux/macOS via XIVLauncher Core):
|
|
|
|
1. **Configuration** (`HellionChat.json`). Plugin settings, channel whitelist, retention values,
|
|
layout state, theme colours. Contains no chat content.
|
|
|
|
2. **Message database** (SQLite file in the same directory). Chat messages from the channels on your
|
|
whitelist, stored as MessagePack-encoded blobs. The default whitelist out of the box covers only
|
|
your own conversations: tells, party, free company, linkshells, cross-world linkshells, alliance,
|
|
ExtraChat. Public chat, NPC dialogue, system messages and battle logs are dropped on the storage
|
|
layer and never written to disk.
|
|
|
|
Earlier versions kept a third item here, an `EmoteCacheV1/` directory of images downloaded from
|
|
BetterTTV. Nothing writes to it as of v2.0.2. If you used a version before that, the directory is
|
|
still on disk and can be deleted by hand; the plugin no longer reads or creates it.
|
|
|
|
There is no shared state with the upstream Chat 2 plugin. `pluginConfigs/HellionChat/` is
|
|
independent from `pluginConfigs/ChatTwo/`.
|
|
|
|
### Retention defaults
|
|
|
|
- Tells: 365 days
|
|
- Your-conversation channels (party, FC, linkshells, cross-world LS, alliance, ExtraChat): 90 days
|
|
- Global default for anything else: 30 days
|
|
|
|
**Retention is off by default.** The plugin does not delete anything on its own until you explicitly
|
|
turn the retention sweep on in the settings. Until then, stored messages stay until you clear them.
|
|
|
|
---
|
|
|
|
## What the plugin does not store
|
|
|
|
- Public chat (`/say`, `/yell`, `/shout`), NPC dialogue, system messages and battle logs. These are
|
|
filtered before they reach the storage layer.
|
|
- Anything from channels you remove from the whitelist. The privacy filter runs on the way in, not
|
|
on the way out.
|
|
- Login credentials, character IDs, account IDs. The plugin uses whatever Dalamud already exposes
|
|
about the local character to attribute messages. Nothing of that is sent anywhere or persisted
|
|
beyond the message itself.
|
|
|
|
---
|
|
|
|
## Outbound network calls
|
|
|
|
**None.** As of v2.0.2 the plugin makes no automatic outbound network requests of any kind. Both
|
|
calls this section used to describe are gone, and the section is kept so the claim can be checked
|
|
against what it replaced rather than simply asserted.
|
|
|
|
### 1. BetterTTV emote service (removed in v2.0.2)
|
|
|
|
Until v2.0.2 the plugin fetched an emote list from `api.betterttv.net` once per session at startup,
|
|
and individual images from `cdn.betterttv.net` on demand, caching them in `EmoteCacheV1/`. The
|
|
startup fetch meant BetterTTV's edge saw your IP as soon as the plugin loaded, whether or not an
|
|
emote ever appeared in your chat. A setting could switch it off, but it was on by default.
|
|
|
|
The feature was removed rather than defaulted off: BetterTTV moved its shared-emote endpoint behind
|
|
authentication, which left 54 mostly static images from a set of 65, and that is not worth a
|
|
connection nobody asked for. The download path, the cache directory and the renderer are gone from
|
|
the source.
|
|
|
|
Messages already stored with emotes in them remain readable and show the code that was typed.
|
|
|
|
### 2. Square Enix Lodestone font (removed in v1.0.4)
|
|
|
|
Earlier versions of HellionChat (and upstream Chat 2) downloaded `FFXIV_Lodestone_SSF.ttf` from
|
|
`img.finalfantasyxiv.com` once during font setup. That code path was a leftover from upstream's
|
|
removed webinterface feature and was no longer consumed anywhere. The in-game symbol glyphs (job
|
|
icons, item glyphs, status effects) come from Dalamud's bundled symbol-font helper, not from the
|
|
downloaded TTF.
|
|
|
|
The download was removed in v1.0.4. As of that version HellionChat makes no automatic network call
|
|
to Square Enix or to any `finalfantasyxiv.com` host.
|
|
|
|
Cached `FFXIV_Lodestone_SSF.ttf` files left over from earlier versions remain in
|
|
`pluginConfigs/HellionChat/` until manually deleted. They are no longer read.
|
|
|
|
### Links you click yourself (no automatic traffic)
|
|
|
|
The About tab contains buttons that open external pages in your browser when you click them: the
|
|
Hellion Forge Discord invite, the HellionChat Gitea repository, its custom-repo manifest, and --
|
|
when the Honorific integration row is shown -- that plugin's GitHub repository and its author's
|
|
profile. Nothing happens until you click. They are documented here for completeness, not because
|
|
they generate background traffic.
|
|
|
|
---
|
|
|
|
## What the plugin does not do
|
|
|
|
- **No telemetry.** Source verified: no calls to AppInsights, Sentry, PostHog, Plausible, Google
|
|
Analytics, Microsoft Clarity or any comparable service exist in the codebase, nor in the direct
|
|
dependencies the plugin pulls in. See `docs/THIRD_PARTY_NOTICES.md`.
|
|
- **No crash reporting.** Crashes go to Dalamud's local `xllog`, not to a remote endpoint controlled
|
|
by HellionChat.
|
|
- **No usage counters.** The plugin does not count installs, sessions, feature usage, channel
|
|
activity or anything else for the maintainer.
|
|
- **No phone-home update check.** Updates are delivered through Dalamud's plugin installer, which
|
|
polls the custom-repo `repo.json` on GitHub. That is GitHub's traffic and falls under GitHub's
|
|
privacy policy. The plugin code does no separate update check.
|
|
- **No background sync.** Messages stay on your machine. No cloud backup, no sharing feature, no
|
|
remote viewer.
|
|
|
|
---
|
|
|
|
## Your data, your rights
|
|
|
|
The GDPR gives you specific rights over data about you. Because HellionChat stores everything
|
|
locally, those rights translate directly into plugin features:
|
|
|
|
### Right to access (Art. 15)
|
|
|
|
Settings → Data & Privacy → Export. You can export to **Markdown**, **JSON** or **CSV**, narrowed by
|
|
channel group, by age in days, or by a substring of the sender's name. The export goes through a
|
|
Dalamud file dialog and writes wherever you point it, on your machine. It reads the database on its
|
|
own connection and writes to a temporary file first, so a run that is interrupted leaves the
|
|
previous export in place rather than a file that looks complete and is not.
|
|
|
|
### A note on the v1.12.0 filter correction
|
|
|
|
Before v1.12.0 the privacy filter applied the unknown-channel failsafe to known channels as well, so
|
|
a channel you had unticked was still stored whenever that failsafe was on -- which is its default.
|
|
That is fixed: an unticked channel stays out.
|
|
|
|
One consequence is worth stating plainly. A configuration that had the filter on, the failsafe on
|
|
and no channel selected was storing everything through that hole. The corrected rule would store
|
|
nothing at all, so the upgrade turns the filter off for exactly those configurations and writes a
|
|
line to `/xllog` saying so. Nothing changes about what is stored; it is now stated where you can see
|
|
it. Pick your channels and switch the filter back on whenever you like.
|
|
|
|
### Right to erasure (Art. 17)
|
|
|
|
Two options:
|
|
|
|
1. **Targeted deletion.** Settings → Data & Privacy → Cleanup applies your current channel list to
|
|
the messages already stored. It shows a preview of what will be removed before you confirm with
|
|
Ctrl+Shift, runs in the background, and calls `VACUUM` afterwards to actually shrink the file.
|
|
Channels this build does not recognise -- ones a game patch added after the plugin was released
|
|
-- survive the cleanup while "save unknown channel types" is on, for the same reason they are
|
|
stored in the first place: so the decision about them stays yours.
|
|
|
|
The cleanup is only offered when it can mean something. With the privacy filter off, every
|
|
channel is stored and nothing contradicts your settings; with no channel selected, a cleanup
|
|
would delete everything, and that is what the clear button is for. Both cases say so instead of
|
|
offering a button that does not do what it looks like.
|
|
|
|
2. **Full deletion.** Close the game and delete the `pluginConfigs/HellionChat/` directory. The next
|
|
plugin start will produce a fresh, empty configuration.
|
|
|
|
### Right to portability (Art. 20)
|
|
|
|
The JSON and CSV exports are open formats. The Markdown export is human-readable and
|
|
machine-parseable. Nothing is locked into a proprietary container.
|
|
|
|
### Right to object / restrict processing (Art. 21, 18)
|
|
|
|
Adjust the channel whitelist or set retention to a low value. Both take effect immediately on new
|
|
messages. Existing data needs the retroactive cleanup to apply retroactively, by design.
|
|
|
|
---
|
|
|
|
## Third parties involved
|
|
|
|
| Party | Why they appear | What reaches them | Their privacy policy |
|
|
| ---------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------ | -------------------------------------- |
|
|
| Hellion Forge (Gitea, self-hosted by Hellion Online Media) | Plugin distribution via custom repo, issue tracker | Whatever the Gitea instance sees from any HTTPS request to a public repo | <https://hellion-media.de/datenschutz> |
|
|
| Dalamud / XIVLauncher (goatcorp) | Plugin loader, font subsystem, repo polling | Whatever Dalamud reports for itself; out of HellionChat's scope | <https://github.com/goatcorp/Dalamud> |
|
|
|
|
Both are unavoidable for anyone using HellionChat through Dalamud at all. Since v2.0.2 the plugin
|
|
introduces no third party on top of that baseline: BetterTTV was the only one, and it left with the
|
|
emote feature.
|
|
|
|
---
|
|
|
|
## Dependencies that touch the network
|
|
|
|
For a full dependency inventory see `docs/THIRD_PARTY_NOTICES.md`. Of the direct dependencies the
|
|
plugin pulls in:
|
|
|
|
- `MessagePack`: local serialisation, no network.
|
|
- `Microsoft.Data.Sqlite`: local SQLite access, no network.
|
|
- `morelinq`: LINQ helpers, no network.
|
|
- `Pidgin`: parser combinators, no network.
|
|
- `SixLabors.ImageSharp`: image decoding (icon handling), no network on its own.
|
|
|
|
No dependency opens a connection on the plugin's behalf, and since v2.0.2 the plugin opens none
|
|
itself either.
|
|
|
|
---
|
|
|
|
## Changes to this notice
|
|
|
|
If a future release changes what HellionChat stores, sends or caches, this document will be updated
|
|
and the change called out in the changelog block of that release. The "Last reviewed" date at the
|
|
top tracks the version this document is accurate for.
|
|
|
|
---
|
|
|
|
## Questions
|
|
|
|
For privacy-related questions specific to HellionChat:
|
|
|
|
- Email: `kontakt@hellion-media.de`
|
|
- Discord DM: `@j.j_kazama`
|
|
|
|
Security-relevant findings (for example, the plugin storing or sending something this document says
|
|
it does not) go through the private advisory in `SECURITY.md`, not a public issue.
|
|
|
|
---
|
|
|
|
Maintained under **Hellion Forge**, the modding and plugin line of **Hellion Online Media** | Bad
|
|
Harzburg | [hellion-media.de](https://hellion-media.de)
|