Privacy and Security

Secrets stay with the GM

Your LiveKit API secret, or your Jitsi app secret, is kept only in the browsers of the GMs who enter it, never in the world's settings. Players get short-lived tokens, signed for them alone by a GM's browser, for this world's room only.

sequenceDiagram
  participant P as Player's browser
  participant F as Foundry server
  participant G as GM's browser
  participant S as LiveKit or Jitsi server

  P->>F: token request
  F->>G: request, stamped with the player's user id
  Note over G: Signs a short-lived token<br/>for that player and this world's room
  G->>F: token
  F->>P: token
  P->>S: joins with the token

Loading

With LiveKit, a token allows a player to send only what the GM's permissions allow, so the server enforces a GM's block. With P2P and Jitsi, everyone else's browser refuses a blocked player's audio or video.

What the core guarantees

Whatever the other modules do:

• Mute applies to what is sent, in every state of the connection.
• A GM's block is enforced by every player's browser.
• A camera effect that isn't running keeps the camera off: your camera is never sent without it.
• The dock never shows a state that isn't so: a mute that isn't applied, a blur that isn't running.

Where audio and video go

• P2P: directly between players' browsers, or through your TURN relay if you set one. Without a relay, players' browsers learn each other's IP addresses; Send everything through the relay server prevents that.
• LiveKit: through LiveKit Cloud or your own LiveKit server.
• Jitsi: through your Jitsi server. lib-jitsi-meet's analytics, statistics and log collection stay off.

Noise cancellation, the voice effects and camera backgrounds run in your browser; no audio or video goes anywhere for them, and their files come with the modules.

Krisp, once released, will be the exception: it downloads LiveKit's package and models, and reports its use to your LiveKit Cloud project. See Noise cancellation.

The audio mixer

• Test my voice stays in your browser: the recording is played back to you and kept nowhere. While it runs muted, the table hears nothing.
• Presets are kept with your Foundry user, which every player's browser can read, so don't put anything private in a preset's name.
• GMs see your chain while a GM has the mixer's The table tab open: which effects run, where, how loud, their settings, and any warnings. Not your devices, and no audio. Your browser answers only GMs, and stops 30 seconds after the GM's window closes.
• A GM can change how you sound by laying a preset over yours. You get a notice, and can refuse that change or keep GMs out of your voice for good. What a GM's change can't do is send your voice while you are muted: mute holds as always.

The one request to GitHub

When a GM opens Plan your modules, and at most once a day when a GM loads the world, the GM's browser asks GitHub (raw.githubusercontent.com) for the list of Modular A/V modules, as Foundry's own update checks do. GitHub sees that browser's address; no cookies or page address go with it. Players never ask. Turn Check GitHub for module updates off in the core's settings to stop it.