Kith Online Privacy Policy

Effective date: 25 October 2026

Who operates Kith

Kith is maintained by Aya. For privacy questions, data requests, or account-deletion help, contact ayadea824@gmail.com.

The Kith online service is hosted by OVHcloud US on a VPS in its New York area location in the United States. Vintage Story's authentication service is operated separately by Anego Studios. This policy covers Kith's mod and online service, not Vintage Story's own privacy practices.

What Kith collects and why

Kith's online features are enabled by default. When enabled, the mod connects to the Kith service to provide sign-in, friends, presence, messages, cosmetics, hosting, screenshot sharing, and optional island backup. You can turn off Online features in Kith Settings. Turning it off stops future online use from that client; it does not itself erase data already stored on the service.

Kith processes these categories of information:

• Account and sign-in: Vintage Story account UID and player name; game version; a short-lived nonce and the Vintage Story multiplayer token used to verify the account. The token is sent to Kith and forwarded to Anego's Vintage Story authentication service for verification. Kith does not ask for your game password or receive your account session key. After verification, Kith stores its own session token as a hash on the server; your client keeps its session token in local Kith settings. Kith sessions expire after 30 days.
• Friends and communications: friend requests and relationships, blocks, group memberships, direct messages (including invites you send, which keep the world name or server address they were for), group messages, delivery/read state, and message timestamps. These are processed to deliver the features to the people in the conversation.
• Presence and server sharing: online status, the broad activity label shown in Kith (such as Kith Hub, Singleplayer, or Multiplayer), game version, Kith mod version, and last-seen information. The service keeps the latest game and mod version on your account so the maintainer can see which versions are in use and plan compatibility; they are replaced by the next update and deleted with your account. The Share server setting controls whether friends can see the multiplayer server you are on; it is enabled by default. Local and LAN server addresses are filtered from this presence field.
• Cosmetics: saved cosmetic loadout and vanity preferences, so Kith players can see each other's selected cosmetics.
• Hosting connection data: when you join or host a world, Kith processes invite and rendezvous information. To attempt a direct UDP hole-punched connection, the client asks Kith's UDP service (port 4121) for its public IP address and port, and exchanges that public endpoint plus local network candidates with the invited peer through the Kith service. The invited peer can therefore see the network addresses needed to attempt the connection. If direct connection fails, Kith can carry game traffic through its relay. The host's game remains on the host's computer.
• Screenshots: when you choose to share a screenshot, Kith uploads the reduced-size JPEG and message metadata so it can be delivered to that friend. The service retains screenshot files for up to 30 days. Messages and screenshots are not end-to-end encrypted from the Kith service; the service stores and processes them to deliver the feature.
• Island backups: if Island backup is enabled, Kith uploads the island build data for restoration on another installation. The service keeps the latest backup and one prior backup copy used as a rollback file.
• Network and service information: requests and UDP discovery necessarily expose IP addresses and connection details to the Kith service and its hosting provider. These are used to operate the service, route connections, and protect it from abuse. Kith's web front end does not keep request access logs. The service's own operational log records events such as a player name when hosting or joining starts and the game version a player uses; it never records session or multiplayer tokens.
• Update checks: while online features are on, the mod checks the Vintage Story ModDB for compatible releases once per game session. With Auto-update Kith enabled it downloads updates from ModDB; with it off (the default) it only checks when you join your hub and shows a chat message if a new version is available. These requests go to ModDB, not the Kith service, and reveal connection metadata such as IP address to ModDB. Update checks do not require your Kith account token.

Who receives information

• Kith's hosting provider (OVHcloud US): hosts the backend, database, screenshots, and island backup files on a VPS in the New York area, United States. The provider may process connection information as part of operating its infrastructure.
• Anego Studios' Vintage Story authentication service: receives the multiplayer token, UID, nonce, and game version for account verification.
• Your friends and invited peers: friends see the profile and presence information described above. Conversation members receive messages, screenshots, and group content sent to them. An invited peer receives the network candidates needed for direct connection setup. Multiplayer server details are shared only through the Share server presence setting or an invite you choose to send.
• Vintage Story ModDB: receives update-check and download requests when the mod checks for updates through ModDB.

Kith keeps daily totals for running the service, such as how many players were active, hosted or joined a world; these are numbers only, without names. Kith does not sell personal information, show advertising, or currently use third-party analytics. Kith does not share data with data brokers.

How long information is kept

• Kith login sessions expire after 30 days; one-time sign-in nonces expire after two minutes.
• Shared screenshot files and their metadata are automatically deleted after 30 days.
• Friend relationships, blocks, account profile, cosmetic loadout, and presence records are kept until you delete your Kith account. Presence status is shown as offline after a player stops checking in. If you turn online features back on after deleting your account, Kith creates a new, empty account; deleted data is not restored.
• Direct and group messages currently have no automatic expiry. Deleting your account removes your direct-message conversations and group messages you authored, along with related records.
• The service keeps the latest island backup plus a prior rollback copy until you delete your account or replace the backup. Account deletion removes the stored island backup and its rollback and temporary files.
• The service's operational log is capped at about 30 MB (three 10 MB files, oldest overwritten first) and is cleared whenever the service is updated. No access logs are kept for Kith's web address.
• Kith does not make separate backups of its database or files. The hosting provider may keep its own infrastructure backups under its terms.

Your controls and requests

Kith Settings let you turn off online features, stop sharing your multiplayer server, disable island backup, change presence, and control invites and notifications. These controls affect future sharing; they do not erase previously stored account data.

Account deletion: When signed in, Settings provides a Delete Kith account action that requires you to type DELETE before confirming. It removes your Kith account and associated service records, including sessions, profile and presence, loadout, friend requests and relationships, blocks, direct messages, group memberships and messages you authored, screenshots, and island backups. Groups you own are transferred to their longest-standing remaining member; groups with no members are deleted. On that computer, Kith also removes its saved session token, switches online features off, and clears the downloaded Kith screenshot cache. This does not delete your Vintage Story account or game worlds. If you cannot sign in to use the in-game action, contact ayadea824@gmail.com to request deletion. We may ask for enough information to verify that the request is yours. You may also request access to or correction of your data at the same address. Applicable privacy laws may give you additional rights, including the right to complain to a regulator.

Deletion cannot remove screenshots already downloaded to another player's device or messages they have already read. An already active direct hosting connection lasts until the players disconnect. If a database record or file cannot be removed during the deletion request, a periodic cleanup job removes the leftover data, normally within about 70 minutes. Your player name and game version may remain in the operational log until it is overwritten or cleared, as described above.

Security

Kith uses HTTPS for its online API and encrypted, authenticated packets for the direct hosting tunnel. The relay uses a secure WebSocket connection. We take reasonable steps to protect account and service data, but no online service can guarantee perfect security. Contact Aya at the email above if you believe your Kith account or data has been exposed.

Children

Kith is a multiplayer service and is not designed to collect information from children who are not permitted to use online services under the laws where they live. If you believe a child has provided personal information to Kith, contact Aya so the account can be reviewed and, where appropriate, deleted.

Changes to this policy

If Kith's data practices change, this policy will be updated at this address with a revised effective date. Significant changes will also be announced on the mod's ModDB page or in release notes.