Akashic Abyss Companion privacy policy

What it does

The companion works only after the visitor presses Grant access. It reads the VRChat auth session cookie that already belongs to that browser, verifies the session directly with VRChat, and sends an explicit Invite me request directly to VRChat.

For Sign in with companion, the companion reads the public VRChat user id and display name locally. The Atlas page sends that public id to the Atlas server to begin a one-time sign-in attempt. The companion temporarily replaces the visitor's VRChat status with the short proof from that attempt. The Atlas server reads that public proof through its own reader account, never through the visitor's session.

The companion saves the visitor's original status only in its own browser-local extension storage while that proof is active. It restores the original status immediately after the check and deletes the temporary record. If the browser closes in the middle, the next companion account check restores a proof that was left behind. The original status is never sent to Akashic, placed in the companion record, or used for analytics.

It never sends a password, VRChat cookie, VRChat session, or two-factor code to Akashic.

Permissions

activeTab

reads only the address of the tab from which the visitor opened the popup. It can prefill a valid wrld_ id from an Akashic world page. It never clicks, changes, or reads page content.

cookies

reads the VRChat website auth cookie only after VRChat host access is granted. Firefox and Zen attach it to direct API requests. Chrome copies it into the browser's own VRChat API cookie jar for the same purpose.

storage

holds an original VRChat status temporarily, only for restoring it after companion sign-in. It is deleted after restoration and is never sent to Akashic.

• Firefox and Zen use webRequest and webRequestBlocking only for API requests to api.vrchat.cloud, only to attach that auth cookie when the request has none.
• Host access is limited to vrchat.com, api.vrchat.cloud, and the Atlas domain where the page bridge runs.

Browser-local data

The companion keeps a short, in-memory activity record for its popup. It names requests and outcomes but never a password, cookie value, two-factor code, original status, or proof value.

The Atlas site keeps its guest Library, notes, playlists, saved worlds, and settings as JSON in the visitor's browser storage. The Library's Export and Import controls let the visitor move that JSON themselves.

Network destinations

The companion sends VRChat requests only to https://vrchat.com/ and https://api.vrchat.cloud/api/1. It does not send the original VRChat status, a VRChat cookie, or a VRChat session to Akashic, tracking, analytics, advertising, or any other endpoint.

Contact

The source and release notes are published with the Akashic Abyss Atlas project. Report a problem without including a password, one-time code, cookie value, or personal status text.

Back to what the companion does. The same text ships inside the package as PRIVACY.md, so the page you are reading and the file the browser stores received are the same words.