Privacy Policy
Last updated: September 5, 2026
VRChat Worlds Manager Web ("the app") runs entirely in your browser. Most of the data it handles never leaves your device. This page explains what the app stores, where it stores it, and where it sends anything at all.
The following is kept only in your browser's own storage (IndexedDB and localStorage). None of it is sent to a server run by the app's author.
- Your favorite worlds, folders, memos, tags, hidden-world settings, and the instances you have created
- Settings such as theme, language, and how things are displayed
- The authentication token used to sign in to VRChat
A browser cannot call VRChat's API directly, so the app goes through a relay running on Cloudflare Workers. That relay forwards your request to VRChat as-is and hands the response back as-is.
- Your VRChat username, password, and authentication token pass through the relay. They are not stored: they are discarded once forwarded.
- Your world data and folders are never stored on the relay.
- To rate-limit abuse, the relay briefly records the IP address a request came from. That record is deleted automatically after two hours.
Connecting Google Drive from the settings screen lets the app keep your data in your own Google Drive so several devices can share it. This is optional; without it, everything except syncing works exactly as before.
- The only permission the app asks for is drive.file, which grants access solely to files the app itself created. It cannot read anything else in your Drive.
- Synced data is stored only in your own Google Drive. The app's author cannot see its contents.
- The Google access token is held in browser memory only and is never persisted. Reloading the page discards it.
- Your VRChat credentials are never sent to Google Drive.
The app uses no analytics and no advertising tools, and sets no cookies for tracking.
The app does not share or sell your data to anyone. The traffic to VRChat and Google Drive described above happens because you asked for it, and sends your data on your behalf.
- Clearing this site's data in your browser erases everything held on the device.
- Data in Google Drive is erased by deleting the file from your Drive.
The Google access you granted this app can be revoked here: https://myaccount.google.com/permissions
Questions about this policy are welcome as a GitHub Issue.