Privacy Policy

Effective: 9 October 2026 · Last updated: 12 October 2026 (web session update)

00Controller, scope, and language

Operational controller: Void Scriptor, an independent studio managed by Choirudin. Contact for privacy questions, data requests, and legal correspondence: [email protected]. We do not claim this name is a legal entity separate from its owner/operator.

This policy covers the Void Scriptor website, accounts and dashboard, Byte Assistant, Void Scriptor Studio for Windows, and QOWNER Quiz Maker when the mobile app is released. Studio is still a preview and QOWNER for iOS/Android is not yet available for download; therefore, mobile-app telemetry and crash reporting are not active through this service. If telemetry or crash-report collection is enabled, this policy will be updated before the feature is used.

The Indonesian version controls if there is any difference. The English paragraphs on this page are summaries to help international readers. For processing subject to Indonesian law, we design the services with regard to Law No. 27 of 2022 on Personal Data Protection. The GDPR applies only if its conditions for application are met; this page does not state that the GDPR always applies.

Void Scriptor is an independent studio operated by Choirudin. Indonesian is the controlling language. This policy covers the website, account dashboard, Byte Assistant, Windows Studio, and QOWNER when released. It is an operational draft, not legal advice.

01Data we process

We aim to process as little data as possible (data minimization):

• Account data (sign-in with GitHub/Google): when you sign in, the login service shares your account ID, display name, username, email address, and profile photo URL with us. We use it to identify your account, display your identity, and connect the website with applications using the same account service. Account profiles, login data, one-time login codes, and active sessions are stored in Cloudflare D1. We never receive or store passwords and do not store access tokens for GitHub/Google: the login-service token is used once on the server to read the profile and then discarded. Applications receive a random Void Scriptor session token that lasts 24 hours and can be revoked on the server.
• Google Drive (optional): when you choose Connect Google Drive, the server receives a Google Drive refresh token to create a temporary access token when uploading a snapshot. The refresh token is stored in encrypted form using the Worker secret and is never sent to the browser or displayed in the API. We store references to backup files created by the application, not workspace contents; the remote file is named voidscriptor-account-backup.json and contains only an account snapshot you saved. Disconnecting removes local credentials from D1 but does not delete the remote file.
• Profile information you provide: the dashboard may store your display name, public username, short bio, account language, time zone, profile visibility choice, QOWNER alias, and leaderboard choice. Your username and profile are shown on public pages only if you choose Public visibility; your email and login provider are never shown there. Your QOWNER alias may be shown on a leaderboard only if you grant that permission.
• QOWNER release interest (optional): if you enter an email and check consent on the QOWNER page, we store the normalized email address, form source, consent time, and update time in Cloudflare D1. This data is used only to follow up on QOWNER release news; no automated email has been sent and the address is not displayed publicly.
• Language preference: your ID/EN choice is stored in your browser.
• Server logs: the hosting provider (Cloudflare) automatically records standard technical data such as IP address, browser type, and access time for security and abuse prevention.
• Byte and local workspace: messages you send to Byte, character/voice choices, and summaries of metadata you ask it to read (file name, type, size, extension, and modification time). The local bridge does not send file contents for scanning; summaries may be passed to a local AI model or the model provider you configure to prepare a response.
• Voice: Byte voice output is produced by your browser’s speech capability. If you enable the microphone, speech recognition follows processing provided by your browser/device; we do not store voice recordings through this site.
• Future products: if Studio or QOWNER enables analytics, telemetry, crash reports, leaderboards, or server-stored progress data, the data types and purposes will be explained before the feature becomes active.

In short: no ad trackers, no third-party cookies, no data selling. Sign-in uses GitHub or Google, which shares your name, email, avatar, and provider ID with us. We store the account identity in Cloudflare D1 for the website. Google Drive is optional; if you connect it, we store an encrypted Drive refresh token and upload only the account snapshot you explicitly save. App connection is not active yet. The website uses a signed session cookie; an active web session is renewed automatically near expiry and carries up to 24 hours from each renewal. Native app tokens last at most 24 hours and will receive a separate renewal mechanism before shared app connections are enabled. Signing out revokes the current server-side session. We never store your password or GitHub/Google access token.

02How we use data

• Operating and securing the site (detecting attacks, abuse, and traffic spikes).
• Recognizing you when signed in (account sessions) and remembering your language preference.
• Storing profile changes you request and displaying public profiles only according to your visibility choice.
• Storing your alias and QOWNER leaderboard consent so future applications can use the public identity you choose. Scores and events are not active on the website.
• Following up on QOWNER release interest after your explicit consent through the form; this does not create a website account.
• Answering questions you send through support email.
• Reading workspace metadata only when you ask Byte to do so, and preparing a plan without automatically deleting, moving, or changing files.
• Uploading an account snapshot to Google Drive only after you connect Drive and press the backup button; this integration uses a limited Drive scope for files created by the application.

03Cookies & local storage

We do not use cookies for advertising or cross-site tracking, and there are no third-party cookies.

• Session cookie (vs_session): set only after you sign in. It contains a random session reference, account ID, provider, and expiry time signed on the server so it cannot be silently altered; OAuth tokens are never included. The session reference is stored as a hash in D1 and can therefore be revoked on the server. The cookie is HttpOnly, Secure, and SameSite=Lax, and lasts up to 24 hours each time it is issued or renewed. The browser session renews automatically while it remains in use and approaches expiry.
• OAuth state cookie (vs_oauth_state): short-lived (10 minutes) and used only to prevent CSRF attacks during sign-in. This cookie is deleted when the process ends.
• Provider-linking cookie (vs_oauth_link): appears only when you ask to connect a second Google or GitHub account to the active account. This cookie is signed, lasts at most 10 minutes, and is bound to the active session hash; the provider token is processed once on the server and then discarded.
• App-flow cookie (vs_oauth_flow): appears only when an application starts sign-in, lasts at most 10 minutes, is signed, and binds the login response to the application and security checks. The code issued after sign-in lasts 2 minutes and can be used only once; its raw value is not stored.
• Google Drive flow cookie (vs_google_drive_state): lasts at most 10 minutes, is signed, and is bound to the signed-in account and session. This cookie secures only the Drive consent callback and is deleted when the flow ends; the refresh token is not stored in the cookie.
• App sessions: applications store a random Void Scriptor session token in secure device storage. The token lasts at most 24 hours, is sent to the account endpoint, and can be revoked by signing out.
• localStorage: stores language preferences (ID/EN), Byte preferences, checklist progress, and workspace metadata summaries if you use them. This data remains in your browser and is not part of the account database.

Pressing Sign out revokes this session on the server and removes the cookie from this browser. Sessions on other devices remain separate; sign out from those devices or revoke app access in GitHub/Google settings if needed. You can also delete all cookies and site data at any time through your browser settings.

If the session-signing key is suspected to be exposed, we may rotate SESSION_SECRET; this invalidates all existing session cookies and requires every user to sign in again. D1 also allows individual stored sessions to be revoked without deleting the account.

04Third parties

This site is hosted by Cloudflare Pages, account profiles and sessions are managed through Cloudflare D1, and download pages are served through Cloudflare R2. Cloudflare processes technical and account data according to its role and its own privacy policy.

• GitHub: if you choose GitHub sign-in, your profile is processed according to GitHub privacy policy.
• Google: if you choose Google sign-in, your profile is processed according to Google privacy policy.
• Google Drive API: if you enable Drive backup, upload requests are processed by Google according to Google privacy policy. The requested scope is limited to files created by the application.

We do not integrate ad networks, third-party analytics, or tracking pixels.

05Processing grounds, transfers, and retention

Processing grounds may include: your consent when choosing sign-in or sending a support request; performance of the service when we create an account session; legitimate interests in security, abuse prevention, and reliability; and legal obligations where required. If the GDPR applies, the relevant grounds and rights will be assessed in the context of the processing and not assumed automatically.

Cloudflare Pages/D1/R2, GitHub, Google, and email providers may process data from or outside Indonesia. The Void Scriptor account D1 is created in the APAC region; other processing is subject to the roles, policies, and transfer mechanisms they use.

• Web sessions: renewed automatically while you remain active; without renewal, they last at most 24 hours from issuance or the last renewal, or until revoked. App sessions last at most 24 hours. OAuth state and app flows last up to 10 minutes; app exchange codes last up to 2 minutes or one use. Expired records are cleaned up as part of database operations.
• Account profiles and provider identity: while the account is active or until you request deletion through Contact, except as needed for security, disputes, or legal obligations. QOWNER aliases and leaderboard choices follow profile retention and can be changed from the dashboard.
• Preferences and Byte summaries: remain in the browser until you delete them or use Delete my data.
• Google Drive connection: the encrypted refresh token and file references are stored while the connection is active. Disconnecting removes credentials from D1; backup files already created remain in Google Drive until you delete them there.
• Support email: reviewed and stored as needed to respond, maintain support history, or meet obligations; the operational target is no more than 24 months after the last interaction unless longer retention is necessary.
• QOWNER release interest: stored while the release list remains relevant or until you request deletion. We may review the list periodically; deletion requests may be submitted through Contact.
• Cloudflare logs: we do not control technical retention managed by Cloudflare. Logs available to us are used for security and operations as needed; actual retention may follow Cloudflare’s product, plan, and policies.

If a security incident affects personal data, we will investigate, take protective measures, and notify affected parties or authorities where required by applicable law.

06Your rights

We store account profiles, login-service data, and minimal session records in Cloudflare D1 to keep your website identity connected. If Google Drive is connected, you can disconnect it from the dashboard to remove the encrypted refresh token and file references from D1; existing files must still be deleted from Google Drive. App connection is not active; future applications’ use of this identity will be explained and verified before launch. Byte preferences and summaries remain in local browser storage. You may request access, correction, or account deletion through Contact:

• Viewing and downloading your data: the Download my data button requests an authenticated export containing your account profile, connected providers, and session metadata without secret tokens, then combines it with local Byte data stored in the browser into a JSON file on your device. Local data contents are not sent to the server.
• Deleting account data: the Delete local data & sign out button in the dashboard deletes only local data and revokes the session in this browser. The Delete account and server data button deletes the account profile, provider identities, all sessions, cloud snapshots, and stored Google Drive tokens after you enter explicit confirmation. Files already created in Google Drive are not deleted; delete remote files from Google Drive if you want that as well.
• Revoking app access: you can revoke Void Scriptor permission at any time from your GitHub or Google account settings (the dashboard provides direct links), so we can no longer read your profile.
• Withdrawing leaderboard consent: you can clear your alias or turn off the QOWNER leaderboard choice from the dashboard at any time. The leaderboard feature will use the latest choice when available.
• Withdrawing QOWNER release interest: send a deletion request to [email protected]. Include the address used in the form; we may request reasonable verification before deleting it.
• Language preference: can be changed or deleted through your browser settings.

For privacy questions or data-related requests, contact us at [email protected].

07Children

This account service is not directed to children, and we do not knowingly collect children’s data. Age limits, age ratings, age verification, parent/guardian consent, and reporting mechanisms for QOWNER mobile or prize events will be established before launch in accordance with applicable law, App Store/Google Play policies, and the risk design. If you are below the applicable age limit, do not create an account or join an event without the required consent.

08Changes

This policy may be updated from time to time. Material changes will be marked by updating the “Last updated” date above and, where appropriate, announced through the site or email.