Closed Alpha Privacy Notice

Aether is an independent service operated in Brazil. It is a game-agnostic virtual tabletop in a free, invitation-only closed alpha and decides why and how personal data is processed.

This notice covers the public waitlist, early-access invitations, Aether accounts, hosted worlds, the free Marketplace, Creator Studio, transactional email and the technical operation of aethervtt.cloud. It does not cover a self-hosted Aether installation controlled by somebody else.

The closed alpha is intended for people who are at least 18 years old. Do not join the waitlist, accept an invitation or create an account if you are under 18.

• Waitlist and invitations: email address, request and review status, where the request form appeared, an optional campaign label and timestamps. Abuse controls store keyed hashes derived from the email and source network address; they do not store the raw source address in the abuse-attempt record.
• Account and authentication: email address, display name, password hash, language preference, platform role, session tokens and their expiry times. Aether does not store your plain-text password.
• Optional alpha research: whether you run or play games, VTTs you use and how you found Aether. These answers do not grant permissions, plans or access to a world.
• World and session data: world names and settings, memberships and roles, scenes, documents, chat, dice activity, game content, installed systems or mods and other material participants add to a world.
• Files and Marketplace data: uploaded assets, free package files, manifests, listing text, creator identity, reviews, replies, moderation records and private release candidates.
• Operations and security: request timestamps, service and container state, storage and usage measurements, error diagnostics, audit records and transactional-email delivery events such as delivered, bounced or complained.
• Cookies: a required session cookie, plus cookies that remember language and theme. The production alpha does not load advertising cookies or a browser analytics SDK.

We use the waitlist email address, request status, form placement, optional campaign label and keyed anti-abuse hashes to review early-access requests, prevent misuse and deliver invitations.

After an account is created, we use account, session, world, file and operational data to authenticate people, protect accounts, operate shared worlds, distribute free Marketplace content, answer support and privacy requests, secure the service and diagnose failures.

Optional alpha research answers are used only to understand who is testing Aether, which VTTs they already use and how they found the product. They are not used to grant platform or world permissions.

The legal bases are steps requested before entering the alpha agreement, performance of the alpha agreement, compliance with legal duties, exercise of rights in legal or administrative proceedings and legitimate interests in operating and securing a small closed alpha. Consent is used only when Aether asks for a genuinely optional use that can be refused or withdrawn without losing the core service.

Aether does not sell personal data. Data is disclosed only where needed to operate the alpha, comply with law, protect participants or investigate abuse.

• Hostinger International Limited, which hosts Aether's single production server, database, world containers and object storage in São Paulo, Brazil.
• Resend (Plus Five Five, Inc.), which receives recipient addresses, email metadata and message content in the United States to deliver invitations, password resets and other required transactional messages.
• Infrastructure and security providers used for domain name service, certificates, source delivery and deployment, to the limited extent they process operational data.
• Public authorities, courts or professional advisers when disclosure is legally required or reasonably necessary to establish, exercise or defend rights.
• Other members of a world, according to that world's membership and permission settings. Content published in the free Marketplace is available to Marketplace visitors and users.

Aether's production server is in Brazil. Transactional email data is transferred to Resend in the United States because that processing is necessary to deliver invitations, password resets and required account messages. Resend's Data Processing Addendum and security terms govern that processing. Aether limits the transfer to the recipient address, email metadata and message content needed for delivery.

• Waitlist and review records are kept while the closed-alpha admission program is operating, unless the address owner asks for deletion and no legal or security reason requires limited retention.
• Active account, membership and world data is kept while the account or world exists. Sessions expire after seven days unless replaced or ended sooner.
• Early-access invitation links expire after 14 days and work once. Invitation and administrator audit records may be retained afterward to prevent reuse and explain access decisions.
• Terminal transactional-email delivery metadata is scheduled for deletion after 30 days. Queued delivery work remains until it is sent, permanently fails or is handled by an operator.
• Deleting an account removes the active account and its sessions and destroys worlds owned by that account. Content already shared into another person's world, or published as a free Marketplace package, may need separate handling so that other users' worlds and legal records are not silently broken.
• Rotating backups keep up to 14 dated copies of database and world-volume data. Deleted objects displaced by a backup sync may remain longer until an operator removes them. Aether will not restore deleted account data into the active service except when needed to recover from a service failure or legal obligation.

You may ask whether Aether processes your personal data and request access, correction, information about sharing, review of relevant automated decisions, portability where applicable, anonymization, blocking or deletion of data processed unlawfully, and withdrawal of consent where consent is the legal basis. Some requests may be limited by another person's rights, a legal duty, fraud prevention or the need to preserve evidence.

Send a request to privacy@aethervtt.cloud. We may ask for enough information to verify that the request concerns your account or email address. Aether will not charge for an LGPD request.

Aether uses access controls, password hashing, scoped session and world tokens, HTTPS, server-side permission checks, isolated world processes, restricted secrets and backups intended to recover from operator mistakes. No service can promise perfect security.

The current alpha runs on one production server. Current backup evidence is recoverable from many software and operator mistakes but is not yet proven to survive loss of the server's physical disk. Do not use the alpha as the only copy of irreplaceable campaign material.

Material changes will receive a new version and effective date. If a change affects existing alpha accounts, Aether will provide notice through the service or by email before the change takes effect where required.

Questions and privacy requests may be sent to privacy@aethervtt.cloud.