What PocketRoles looks at, keeps and sends

Who and what this covers

This policy is about the following:

• The PocketRoles mod. It runs inside Among Us on the host's PC.
• PocketRoles Launcher and the Aegis tray app. StarPocket Client, which combines the two into one app, follows the same rules.
• The ban console. The author and the moderators use it to look at records that people have sent in.
• This website.
• The contact page, the room list and login. They run on a server the author keeps at home (This website).
• The Discord and e-mail channels for appeals, deletion requests and questions.

A “player” is someone who joins a room with its room code. A “host” is someone who installs PocketRoles on their own PC and creates rooms.

PocketRoles is an unofficial mod with no connection to Innersloth. What Among Us itself collects is governed by Innersloth's privacy policy. This page only describes what PocketRoles adds.

What is collected, what is not

Players (people who only join a room)

Nothing is installed on a player's phone or PC, and nothing on it is inspected. There is no code that sends a file or a program to a player.

What the host's PC sees is only the information the game itself delivers to the host when someone joins a room with ordinary Among Us:

• the name, the account number (PUID) and friend code, and the kind of device (PC, phone and so on)
• what happens in the match (movement, kills, vents, votes and so on) and the chat text

Of this, the following is written to files:

• Aegis records (aegis-bans.json and one evidence record per removal or ban): the name, the PUID and friend code in a form that cannot be reversed (a hash), the code used to delete records, when, in which room, under which rule and with which numbers, and the last 20 lines logged about that player (whom they killed, for example; other players' names can appear there). The PUID and the friend code themselves are never written. This is not everyone who joined: only people Aegis removed, people the host banned, and people stopped at the door by a shared ban.
• The host's own lists (Banlist.txt, Admin.txt, Moderator.txt, VIP.txt): only when the host uses /ban without a number of days, or /admin, /mod or /vip, the PUID (or the friend code when there is none) and the name are kept as they are.
• The mod's log (LogOutput.log): names, match events, Aegis detections, the first 40 characters of a meeting message that names a player, who voted for whom, and for NG words only the matched entry (never the message).

Chat text is almost never kept. The exceptions are the 40 characters above, and the case where the host has turned on the diagnostic setting ([Diagnostics] WireLog, off by default).

Hosts (people who installed PocketRoles)

The Aegis tray app and the mod's self-check look, on the host's PC only, for signs that the PC is set up for cheating.

• What they look at: the game folder (BepInEx, the mod, the names and fingerprints of the DLLs next to the game), where Steam is, the Windows version and its protection settings, the names of running apps and the fingerprint, product information and signer of their executables (compared with a list of tools usable for cheating), and the names of loaded drivers.
• What they do not look at: the memory, windows or screen of other apps. For other games too, they only ask Windows where the executable is and read that file from disk. Passwords, browsers, accounts.
• What they do not install: kernel drivers or background services. No administrator rights are needed. The registry is only read, and only one value is written, when the “open at Windows start-up” switch is turned on.

The results appear on the host's screen and in the log, and are sent nowhere.

How long things are kept

Records stay on that host's PC. They are not gathered on any server of the author. The author's server only runs the contact page, the room list and login; it does not receive the mod's records (This website). When the time is up, they are deleted automatically.

• Deletion happens when PocketRoles (the mod, the launcher, the tray app) starts. The mod does it at start and once a day while it runs (never during a match or a start countdown). On a PC that is never started, nothing is deleted until the next start. The host needs no setting and no action.
• Evidence records count from the day they were made; everything else counts from the day it stopped being needed.
• A host can delete any of these files themselves.

What leaves the host's PC

With the default settings, only one thing connects to the outside:

• The Aegis definitions file (aegis/definitions.txt) and its signature are fetched from GitHub. The mod does this at start and once a day while it runs (and when the host types /ac rules reload). The tray app does it once at start. StarPocket Client does it when it opens, and again when its window is opened or Play is pressed after 12 hours have passed.
• What is sent is an ordinary download request (with a User-Agent naming the app and its version). No information about the host's PC is sent. GitHub sees the IP address, just as it does when you visit any website.
• There is no setting that stops the fetch ([AntiCheat] RemoteRules=false still fetches it, for the list of deletion requests). A PC without internet keeps using the file it last received.

Connections made only when the host presses a button:

• The launcher's “check for updates” and install: downloads from GitHub Releases and builds.bepinex.dev (receiving only).
• “Open mail”: opens your mail app and sends nothing. Report zips are never sent automatically either; the host decides whether to attach one.

There is no code that sends anything to a server of the author or to analytics. The author's server (the contact page, the room list and login) is used only when you open it in a browser; the current PocketRoles (the mod, the launcher, the tray app and StarPocket Client) contains no code that connects to it. The game's own traffic (with Innersloth's servers) is the same as in ordinary Among Us.

Microsoft Edge WebView2, which draws StarPocket Client's screen, is a Microsoft component and may talk to Microsoft according to your Windows settings (to check for its own updates, for example). The app's screen itself loads nothing from the internet.

What runs only when the host turns it on

All of the following are off to begin with. They run only after the host turns them on in the settings.

• Discord notices ([Discord] WebhookUrl). Only when the host has entered a Discord webhook address. What is sent is one line: the room code, the player count, the state (open, full, in game) and the kind of room. No names are sent.
• Chat translation ([Translate] Enabled). In a room where it is on, chat messages (up to 300 characters) and the target language are sent from the host's PC to Google Translate (or to DeepL when a key is present). Names are not sent. Commands, very short messages and messages in the room's language when everyone shares it are not sent. Players cannot turn it off themselves. The “translation on” notice when you join is the sign. If you do not want a message sent, do not post it, or ask the host to turn translation off. Google's and DeepL's terms apply.
• Automatic reports ([AntiCheat] AutoReport). When Aegis finds certain cheating and removes the player, it files an official Among Us report through the game's own mechanism. It passes only that player's in-room number and the reason; no records, chat or logs are attached. At most once per player in 30 days, and five reports per hour in total. What happens afterwards is decided by Innersloth.
• Automatic region choice ([Lobby] AutoRegion). When the create-room screen opens, the official servers are asked how fast they respond.
• Diagnostic log ([Diagnostics] WireLog). Chat text and part of the network traffic are written to the log. For troubleshooting only.

The following are on to begin with, and a host can turn them off:

• Rule updates ([AntiCheat] RemoteRules) and shared bans ([AntiCheat] SharedBans). They use the values and the list from the signed file on GitHub (Settings that work remotely).
• Removal notices ([AntiCheat] AnnounceKick, [Chat] NgAnnounce). When Aegis removes someone, their name and the reason appear in everyone's chat in that room.

Settings that work remotely (what the author can change for everyone)

PocketRoles fetches a signed definitions file from GitHub. By editing that file, the author can change how every host's PC behaves, all at once, without shipping a new mod. Here is what can be changed, stated openly.

• The minimum required version ([update]). An older PocketRoles can no longer create rooms. The menus, the settings, joining other people's rooms and ordinary Among Us keep working. Nothing on the PC is deleted or changed.
• Detection values and levels ([rules]). The numbers of the Aegis rules, and whether a rule removes the player, only notifies, or is off. A number can only move inside a fixed range. A level can only be made more lenient than the one built into the mod, never stricter: the GitHub file cannot add rules that remove players. With RemoteRules=false, the built-in numbers are used and only the lenient changes are taken.
• The NG-word list and its exceptions ([ngwords], [ngallow]). The words are not listed in plain text.
• The shared ban list ([bans]). PUID hashes, level, expiry and reason. SharedBans=false stops it being used.
• The erase list ([erase]) and the unban list ([unban]). Deletion requests, and appeals the author accepted. These apply on every PC whatever RemoteRules says (Having your records deleted).

The safeguards:

• Only a file whose signature matches the author's key is used. A file with a wrong or missing signature is ignored.
• The version number cannot go backwards. An old file cannot be put over a newer one.
• Values that are clearly wrong (a version that jumps far ahead, for example) are ignored. When the file cannot be fetched, nothing is blocked (it fails open).
• The file is public on GitHub, with its change history. Anyone can read it.

The small per-room variation of the detection values ([AntiCheat] Jitter, 10% by default) is drawn at random on the host's PC and cannot be set from outside.

Having your records deleted

You do not need to ask the host. You contact the author once.

1. Type /cmd id in a room

   You get “your code” (16 letters, for example BDZN XHNJ JSXD GZDG). In a registered room it goes to you alone. In an unregistered room it is shown to everyone as “name: code”. If that matters to you, type it in a registered room.

2. Send the code to the author

   Open a ticket in the “🛡️｜異議申し立て” (appeals) channel of the Discord server “PocketRoles 役職部屋”, or e-mail pocketroles.report+help@gmail.com with the subject “Delete my records”.

3. The rest happens automatically

   The author puts the code and the date on the “erase list” in the signed definitions file. Every PocketRoles host's PC deletes your records up to that date (+2 days) the next time it fetches the file (at start, and once a day while running). The entry stays on the list for at least 90 days.

What is deleted: the name, the history and the evidence records. An evidence record younger than 30 days loses its name, room code, log lines and detection text at once; the rest (hashes and numbers) goes at 30 days.

What remains:

• While a restriction is still in force, the minimum that keeps it working (hash, level, expiry) and its evidence record. They go 30 days after the restriction ends.
• The minimum for the repeat count (hash, count, dates). It goes one year after the last restriction ended.
• The host's own lists (Banlist.txt and the others). The host wrote them by their own decision, so this request does not change them.
• Things that cannot be found by the code, such as logs. They are left to expire after 30 days.
• The copies held by the author and the moderators (report zips that were sent in, records imported into the ban console). With the same request, the author deletes their own copies by hand and asks the moderators to delete theirs.

If you no longer join PocketRoles rooms, you cannot get a code. Then either wait for the automatic deletion (30 days for logs and the like, 90 days for evidence records), or, if you only want the author's own copies deleted, contact the author with your friend code.

If you think a restriction was a mistake, you can appeal (If you were restricted). The full details of deletion are in the FAQ on the home page: “I want my records deleted, or I think a ban was a mistake”.

What is public, and what others can see

• The definitions file on GitHub holds the shared bans (PUID hash, level, expiry, reason), the erase list (code, date) and the unban list (code, date, evidence id). No names, friend codes or PUIDs themselves. GitHub's change history keeps old versions.
• Codes and hashes are made from your account number. A host or a player who was in the same room as you may be able to tell which line is yours.
• Inside a room, the notice when Aegis removes someone shows that player's name and the reason (a host can turn this off). The notice when a restricted player joins shows no name. Typing /cmd id in an unregistered room shows your name and code to everyone in the room.
• In a room whose host set up Discord notices, the room code and player count appear in that host's Discord. No names.

What reaches the author and the moderators

Neither the author nor the moderators can look into the records on another host's PC. What reaches them is only what people send themselves.

• The text of tickets and e-mails (including friend codes). A Discord ticket can be read by the person who wrote it and the Aegis team. E-mail is read by the author. Discord's and Google's (Gmail's) own rules apply too.
• What you write on the contact page (support.starpocketgames.com) (the category, subject, text, the reply-to e-mail only if you entered one, the game info and the language). It stays on the author's home server, and the author reads it in the admin pages. It is deleted automatically 30 days after it is closed. To tell the author that a new enquiry has arrived, only the reference number, category, language and subject may be sent to the author's Discord (the text and the reply-to e-mail are not; whatever you wrote in the subject arrives as it is; E-mail, Discord notices and the bot check).
• Report zips and single-player evidence zips. They stay in the author's mailbox and PC, and in the ban console's import folder.
• A friend code is used only to match records. The matching is done inside the ban console on a hash, and the console does not keep it.

Purposes: deciding appeals, deleting records, deciding shared bans, and investigating bugs. Nothing else. Nothing is sold or passed on to anyone. To draft a reply, the text may be sent to an AI after anything the machine can find (such as e-mail addresses) has been replaced with a marker (only for enquiries where you ticked “an AI may be used to draft the reply” on the form; a name you wrote in the text yourself is sent as it is; AI-drafted replies).

There is no automatic deletion of the copies held by the author and the moderators yet. If you want them deleted once your case is decided, say so in the same ticket or e-mail. The author deletes by hand and asks the moderators to do the same (for copies on a moderator's PC, the author can only ask). Names written in the ban console's audit log (audit.log) cannot be deleted at present.

AI-drafted replies (only when the author turns it on)

When the author writes a reply to an enquiry that arrived through the contact page (support.starpocketgames.com, which runs on the author's home server; see This website), the text of the enquiry (including the subject, the game info and the earlier exchange) may be sent to an AI to produce a draft. The AI is Claude, made by Anthropic (an AI company in the United States). Only enquiries where you ticked “an AI may be used to draft the reply” on the form are sent, and that box is unticked to begin with. There is no such mechanism for e-mail or Discord tickets.

When it is on, this is what happens:

• Only enquiries where you ticked “an AI may be used to draft the reply” on the form are sent. That box is unticked to begin with. An enquiry sent without it is never given to the AI; the author writes the reply themselves. The choice is fixed when you send the form and cannot be added or removed afterwards. E-mail and Discord tickets have no such box, so they are never sent to the AI.
• What is sent is the subject, the game info, the messages exchanged (your text and the author's replies), and the enquiry's category and language. Before sending, anything the machine can find is replaced with a marker. E-mail addresses, URLs, reference numbers, user IDs, Discord IDs and usernames (forms like taro#1234 or @taro, or one written as “my Discord ID is …”), IP addresses and phone numbers are replaced with a marker such as “(e-mail address)” first. This is a program looking for fixed patterns, though. A name you wrote inside the text yourself (Taro Yamada, TaroYamada) cannot be found by the machine and is sent as it is. If you do not want your name known, do not write it in the text. The reply-to e-mail address is not sent.
• The AI only produces a draft. Until the author has read it, corrected it and pressed “post reply” themselves, the other person sees nothing. The AI never replies on its own.
• The text leaves Japan. Anthropic is a company in the United States, and the text is sent to that company's servers.
• Anthropic does not use what is sent through its API to train its AI (Anthropic's Commercial Terms of Service). The text sent and the AI's reply stay on Anthropic's servers, but are normally deleted within 30 days. Content suspected of misuse can be kept for up to 2 years (Anthropic's article “How long do you store my organization's data?”, as updated on 1 July 2026). Anthropic may change this, so check that page for the current terms.
• One more layer, just in case: even on a ticked enquiry, if the words “AI に渡さないで” (Japanese for “do not give this to an AI”) appear anywhere in your message, it is not sent to the AI. It is recognised with or without the space, in full-width characters (“AIに渡さないで”, “ＡＩに渡さないで”) or written in kana (“AIにわたさないで”), and it works in the subject or the game-info field too. Wordings such as “do not send to AI”, “no AI”, “human reply”, “AI は使わないで” or “不要交给 AI” are also looked for. But this is a machine looking for words, and it can miss one. The sure way is to leave the box unticked. The tick box is the real gate; this word search is only a safety net for a box ticked by mistake.
• The only record kept on the author's server is that a draft was made, and how much it involved: the model used, the number of characters sent, the number of markers inserted, how much the AI used (tokens), and the length of the draft, plus a fingerprint of the draft (a hash, from which the text cannot be recovered) used to tell whether the draft is still the untouched AI version. The action log (audit) keeps the ID of the administrator who pressed the button and the enquiry ID. Neither the enquiry text nor the AI's reply is written to any log. The draft goes into the reply draft box and is deleted together with that enquiry.
• The author can turn the feature off in the settings. When the AI cannot be reached, enquiries keep working as usual.

E-mail, Discord notices and the bot check (what the author's server hands to outside companies)

The contact and login pages (which run on the author's home server; see This website) hand something about you to an outside company in just three cases. In all three, that company's own rules apply too.

E-mail is handed to a sending service (Resend)

The following two e-mails are not sent by the author's server itself. It asks the mail-sending service Resend (a company in the United States) to send them.

• The author's reply to someone who entered a reply-to e-mail in their enquiry (only when the author chooses “Also email them”)
• The 6-digit code for logging in with e-mail

Resend receives three things: the recipient's e-mail address, the subject, and the text of the mail (the reply, or the code). The text of your enquiry and your IP address are not handed over. How Resend handles this and how long it keeps it is set by Resend's privacy policy. The author's server has no way to delete what is at Resend.

The mail is not sent straight from the author's home because, sent that way, the home IP address would stay in the mail (in its headers) and reach the recipient, and mail sent from a home connection is easily treated as spam. The author's server log keeps only the fact that a mail was sent, with the address partly hidden (in the form t***@example.com); the subject, the text and the code are not logged.

The subject of a new enquiry reaches the author's Discord (only when the author sets it up)

When the author has set up a Discord webhook, one notice is sent to the author's Discord channel when a new enquiry arrives and when something is added to it. Only the reference number, category, language, subject (the first 120 characters if it is longer) and a link to the author's admin page are sent. The text and the reply-to e-mail are not.

But the subject is free text that you write. If you put a name or an e-mail address in the subject, that reaches Discord as it is. Put anything you do not want known in the text, not in the subject. A notice that has arrived stays on Discord's servers (Discord is a company in the United States) and is not deleted automatically; only the author can delete it by hand. Discord's own rules apply too.

The “I am not a robot” check on the send button asks Cloudflare

The contact page and the e-mail login page (where the code is sent) each have a small Cloudflare Turnstile box (an “I am not a robot” check provided by Cloudflare, a company in the United States). It is there to stop mass automated sending; nothing can be sent without passing it. The room list and logging in with Discord do not have this check.

Your browser loads that box straight from Cloudflare. So as soon as the box appears, your IP address and browser details reach Cloudflare, as when you open any website. When you pass the check, your browser is given a “pass token” (a meaningless string of random characters).

When you press send, the author's server asks Cloudflare whether that token is genuine. Only two things are handed to Cloudflare at that point: the token and your IP address. The subject, the text, the reply-to e-mail and the e-mail address used to log in are not. From Cloudflare's answer the server reads only “passed / not passed” and, if not passed, a short reason code. It does not store the token or the IP address, nor write them to its log (the log only keeps the reason code when a check fails).

How Cloudflare handles this and how long it keeps it is set by Cloudflare's privacy policy. The author's server has no way to delete what is at Cloudflare.

This website

• This site is hosted on Cloudflare. When you open a page, Cloudflare's servers receive your IP address and the like, as with any website (Cloudflare's privacy policy).
• The contact page (support.), the room list (rooms.) and login (account.starpocketgames.com) run on a server (a small PC) the author keeps at home. It is connected to the outside through a Cloudflare Tunnel, so the home IP address is not exposed. Your IP address reaches the server through Cloudflare, but the server does not store it (only a marker derived from the IP that cannot be turned back into it, used to prevent spamming; after the server restarts, that marker can no longer be matched to any IP). The server's log does not record IP addresses, e-mail addresses or the text of enquiries either. Only when you press send on the contact page or the e-mail login page does the server hand your IP address to Cloudflare, once, for the bot check (E-mail, Discord notices and the bot check).
• Automatic server status check. When the “Server status” panel under “Contact” on this site comes into view, your browser asks each of the three entry points (contact, room list, login) whether it is up (their /status path). This happens without pressing anything, but only once, when the panel comes into view; after that it asks again only when you press “Check again” (it never polls every few seconds). If a reply cannot be read, it asks that entry point once more to see whether anything gets through, and asks this site itself (Cloudflare) once. As when you open those pages normally, your IP address reaches the author's home server through Cloudflare. Nothing but that “are you up?” request is sent: no login cookie and not your chosen language. The server does not write this request to its log (neither the IP address nor the fact that it happened is kept; only the anti-spam marker described above is held for about a minute, and nothing goes to a file or the database). The result is not stored in your browser.
• What stays on that server: what you send on the contact page (the category, subject, text, the reply-to e-mail only if you entered one, the game info and the language; deleted 30 days after the enquiry is closed). When you log in, your Discord ID and display name, or your e-mail address (there are no passwords). Rooms posted to the room list (they leave the list 3 minutes after updates stop and are deleted after 1 day). An action log of who did what and when (30 days). The server's log (14 days).
• When a reply is e-mailed to someone who entered a reply-to address, and when a login code is e-mailed, the author's server does not send the mail itself: it is handed to a mail-sending service (Resend), and the recipient's address and the text of that mail go to that service (E-mail, Discord notices and the bot check).
• The site itself uses no cookies and no analytics. It loads no fonts from other sites. The only traffic from this site to the author's server is the “Server status” check above.
• The only things stored in your browser are your chosen language and your light/dark choice.
• After you follow an outside link (GitHub, Discord, YouTube, bilibili, X, e-mail), that site's own rules apply.

Changes and contact

When this policy changes, the “Last updated” date at the top is updated. Larger changes are also announced on Discord and in the release notes.

For questions about privacy, deletion requests and appeals, use one of these. Japanese, Chinese and English are all fine. A reply can take a few days.

• Open a ticket in the “🛡️｜異議申し立て” (appeals) channel of the Discord server “PocketRoles 役職部屋” (a ticket can be read only by you and the Aegis team)
• E-mail: pocketroles.report+help@gmail.com (subject “Privacy”, “Delete my records” or “Appeal”)

Run by StarPocket Games (the activity name of one individual developer, not a company). Contacts for other matters are on the home page under “Where do I write?”.