Privacy

The short version

There is no account, no advertising, no tracking cookie and nothing sold to anybody. Your load order is read inside your browser and is never uploaded, unless you decide to submit it, which is a separate button that says so. Everything below is the detail behind that.

Sorting your order

The file you drop in is parsed by code running on your own machine. It is the masterlist that travels, downloaded to you, and the sort happens against it locally. No copy of your order is sent to a server, written to a log or seen by anyone. If you would rather check than take my word for it, open your browser's network tab while you import: there is no upload to see.

What is kept on your device

Nothing, until you turn on remembering. Do that and two values go into your browser's local storage: the fact that you asked, and the imported order along with any slots you assigned by hand, so a reload does not lose your work. Both stay on your device, both are deleted the moment you turn remembering off, and clearing site data removes them. VOLO sets no cookies at all.

If you submit an order

Submitting is the one action that publishes something. The order becomes a public issue on the repository and then a file in a public corpus, released under CC0, because the whole tool is built by counting what is in those files and nobody can check the counting without the files. No name, no email and no account go with it.

Before it leaves your browser, filesystem paths are stripped out. BG3 Mod Manager writes the full path of a pak into some entries, and that path contains the account name of whoever exported it, so one submitted order can publish a stranger's real name without them ever deciding to. It happened once. The same scrub now runs three times: in your browser, again at the API, and again when the order is taken into the corpus.

An order too large to fit in an issue is stored first in Cloudflare R2, and the issue carries a link to it with an entry count and a checksum. That copy holds the same scrubbed text that would have gone into the issue.

Anything you write in the Notes box is kept too, beside the order in the same public corpus, because what a submitter says about their own game is often the only record that two mods fight or where a crash happened. It is your words as you wrote them, with filesystem paths stripped the same way, and nothing acts on it automatically. Leaving the box empty records nothing at all.

Other services your browser talks to

Cloudflare hosts the site, so every request reaches them and their logs record it in the ordinary way any web host does, IP address included. They also serve the analytics script described below. The submit page loads Cloudflare Turnstile on top of that, which is the check that you are not a bot, and your IP is passed to it as part of that check.

Nobody else. The typeface used to come from Google Fonts, which meant Google received a request from your browser on every page you opened here. It is served from this site now, so it does not. There is no content delivery network in front of the code, no embedded video, no comment widget and no advertising.

GitHub is contacted only as a fallback, if the masterlist fails to download from this site. Ko-fi, Patreon and PayPal are contacted only if you click one of those links: the support page uses plain links, not embedded widgets, so nothing loads from them unless you choose to go there.

Measurement

VOLO uses Cloudflare Web Analytics. It is a small script that Cloudflare adds at the edge, so it does not appear in the source of this site, and it reports each page view together with how quickly the page painted and responded on your device. It also records the site that referred you, your browser, your operating system and your country.

It sets no cookie, stores nothing on your machine, and cannot follow you to any other site, so there is no consent banner on this page because there is nothing stored to consent to. There is no Google Analytics, no advertising pixel, no cross-site tracker and no fingerprinting.

Two smaller things. Cloudflare keeps request logs the way any host does, covered above. Search Console tells me which searches this site turns up in, which concerns queries, not people.

Changing your mind

If you have submitted an order and want it gone, ask and it will be taken out of the corpus and the masterlist rebuilt without it. Be aware of what that can and cannot undo: the file is removed from the project going forward, but it was public, and old commits keep their contents unless the history is rewritten. If something personal reached the corpus, say so in the request and I will rewrite the history instead of only deleting the file.

Asking about any of it

Questions and removal requests go to the issue tracker. This page carries no revision date on purpose, since a date is easy to leave stale: every change to it is a commit, and the history is public, so you can read what changed and when instead of trusting a line at the bottom.