Memoria: Reinventing Flock in FFXIV

The Hell was PlayerScope?

With the release of Dawntrail, Square Enix introduced a new account-wide blacklist meant to solve a long-standing problem of users getting harassed by alt accounts. This change was all well and good, except for a fatal flaw: the blacklist was managed purely client-side. Every game client would receive the account IDs of every character they saw.

Because we cannot have good things, a plugin named PlayerScope was created. This plugin only needed to be installed by a small percentage of the playerbase, since its entire purpose was to scrape every visible player in every possible location to create a full database of characters and their owning accounts. While this data was kept relatively protected (namely, you needed to be friends with the PlayerScope dev), it rightfully generated quite a bit of controversy as it was impossible to escape. Every name change and server transfer was logged. If you were ever in the same zone as a PlayerScope uploader, you were indexed. For the poor souls in the United States right now, this may very well sound eerily familiar to some other things out there.

The community backlash to this was clear and unambiguous. It became known as a stalking engine, and there were numerous documented cases of players being harassed through the information PlayerScope made public. Players had to face toxic ex-partners and people they had long thought blacklisted, now stripped of the protection that their new alt gave them.

In January 2025, Square Enix did something that was, up until that moment, unprecedented. Director Naoki Yoshida publicly acknowledged the plugin and said that Square Enix was considering taking legal action. In March, Square released Patch 7.2, bringing the first official attempt to fix the blacklist problem. The obfuscation used was reversed in under 24 hours by a number of prominent plugin developers, as well as PlayerScope themselves. Finally in June, Square Enix issued their first (known) Cease and Desist against a plugin developer, bringing PlayerScope down. While the creator claimed to delete all stored data, the damage was still done. The idea was out there, and existing data dumps likely remained.

The PlayerScope shutdown was not obscure news; it was covered by many media outlets (as seen above), was discussed across nearly every FFXIV community, and got the plugin community its first ever brush with the Square Enix legal team. And yet, eleven months after the cease and desist, Memoria decided that it would be a wonderful time to try again. May 2026 marked the release of their plugin and initial database, now backed by the power of ChatGPT.

The Hell is Memoria?

Memoria is a custom-repository Dalamud plugin that runs in the background of a player's game. Rather than try to reword things, let's go straight to the horse's mouth:

"Memoria is a free Dalamud plugin for Final Fantasy XIV that quietly remembers every player you cross paths with — every zone you pass through together, every Frontline you run, every busy market you wander. No button to press, no list to manage. It just watches." — Memoria README.md, github.com/RoseOfficial/Memoria

As with PlayerScope before, the players being tracked are not the ones who have installed Memoria. It doesn't even matter if a player is using mods or is playing on a console. Anyone near any user that installed the Memoria data collector becomes another data point, with the following information recorded about them:

The full contents of this database are synced up to a public React app running on Netlify, backed by a Postgres database running in AWS. Anyone with a web browser can search any character and all (known) historical information for that character. And, much like the comparison to Flock we're going to keep forcing, none of this has any real oversight.

But they fixed Account IDs!

Like PlayerScope before it, Memoria's alt-linking feature depends on a hidden account identifier in the game client that ties all characters on the same account together. After the initial (botched) patch in 7.2, Square Enix finally fixed the problem for good (ish)^[1] in Patch 7.3 with a new system that (as of the time of writing) has not notably been broken.

The current account ID system still, unfortunately, does leak some information, but it is much more constrained. In practice, to positively link two accounts together, you must have seen (or otherwise be aware of) two characters belonging to the same player within the same play session. In plain words, it's no longer possible to drive-by identify players: to link Character A with Character B, you must have seen both characters in a single login.

Despite this, Memoria still tried its best, and its own change logs show the result. From CHANGELOG.md, the v1.0.1 release on May 30, 2026:

"Alt characters on the same account now link together reliably. Memoria works out which characters belong to the same player using a hidden account identifier the game provides, but that identifier is only trustworthy for your own character. For other players it would sometimes come through as your own, which could either split a single player's characters apart or wrongly group unrelated strangers together." — Memoria CHANGELOG.md, v1.0.1

When Memoria initially launched, the entire core tracking feature was effectively broken thanks to the changes made in Patch 7.3, which apparently went unnoticed during initial QA. This led to data pollution in the database, as unrelated players were grouped together as if they shared an account. One can imagine why even this failure mode is concerning.

Then from the v1.3.0 release on June 29, 2026 (released the same day as this article):

"Memoria links a player's characters together using a hidden account identifier the game provides. It now takes that identifier only from the game's server messages, never from the unreliable in-memory value, so alts on one account group together correctly and unrelated strangers are no longer linked by mistake. Anything tagged wrong before heals itself the next time the character is seen." — Memoria CHANGELOG.md, v1.3.0

For those keeping track at home, this was the second bug fix in seven weeks. The first version read account identifiers from "the unreliable in-memory value" while the second attempt instead tried reading it from server data directly. Of course, the "unreliable in-memory value" also came from the server, so this was really just putting a fresh spin on a problem that (fortunately) remains unresolved.

However, this reveals something important: these are not refinements to a working implementation made by someone with actual expertise. Instead, they were made by a stochastic parrot thrashing through approaches to a feature it could not get right, on a foundation SE had already closed off, all the while happily uploading broken and unreliable data. In most normal cases, this would be enough to hint that this isn't such a good idea, but sadly LLMs do not know when to stop.

This also puts us in a slightly annoying place. Memoria could have delivered on its earlier promises, albeit with very limited results. Someone with enough data sources can, indeed, piece together some alts with enough patience and samples. So long as you trust all the samples to be correct, at least. ^[2]

Consent is for Nerds

Players being tracked by Memoria made no choice to participate. There's no notification that you're being tracked, and there's no way for there to be one. The only way to know that you've been recorded is to know Memoria exists, and to search for your own name in the database on their website.

While there is an opt-out mechanism (and we'll get to it in a second), players are still ultimately required to navigate outside the game to request removal from a service they never agreed to join. And, as designed, there are only two ways to do so: give your Discord account to the operator of Memoria, or fill in a form and hope that they deem your request worthy of approval. They even give you a little field to justify your request! How quaint!

The logical conclusion of all of this should be clear: if a service is collecting data on you without your consent, it obviously has no regard for your privacy. Putting further trust in that service will likely not end well.

Admins Have God Mode Anyway

Memoria's advertising likes claiming there are privacy controls. As with all good advertising, the claim is true, but only barely. They only work for regular visitors to the website, and do nothing against Memoria's operator and whoever they deem worthy to have access to full unredacted information.

Fortunately, since the plugin is open source, we can inspect the exact code that drove these policy decisions:

using MemoriaServer.Models.Entities;

namespace MemoriaServer.Services.Profiles
{
    /// <summary>
    /// The single source of truth for profile privacy/tier gating. The web by-slug endpoint
    /// AND the Discord /lookup command both call these predicates so the two surfaces can
    /// never diverge into a leak. Owner/admin bypass means "show me my own hidden data" — the
    /// toggles are about who-ELSE can see, not blinding the owner to their own profile.
    /// </summary>
    public static class ProfileVisibility
    {
        public static bool IsHidden(Player p, bool isOwner, bool isAdmin)
            => p.HideEntirely && !isOwner && !isAdmin;

        // Alt-character display has been permanently removed from every surface.
        // This is the single shared gate the web profile and the Discord /lookup
        // command both call, so returning false here hides alts from both in
        // lockstep (the web sends no alt list; the Discord embed drops its Alts
        // field). AccountId is still captured and stored, and GetAlts still works —
        // only the public display is gone. Restore the predicate below to re-enable.
        //   tier >= 2 && (!p.HideAlts || isOwner || isAdmin) && p.AccountId != null
        public static bool CanSeeAlts(Player p, int tier, bool isOwner, bool isAdmin)
            => false;

        public static bool CanSeeLocations(Player p, int tier, bool isOwner, bool isAdmin)
            => tier >= 2 && (!p.HideEncounters || isOwner || isAdmin);
    }
}

For those of you that don't read code, there are a couple of things here that matter:

• Line 13-14, 26-27: Hiding your data has no effect for admins.
  Both of these functions only hide data when the user viewing the character is neither that character's owner nor an admin. In other words, anyone on the server admins list can see the full contents of any profile (including encountered location information) regardless of your character's privacy settings. Not only is this backdoor pretty visible, it has been explicitly documented, indicating that this design is intentional.
• Lines 20-22: Alt data is still being collected and stored.
  The comment basically says everything here: "Alt-character display has been permanently removed from every surface." And yet, five lines later: "AccountId is still captured and stored, and GetAlts still works — only the public display is gone." The permanent removal is from the UI only, and doesn't affect the backend at all.

Don't Worry, It Spies on its Own Users, Too!

From CHANGELOG.md, v1.2.0 on May 31, 2026:

"Memoria now sends anonymous usage telemetry to help guide what gets worked on next, like which windows you open and how often you search. It never includes character names, IDs, your search text, or anything about the players you scan. It is on by default; you will see a one-time notice the first time you open Memoria." — Memoria CHANGELOG.md, v1.2.0

Seventeen days after launch, Memoria added usage telemetry to its own uploader plugin. This telemetry is described as "anonymous," a claim made by the same operator whose privacy controls can be bypassed by admins and whose own code admits they're still trying to collect alt data despite public claims otherwise. There is no third-party audit of what "anonymous" means in practice, no data retention schedule, and no indication of where this telemetry goes beyond "Memoria's servers," though the source code does log things to PostHog as well.

And History Threatens To Repeat Itself

Square Enix's position on third-party tools has never been ambiguous. Every version of the FFXIV terms of service prohibits them. For years, the community operated on an informal tolerance: SE looked the other way at tools that weren't causing visible harm, and the Dalamud ecosystem grew into hundreds of plugins that players depend on. That tolerance was never a guarantee, and it was never a license for the community to do its own thing. While it's endured so far, it's becoming increasingly shaky.

This, unfortunately, is not an isolated incident either. PlayerScope may have been the first major case of Square taking direct and unambiguous action against a plugin, but it wasn't the last. Only two months later, Square issued a second cease and desist against Mare Synchronos (a mod-sharing plugin with over 200,000 Discord users). While the Mare incident was far less malicious and instead was likely driven by business reasons, it remains obvious at this point that Square has woken up and is paying closer attention.

Memoria launched in May 2026 doing the same thing PlayerScope did. It has a public website, a community-aggregated database, alt linking, retainer-to-owner matching, and a Discord bot: every feature that made PlayerScope a target. Every day Memoria operates, it gives SE another reason to move from informal tolerance to active enforcement across the entire Dalamud ecosystem.

None of the players who rely on Dalamud for anything agreed to have their access put at risk by a surveillance plugin that spent its first seven weeks blindly throwing vibe-coded bugfixes at a broken core stalker feature. Memoria is spending SE's goodwill, and everyone else in the Dalamud ecosystem is paying the bill. The ultimate irony is that Memoria refuses to ask for any consent, and in doing so, saddles the entire community with the cost of its own hubris.

Even now, the Memoria devs like pointing out that this isn't a big deal at all. After all, plugins that "do more than what [Memoria] does already exist and are actively supported by Dalamud." This claim is most likely referencing PlayerTrack, a separate local-only plugin that also tracks players the user has encountered. PlayerTrack also has no concept of alt tracking and cannot add it even if they wanted to, since doing so would go against Dalamud's plugin restrictions. It does not take any appreciable level of literacy to note the difference in scope, and yet Memoria's devs are happy to pretend that it's no different at all.

Dramatis Persona

Really, what hit piece in the FFXIV space would be complete without some commentary on a person as well? It's been a staple of Google Docs for time immemorial, so why not here as well?

Memoria's operator, RoseOfficial, certainly has a lot of other very interesting projects to their name. Memoria isn't their first plugin, nor is it (somehow) their most controversial plugin. Their GitHub profile shows a number of other curious projects, including irrelevant-but-scene-setting things like deep-live-cam a Python script that promises a "real time face swap and one-click video deepfake with only a single image." A few other projects catch the eye for other reasons: they host yet another abandoned Mare fork, and an ill-fated project named ffxiv-struct-tools, ostenisbly built to help support FFXIVClientStructs developers on patch day (editor's note: this tool was never used by any ClientStructs developer, and as far as the authors can tell, was never even desired. The ClientStructs dev team fortunately tends to be resistant to political plays for clout.).

But let's look at something far more insidious: Olympus. Once again, it's best to just let the README speak for itself:

"An intelligent rotation assistant for FFXIV that goes beyond automation. Olympus provides intelligent decision-making through fight prediction, party coordination, performance analytics, and an integrated training system to help you master your job." — Olympus README.md, github.com/RoseOfficial/Olympus

We've had a fair few cheat plugins pop up over the days, but Olympus has a bit of a storied history. People familiar with the FFXIV botting and cheating scene will be quick to point out that this is, in fact, a pretty close copy of MMOMinion's ACR system, just now open sourced. Given some other stories about Rose's past, it's probably safe to assume that Olympus is indeed the ACR system, just vibe-reverse-engineered and published under their own name.

And once again, in the same vein as Memoria itself, Olympus is half-baked and without understanding. It claims to support "party coordination" through the use of IPC, though this has a pretty critical flaw: Dalamud's IPC is completely local and meant for plugins to talk to each other within the same game instance. It has zero inherent networking featured, since that's absolutely not what it was designed to do. And yet, ChatGPT decided that this was "good enough" for claims of a server meant for party coordination and designed an entire framework and feature for this. This was then cheerfully advertised to the world by the same stochastic parrot that is ultimately responsible for scraping all visible players.

All this points out that Memoria is not a one-off incident, neither of bad judgment or technical ineptitude. It reveals a pattern of behavior that shows no sign of stopping. This is the cost of vibe coding in our space. Dangerous ideas escalate and get shipped in a way that threatens everyone and everything, with little to no human oversight and no checks on "should we even do this." Ethics and player safety were never even a thought, and there doesn't seem to be any indication that anything will change. One can only hope that they don't drag all the good things the plugin ecosystem made down with them.

Okay, so now what?

At least Memoria forgot to buy the domain name mentioned in the source code and changelogs. I don't know about you, but I really do like this redesign, even if it doesn't have that same dark-cyan theme they were talking about.

"memoria.gg got a full visual refresh, a dark-cyan theme across the home page, search, and character profiles." — Memoria CHANGELOG.md, v1.3.0.