Privacy

Your account

An account is optional: the catalog and streaming work without one. You sign in with Steam, Discord or a link sent by email; Cartouche never has a password.

• Steam: your SteamID, public name and avatar.
• Discord: your id, display name and avatar (the « identify » scope only: no email, no servers).
• Email: your address, and as your name the part before the « @ ».

Name and avatar are refreshed at each sign-in. A session (a cookie on the site, an encrypted token in the app) lasts 180 days after its last use; we only keep a hash of it, with the kind of device (site, Windows, Android, Xbox). Signing out deletes it.

Your library

Signed in, your library follows you from one device to another: the games in your collection, favorites, hidden ones, your status (want, playing, done), your rating, your personal note, your lists, and the games you added yourself (from GitHub, for instance). Your play time, installs and saves stay on your PC.

What you make public

These show with your name and avatar: your reviews (rating and text), your shared or public collections, and the games you publish with Cartouche Studio. Your hearts on Studio games, your « Does it work? » votes and your game suggestions are recorded with your account but not shown. You can delete a review, remove a heart and stop sharing a collection at any time.

Cartouche Studio

The Studio runs on your PC, with your own assistant (Claude Code, or Codex) and your own keys (Anthropic, ElevenLabs, Tripo): your conversations and projects stay on your PC, where your keys are encrypted. They go straight from your PC to those services, never through us.

If you turn on « Remote Studio » to drive your PC from your phone, our servers relay your PC's name, your commands and the state of the open conversation, in memory only (nothing is written, it all goes once the PC has been silent for 10 minutes). Drafts you open on your phone are kept 14 days, playtests 2 hours, at a secret address.

A game you publish is stored with us (its files, cover and sheet). To count its plays without keeping IP addresses, we record a daily hash (the IP mixed with a changing secret), deleted after 30 days.

Streaming

The stream goes straight from your PC to your phone, tablet or Xbox over your local network: picture, sound and controller never go through our servers. Pairing stays between your devices.

On your device

The Windows app keeps on your PC your session (encrypted by Windows), your library, your play time, snapshots of your saves, a cache of the catalog and technical logs. It sends no telemetry and no crash reports. The site, and the Android and Xbox apps that show it, keep in browser storage your settings (theme, sound, filters), your guest library if you have no account, and the saves of Studio games.

The only cookie is your session's (cartouche_session). There are no advertising cookies and no analytics, hence no banner.

IP addresses

Your IP address is used, for the duration of a request, to limit abuse (too many sign-in attempts, for instance). It is neither stored in our database nor logged.

The services that help us

• OVH (France): the server hosting the site, the API and the database.
• Cloudflare: the network in front of the site.
• Steam and Discord: sign-in, if you choose them.
• Resend: sending sign-in links by email.
• IGDB (Twitch): game sheets and covers. Searches reach it through our server, with nothing that identifies you.
• GitHub: game and app releases, checked by your browser or your PC.

Your browser also loads images from these services (IGDB covers, Steam and Discord avatars).

How long

Your account, library and contributions are kept as long as your account exists. The rest is short-lived: 15 minutes for a QR sign-in in progress, 30 minutes for an email link, 180 days for an unused session, 14 days for a draft, 30 days for play counts.

Your rights

You can ask us for a copy of your data, have it corrected, or delete your account and everything tied to it (library, reviews, collections, published games, hearts): write to [email protected] from the account concerned, or tell us how to recognize it. We answer within a month. You can also contact the CNIL, France's data protection authority (cnil.fr).