Privacy
What this installation stores and which external services are involved.
Abuse prevention
The site and API keep client IP addresses or IPv6 network prefixes, request counters and temporary blocks in server memory. Client state expires after 48 hours of inactivity; cleanup runs every minute. An anonymous HttpOnly security cookie expires after 30 minutes. Challenges expire after 2 minutes and verification-token hashes after 5 minutes. This state is not written to the catalogue database and is cleared on API restart.
Download verification
In self-hosted ALTCHA mode, Arkona serves the verification widget and checks its proof of work on its own server. No CAPTCHA requests, tokens or IP addresses are sent to Cloudflare or ALTCHA. Short-lived, single-use challenges are tied to the browser session, client address and selected release. Legacy installations can explicitly use Cloudflare Turnstile instead; in that mode the browser contacts Cloudflare and the server sends it the token and client IP. The local development bypass is restricted to loopback addresses and is not a CAPTCHA. Public VPN/datacenter lists are checked locally; visitor IPs are not sent to their publisher.
Preferences on this device
The gamedb-language cookie stores your selected language for one year and is renewed when you change language. The theme and results-per-page preferences are stored in your browser's local storage until you remove them. These preferences do not require an account.
Reports and personal information
Reports previously submitted through the contact form are kept in a private inbox with the subject, referenced page, message, optional email, language and submission time. These are used to investigate the request and, if an email is provided, reply. The report feature does not store your IP address or user agent. Records expire after 90 days and are checked hourly while the server is running; backups require a separate retention policy before deployment.
External services
Covers and screenshots may load from IGDB or Steam infrastructure, which receives a network request from your browser. Opening a download or external reference takes you to another service with its own privacy policy. These external services are not controlled by Arkona.
Requests and deployment
You can send personal-data enquiries, including access, correction or deletion requests, through my CS.RIN.RU profile linked on the Contact page. Include your report reference where relevant. No audience-measurement or advertising integration is currently configured in the application. Hosting and access-log policies must be completed for the production installation.