Privacy Policy | The Arcanum Forge

Overview

The Arcanum Forge (arcanum-forge.com) is a gaming community site operated by NodeCore LLC. We take a minimal-data approach: we only collect what we need to run the service, we don't sell it, and we don't use it for advertising.

This policy now covers two categories of the site: the public arcade (games, leaderboard, no account required) and Arcanum ID (our account system and social features — profiles, friends, messages, groups, posts). Read the section that applies to what you actually use; most visitors only need the arcade section.

What We Collect — Arcade (no account)

Leaderboard submissions — when you voluntarily submit a score to our arcade leaderboard, we store:

The name you entered (max 16 characters, alphanumeric)
Your score and which game it was for
A timestamp
Your IP address (explained below)

Arcade analytics — when you play a game or interact with the site, we log the event type and a count. We do not attach your identity to these logs.

Your device (localStorage) — your personal best scores and your preferred leaderboard name are saved in your browser's localStorage. This data never leaves your device unless you choose to submit a score.

Standard server logs — like all websites, your browser sends us a request when you load a page. Cloudflare (our infrastructure provider) processes these requests and may log IP addresses, user agents, and timing data per their own privacy policy. We do not separately store these logs.

Why We Store IP Addresses

We store your IP address alongside leaderboard submissions to enforce a fair-play limit of 5 score submissions per game per hour per connection. Without this, a single person could flood the leaderboard with fake scores and ruin it for everyone.

Your IP address is never displayed publicly. It is only used in an automated check to count recent submissions from the same connection. We do not use it to identify, track, or profile you across sessions or across other sites.

The legal basis for this processing is legitimate interest — maintaining the integrity and fairness of a public leaderboard is a reasonable, proportionate reason to retain this data.

What We Collect — Arcanum ID (accounts & social features)

Creating an Arcanum ID account is required to use Arc Mafia and unlocks profiles, friends, groups, and messaging across Arcanum Forge. Signing up currently means signing in with Discord (other sign-in methods may be enabled later). We collect:

From Discord, when you link/sign in — your Discord user ID, username, and avatar image. We also request your email address as part of Discord's sign-in permissions, so we can contact you about your account (e.g. security notices) — we do not use it for marketing.
Profile information you provide — display name, handle, bio, and an avatar you compose yourself from a built-in shape/color picker. There is currently no photo/image upload feature — you cannot upload a picture of yourself or anyone else.
Social graph — your friends list (who you've sent/accepted requests with), the groups you join, and who you follow within the platform.
Content you post — wall posts, comments, and reactions (like/love/haha/wow/sad/angry). Posts are public by default; comments are visible to your friends by default. Anything you post is stored so it can be displayed back to you and others per its visibility setting.
Private messages — message content sent between you and another user. Only the sender and recipient(s) of a conversation can read it; we do not read messages except as needed to investigate a report or legal request.
Profile customization — if you use the HTML/CSS customization feature, the raw markup you write is stored and rendered back (through a sandboxed, sanitized renderer) on your public profile.
Session cookies — a session cookie (arcid_session) that keeps you logged in. It is separate from Arc Mafia's own session cookie; logging into one does not automatically log you into the other.

If email/password sign-up is enabled for your account: your password is never stored in plain text. We store a salted, one-way cryptographic hash (PBKDF2-SHA256, 100,000+ iterations) that cannot be reversed back into your password, even by us.

Content Moderation

Because Arcanum ID lets you post content visible to other users, we operate a moderation system:

Any post or comment can be reported by another user via a "Report" action.
Content that receives multiple distinct reports is automatically hidden pending manual review — this is a precaution while a person looks at it, not a final judgment.
We may remove content or suspend/terminate an account that violates these policies or our Terms of Service, at our discretion.
Reports and moderation actions are reviewed through an internal admin tool, accessible only to NodeCore LLC staff.

How Long We Keep It

Leaderboard entries (name, score, timestamp) — kept indefinitely, as they form the public record of the leaderboard.
IP addresses — stored with each leaderboard entry. In practice the rate-limit check only looks at the past hour, but the value persists in the row. We may purge IP columns in a future database cleanup.
Analytics events — kept indefinitely in aggregate form.
Arcanum ID account and content data — kept for as long as your account is active. If you delete your account (see "Your Rights" below), we remove your profile, posts, comments, messages, and friend relationships; content that necessarily involves another user (e.g. a message you sent them, or a comment on their post) may remain associated with that other user's record where deleting it entirely isn't possible without affecting their own data.

Who We Share It With

We do not sell, rent, or share your personal data with third parties for marketing purposes. The following service providers process data on our behalf:

Cloudflare — hosts our site, runs our edge functions, and stores our databases (D1). All data is processed through Cloudflare's infrastructure. See Cloudflare's Privacy Policy.
Discord — provides the sign-in mechanism for Arcanum ID and Arc Mafia. Your use of Discord itself is governed by Discord's own Privacy Policy.
Resend — sends transactional email on our behalf (e.g. password resets, email verification), when that feature is active for your account. See Resend's Privacy Policy.

Cookies & Tracking

We do not use advertising cookies, tracking pixels, or third-party analytics scripts. The arcade uses localStorage (not cookies) to remember your in-browser preferences — that never leaves your device automatically. Arcanum ID and Arc Mafia each use a single, first-party, HttpOnly session cookie strictly to keep you logged in — not for tracking or advertising.

Your Rights

Depending on where you live, you may have rights regarding your personal data including access, correction, deletion, and objection to processing. To request removal of a leaderboard entry (including the IP address stored with it), or to request deletion of your Arcanum ID account and associated content, contact us via our Discord server and we will act on it promptly.

If you are located in the European Economic Area, you have rights under the GDPR. If you are a California resident, you have rights under the CCPA. We will honor these requests regardless of where you are located.

Children

The Arcanum Forge is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has submitted data to us, please contact us and we will delete it.

GhostSpeaker Bot

GhostSpeaker, our Discord TTS bot, operates under a separate privacy policy accessible via the bot's listing and at arcanum-forge.com/services/bots. That policy governs data the bot processes within Discord servers.

Changes to This Policy

We may update this policy as the site evolves. The effective date above reflects the most recent revision. Continued use of the site after a change constitutes acceptance of the updated policy.

Contact

Questions or data requests: join our Discord server via the link on arcanum-forge.com and reach out directly. We're a small team and will respond personally.