Legal

Privacy Policy

Effective date: September 7, 2026

Arctium ("us", "we", or "our") operates the Arctium websites, the Arctium account and the Arctium App (hereinafter referred to as the "Service") and is the controller within the meaning of Art. 4 (7) GDPR. Who is behind Arctium and how to reach us is stated in the Legal Notice; email: legal@arctium.io. We are not required to appoint a data protection officer.

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. We process personal data only on a legal basis under Art. 6 (1) GDPR: your consent (a), the performance of a contract with you (b), a legal obligation (c) or our legitimate interest (f). The basis for each processing is named below. Terms used here have the same meaning as in the EULA.

Definitions

Service: Service are any Arctium websites/tools/servers operated by Arctium
Personal Data: Personal Data means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).
Usage Data: Usage Data is data collected automatically either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
Cookies: Cookies are small files stored on your device (computer or mobile device).

Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to:

Email address
Cookies and Usage Data

Arctium Account

When you create an Arctium account we collect your user name, email address, date of birth and country. The email address is verified with a code we send you. Date of birth and country are used to check the minimum age that applies in your country (Art. 8 GDPR and the national rules based on it). During registration the country your connection comes from is compared with the country you chose; a clear mismatch is refused. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and our legal obligation to check the age of consent (Art. 6 (1) (c) GDPR). The account and its data are deleted when you close it, at the latest 30 days afterwards, unless we have to keep something for legal reasons.

Comments and Uploads

Comments you post appear publicly with your user name and the time of posting. Mods, addons and other files you publish through the Service are stored and offered for download with the project details you entered; download counts are kept per file. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). You can delete your comments and projects; copies that other users have already downloaded are outside our control.

Anti-Cheat Data

The Arctium App contains an anti-cheating component. What it scans, what it sends to us only in the event of a detection (account name, details of the detected program, time, product version), the retention of at most 24 months and the human review of any sanction are described in the Anti-Cheat Agreement. Legal basis: our legitimate interest in the integrity of the Service and in fair play (Art. 6 (1) (f) GDPR).

Payments (Arctium Pro)

Paid features are sold through our payment partner Paddle (Paddle.com Market Ltd., London, and its affiliates) as the merchant of record. Paddle collects and processes your payment and billing data as an independent controller under its own privacy policy (https://www.paddle.com/legal/privacy). We receive from Paddle the information we need to unlock and support what you bought: your email address, the order and subscription identifiers, the product and the subscription status. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and our tax obligations (Art. 6 (1) (c) GDPR, retention of accounting records for up to 10 years).

Microsoft Store

If you install the Arctium App through the Microsoft Store, Microsoft processes your data under its own privacy statement (https://privacy.microsoft.com). We do not receive personal data from the Store beyond anonymous download statistics.

Discord Data

Sign-in with Discord (and later Battle.net) is offered as an option. If you choose it, the provider sends us the data you release there. For information about what data Discord's API exposes about users please see https://discord.com/developers/docs/resources/user. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).

Upon logging in to Arctium Services with Discord via OAuth you provide us with information that may include, but are not limited to:

Discord Email address
Discord User name
Discord User id

Usage Data

We may also collect information how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Our servers keep these access logs to run the Service securely and to investigate attacks and errors. Legal basis: our legitimate interest (Art. 6 (1) (f) GDPR). Logs are deleted after 14 days at the latest unless an incident has to be investigated.

Tracking & Cookies Data

We only use cookies and browser storage that are necessary to run the Service (section 25 (2) of the German Telecommunications Digital Services Data Protection Act, TDDDG). They do not need your consent, which is why the Service shows no cookie banner. We do not use tracking cookies, beacons, tags or fingerprinting.

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

Examples of Cookies we use:

Session Cookies. We use Session Cookies to keep you signed in to your Arctium account and to complete the sign-in with the Arctium identity service.
Preference Cookies. We use Preference Cookies to remember your language (arctium.lang), your news view and which games or trackers you have hidden. Signed-in users' preferences are stored with their account instead.
Security Cookies. We use Security Cookies to protect forms against cross-site request forgery.
Local storage. Your light/dark theme choice is kept in your browser's local storage.

Use of Data

Arctium uses the collected data for various purposes:

To provide and maintain the Service
To notify you about changes to our Service
To allow you to participate in interactive features of our Service when you choose to do so
To provide customer care and support
To provide analysis or valuable information so that we can improve the Service
To monitor the usage of the Service
To detect, prevent and address technical issues

Email

We send emails only when the Service needs to: verification codes, password resets, receipts and notices about changes to your contract or these policies. No newsletter is sent without your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time.

Transfer Of Data

We are based in Germany. The Service runs on the infrastructure of our hosting and security provider Cloudflare (see below), which operates a global network, and on further providers named in this policy. Your data, in particular your IP address and request data, may therefore be processed in the United States or in other countries outside your own, where the data protection laws may differ from those of your country.

Such transfers rest on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, under which Cloudflare is certified) or on the EU standard contractual clauses (Art. 45 and 46 GDPR), together with data processing agreements (Art. 28 GDPR).

Disclosure Of Data

Legal Requirements

Arctium may disclose your Personal Data in the good faith belief that such action is necessary to:

To comply with a legal obligation
To protect and defend the rights or property of Arctium
To prevent or investigate possible wrongdoing in connection with the Service
To protect the personal safety of users of the Service or the public
To protect against legal liability

Security of Data

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Service Providers

We may employ third party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Analytics

We may run our own analytics service to see how the Service is used (pages visited, referrers, browser type, approximate region), on our own infrastructure and without advertising networks. Its data may be processed on the same infrastructure as the Service, including outside your country. Legal basis: our legitimate interest in understanding and improving the Service (Art. 6 (1) (f) GDPR). Where such a service needs to store anything on your device beyond what is technically necessary, we will ask for your consent first.

Email Provider

Transactional emails are sent through an email provider that processes data on our behalf under a data processing agreement (Art. 28 GDPR).

External Content

Images and posts from third-party sites shown in the Service (for example Blizzard forum posts or Final Fantasy XIV Lodestone news) are fetched by our server and delivered from our own domain, so your IP address is not disclosed to those sites by viewing them here.

Cloudflare

We use services provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; for the EU: Cloudflare Germany GmbH, Munich) for hosting and to ensure the security and performance of our Service.

Cloudflare hosts parts of the Service and acts as a Content Delivery Network (CDN) and a security reverse proxy. This means that traffic to our Service is routed through Cloudflare's global network and may be processed in the USA or other countries. This allows Cloudflare to detect and prevent malicious attacks (such as DDoS attacks) and optimize loading speeds.

Data Collected: To provide these services, Cloudflare may process data such as your IP address, system configuration information, and other traffic data regarding the request.
Legal Basis: The use of Cloudflare is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in providing a secure and error-free provision of our Service. Cloudflare processes data on our behalf under a data processing agreement; transfers to the USA rest on the EU-US Data Privacy Framework and the EU standard contractual clauses.
Privacy Policy: For more information on how Cloudflare handles your data, please visit: https://www.cloudflare.com/privacypolicy/

Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's Privacy

An Arctium account requires the minimum age that applies in your country (between 13 and 16 years, based on Art. 8 GDPR and the national rules); it is shown when you register. The Service does not address younger children.

We do not knowingly collect personally identifiable information from anyone below that age. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

Your Rights

Under the GDPR you have the right to access the personal data we hold about you (Art. 15), to have it rectified (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing that rests on our legitimate interest (Art. 21). Where processing rests on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3)). Write to legal@arctium.io; we answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the Data Protection Commissioner of Lower Saxony (Landesbeauftragte/r für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, https://lfd.niedersachsen.de.

Automated Decisions

We do not make decisions with legal effect on you that rest solely on automated processing. Anti-cheat detections are reviewed by a person before a sanction takes effect.

Retention

We keep personal data only as long as the purpose requires: account data until you close the account (plus up to 30 days), comments and projects until you delete them, server logs 14 days, anti-cheat detection records at most 24 months, billing records for the statutory retention period of up to 10 years.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us by email: legal@arctium.io