Skip to content

Privacy Policy

Jump to bottom
codingncaffeine edited this page Oct 10, 2026 · 4 revisions

Privacy Policy

Effective date: 2026-10-10 (revised to add the Steam store lookups the Windows platform makes, present since v1.9.1; the 2026-09-23 revision covered cloud sync, EmuTV themes, SteamGridDB, arcade bezels, game manuals and the timed refreshes as of v1.8.10; original policy 2026-05-17) Applies to: Emutastic for Windows (all versions)

Summary

Emutastic does not collect, store, transmit, or sell any personally identifiable information. It contains no analytics, no crash reporting, no telemetry, and no user-tracking of any kind. Emutastic operates no servers of its own. All persistent state lives on the user's local machine. The one feature that copies the user's data off the machine — the optional cloud sync — sends it to a private GitHub repository the user owns, under the user's own GitHub account, and only after the user signs in and turns it on; the author never receives it.

The rest of this page documents the specifics in the format RetroAchievements' hardcore-compliance review expects.

What data Emutastic collects

None. Emutastic does not collect any data about its users or their usage of the application.

What data Emutastic stores locally on the user's machine

Emutastic writes the following to the user's local filesystem, under either %AppData%\Emutastic\ (default) or a user-chosen custom data folder, or PortableData\ next to the executable in portable mode. None of this leaves the user's machine via Emutastic.

What Where Notes
Library database (game list, play counts, save metadata) library.db SQLite. Contains only the user's ROM paths, titles, console, play history, and artwork paths. No external IDs or PII.
User credentials for third-party services config.json RetroAchievements username/token, ScreenScraper username/password and a SteamGridDB API key are stored here when the user opts to enter them, in plaintext. The GitHub sign-in token for cloud sync is stored there too, protected with Windows DPAPI so only the same Windows user account can read it. None are ever sent to Emutastic-controlled servers (Emutastic operates none).
Save files and save states BatterySaves\, Save States\ Per-game .srm / .state files, generated by the active libretro core. Battery saves and memory cards are also copied to the user's own GitHub repository when cloud sync is on — see the cloud sync section below.
Screenshots and recordings Screenshots\, Recordings\ Local image and video files.
Cover art and metadata Artwork\ Cached locally after the user fetches it from ScreenScraper, OpenVGDB or SteamGridDB.
Downloaded extras Artwork\ (manuals), EmuTvThemes\, Overlays\ (bezels), Cores\ Game manuals, EmuTV themes, arcade bezels and libretro cores the user chose to download.
Per-game notes library.db Free text the user types on a game's card. Included in the library backup when cloud sync is on.
Logs Logs\emulator.log, Logs\ra.log Diagnostic output from emulation and RetroAchievements activity. Never transmitted; written for the user's own debugging.

What outbound network traffic Emutastic generates

Emutastic makes outbound HTTPS requests to the following third-party services, either as part of explicit user actions (logging in, fetching artwork, downloading a core / DAT / theme / manual, checking for updates), to render content the user has opted in to display (RetroAchievements badges and game art when an RA session is active), or on a timer the user has switched on. Emutastic does not proxy these connections — the requests go directly from the user's machine to the third-party service. There is no Emutastic-controlled telemetry endpoint.

Three things run on a timer, and each exists only after the user has opted in:

  • RetroAchievements play session — while a game runs with RA signed in, rcheevos reports unlocks and rich-presence pings to RetroAchievements at its own cadence. This is the RA feature working as designed.
  • Friends refresh — with the Friends feature enabled, the library window periodically re-reads the public RetroAchievements profiles of the users the account follows, to show their recent unlocks. Signing out of RA or disabling Friends stops it.
  • Periodic cloud upload — with cloud sync signed in and its timing set to "Every 15 minutes during play", battery saves changed during play are uploaded to the user's own repository on that interval. "Manual only" uploads nothing until the user clicks Sync.

Every other request below happens only when the user does something.

Retro Achievements

Service When What is sent What is received
RetroAchievements API (retroachievements.org/API) The user is logged into RA and is playing a game or browsing the Achievements tab The user's RA username / login token / Web API key (which the user provides), the User-Agent string Emutastic/<version> (Windows X) <core>/<version>, game hashes for identification Achievement metadata, unlock confirmations, leaderboard data, profile info
RetroAchievements media (media.retroachievements.org) The Achievements tab and detail card render achievement badges and game icons Anonymous image requests for badge / game IDs PNG badge images
RetroAchievements Web API, Friends feature (retroachievements.org/API) Friends enabled: on a timer while the library is open, and when the user adds or opens a friend The user's Web API key and the followed users' public RA usernames Those users' public profile, points and recent unlocks (all data RA already shows publicly)

Artwork and metadata

Service When What is sent What is received
ScreenScraper API (screenscraper.fr/api2/) User opted into artwork / metadata fetching and entered ScreenScraper credentials; also when the user downloads a game's manual ScreenScraper credentials, ROM filenames / hashes Cover art, screenshots, video previews, game metadata, PDF manuals
SteamGridDB (www.steamgriddb.com/api/v2/) Only when the user has entered their own SteamGridDB API key and fetches artwork That API key and the game's title Grid / cover images
Steam store API and image CDN (store.steampowered.com/api/appdetails, shared.akamai.steamstatic.com) A Steam game is added to the Windows platform through its steam:// shortcut, or its artwork is refreshed Anonymous request carrying the Steam app ID of that game (no Steam account, no key) The store's public details for the app (title, developer, genres, release date, short description) and its library cover / hero images
The Bezel Project (raw.githubusercontent.com/thebezelproject/...) The user turns on an arcade bezel for a game Anonymous request for the bezel file named after the arcade short name Bezel PNG
Arcade Italia / progettoSNAPS (adb.arcadeitalia.net/service_scraper.php) Metadata refresh on an arcade game Arcade game short name (e.g. galaga) Title screen, marquee, flyer, screenshot URLs, metadata
Libretro thumbnails (thumbnails.libretro.com) Artwork fetch fallback when ScreenScraper / OpenVGDB don't have coverage Anonymous request for <system>/<category>/<title>.png PNG thumbnail image
OpenVGDB cover art (gamefaqs.gamespot.com, raw.githubusercontent.com, art.gametdb.com) Box-art fallback when libretro thumbnails has no image for a matched game Anonymous image request for the cover-art URL stored in OpenVGDB Cover-art image (JPG / PNG)

OpenVGDB itself is not a network service — the application ships an embedded copy of the OpenVGDB SQLite database (Assets\openvgdb.sqlite) and queries it locally, so game matching and text metadata (title, developer, genre, etc.) generate no network traffic. Box art is the exception: when a matched game has no libretro thumbnail, Emutastic downloads the cover image from the third-party URL stored in OpenVGDB's releaseCoverFront field — see the OpenVGDB cover-art row above.

Downloadable assets (Preferences → Extras)

The following endpoints are contacted only when the user explicitly clicks Install / Update on the corresponding asset in Preferences → Extras or Preferences → Cores.

Service What is sent What is received
Libretro core buildbot (buildbot.libretro.com/nightly/windows/x86_64/latest/) Anonymous request for a core .dll filename The core's .dll binary
Libretro cheats database (buildbot.libretro.com/assets/frontend/cheats.zip) Anonymous request cheats.zip (community cheat collection)
Libretro DAT repositories (raw.githubusercontent.com/libretro/libretro-database/..., .../FBNeo/..., .../mame2003-plus-libretro/...) Anonymous request for specific DAT / XML DAT / XML file used for ROM identification
Libretro overlay-borders (api.github.com/repos/libretro/overlay-borders/...) Anonymous request Vectrex overlay PNGs
Redump (http://redump.org/datfile/<slug>/) Anonymous request Redump DAT file for disc-based systems
SDL3 release (api.github.com/repos/libsdl-org/SDL/releases/latest) Anonymous request Latest SDL3 release metadata, then a follow-up download of SDL3.dll
FFmpeg builds (github.com/BtbN/FFmpeg-Builds/releases/download/latest/...) Anonymous request ffmpeg.exe binary
ES-DE theme catalogue (gitlab.com/es-de/themes/themes-list/) and the theme repositories it points to (gitlab.com / github.com archive downloads) Anonymous request when the user opens EmuTV's theme picker, and when they install a theme The theme list, then the chosen theme's archive

Cloud sync (optional, off until the user signs in)

Cloud sync backs up each PC's battery saves and memory cards, plus a snapshot of its library database (titles, play history, per-game notes), to a private GitHub repository owned by the user — one repository per PC, created under the user's own GitHub account when they sign in from Preferences → Cloud Sync. The author has no access to it; Emutastic never sends any of this to a server the author controls, because there is none.

Service When What is sent What is received
GitHub sign-in (github.com/login/device, api.github.com) The user clicks Sign in GitHub's device-code flow; the resulting token is stored locally, DPAPI-protected An access token scoped to the user's repositories
GitHub API (api.github.com/repos/<user>/emutastic-saves-<pc>/...) On sign-in (repository creation), before a game launches (pull), after a game closes and on the periodic timer if enabled (push), and when the user clicks Sync Battery saves and memory cards under BatterySaves\, the library snapshot, and a sync manifest. With Encryption enabled these are encrypted on the user's machine with a passphrase only the user knows before upload; GitHub then holds ciphertext The same files, when restoring on another PC

Excluded from upload: BIOS files, save states, screenshots, recordings, logs, caches and texture packs. The user can delete the repository from GitHub at any time; Emutastic keeps no copy elsewhere.

Update check

Service When What is sent What is received
GitHub Releases API (api.github.com/repos/codingncaffeine/Emutastic/releases/latest) The user opens Preferences → About Anonymous request for the latest release tag The latest version number, used to display "A newer release is available" if applicable

Server locations and countries

Emutastic operates no servers. There is no Emutastic backend, no Emutastic database, no Emutastic-hosted log aggregation, no Emutastic-hosted analytics. Server-side privacy policies for the third-party services listed above are governed by those services individually:

Data retention

Emutastic itself retains no user data (because it collects none). Local files written to the user's filesystem persist until the user deletes them. There are no automatic expiration or retention schedules — the data is the user's own.

GDPR / privacy regulation compliance

Emutastic does not act as a data controller or data processor under the GDPR, CCPA, or any analogous regulation, because it does not collect, store, transmit, or process personal data. Users in any jurisdiction have the same posture: their data stays on their own machine, under their own control.

For data held by the third-party services Emutastic talks to on behalf of the user, the user is the data subject and the third-party service is the controller. See those services' privacy policies linked above. This includes the cloud-sync repository: it lives in the user's own GitHub account under GitHub's terms and privacy policy, the user can delete it at any time, and the author is not a party to it.

Children's data

Emutastic does not knowingly collect any data from any user, including children under 13. It collects no data from any user, of any age, regardless of jurisdiction.

Changes to this policy

Updates to this policy will be published on this page, with the effective date updated at the top. The git history of this page in the wiki repository is the authoritative changelog.

Contact

For questions about this policy, open an issue at the Emutastic GitHub repository.

Console Notes

Features

Technical

Platforms

Legal

Clone this wiki locally