Store sign-in
What Arcadist receives, stores and reads when you connect a store, explained per store.
The same rules for every store
- Your password stays with the store. You sign in on the store's own website inside Arcadist. Arcadist never sees, stores or sends your password.
- Encrypted on your phone. What the store hands back after sign-in (a session cookie or a token) is encrypted with a key held by Android Keystore and kept in Arcadist's private storage, separately for every account.
- Never in a backup. Sign-ins are excluded from Android backups, from device-to-device transfer and from Arcadist's own backup file. After restoring, you sign in again.
- Sent only to that store. A sign-in is only sent to the store it belongs to, over HTTPS, and requests carrying it do not follow redirects to other addresses.
- Checked before use. An account counts as signed in only after the store has confirmed its account ID (the Amazon Luna test below is the one exception). Signing in alone does not mean Arcadist can read the library.
- Removable at any time. Removing a sign-in deletes it from your phone. Your library entries stay.
Several connections below use interfaces that the stores do not officially offer to apps like Arcadist. They can change or stop working at any time, and their use may not be covered by the store's terms. Arcadist says so before you sign in, and you decide whether to continue.
You can also add any account manually or import a CSV or JSON file. A manually added account is labelled "Manual" and is not a store sign-in, and a file import is not a sync.
Steam
- Sign-in
- On the Steam website. Steam may load a security check such as reCAPTCHA.
- Arcadist stores
- Your Steam session (cookies), encrypted on your phone.
- Arcadist reads
- The games owned by this account.
- Good to know
- The session may allow more than reading your library. The Steam interfaces used are not officially documented. As an alternative you can enter your own Steam Web API key instead of signing in; then the profile's game details must be public, and the key is stored encrypted and never backed up.
Epic Games
- Sign-in
- On the Epic Games website. Epic may load a security check such as hCaptcha.
- Arcadist stores
- Epic returns a one-time code. Arcadist exchanges it for a sign-in token and stores that token, encrypted.
- Arcadist reads
- Your launcher library, only when you start a sync yourself and never on the background schedule. Add-ons are kept with their game.
- Good to know
- This uses the route that community tools such as Legendary use, with Epic's publicly known launcher client. It is not an official interface for apps like this, may not be covered by Epic's terms of service, and your Epic account could be restricted.
GOG
- Sign-in
- On GOG's sign-in page. GOG may load CAPTCHA and security services.
- Arcadist stores
- The GOG session cookie, encrypted on your phone.
- Arcadist reads
- The games in your GOG library.
- Good to know
- The cookie may allow more than reading your library. The GOG interface used is not officially documented.
PlayStation
- Sign-in
- On the Sony website. If your sign-in needs a passkey, you can instead copy your Sony "NPSSO" value from the Sony website yourself and paste it into Arcadist.
- Arcadist stores
- Only a refresh token, encrypted. The NPSSO is used once to obtain it and is not stored.
- Arcadist reads
- Purchased, PlayStation Plus and played PS4/PS5 games, shown separately. Played games are history and never count as owned.
- Good to know
- The route is unofficial and may stop working at any time. Whether an account has an active PlayStation Plus subscription is your own statement in Arcadist; Sony does not report it. The development version also needs Sony app credentials that you enter in the settings.
Xbox
- Sign-in
- On the Microsoft website.
- Arcadist stores
- A refresh token, encrypted. It is sent only to Microsoft and Xbox and lets Arcadist request Xbox data for you until you remove the sign-in.
- Arcadist reads
- Your play history only. Played titles do not prove ownership, and games you never started are missing.
- Good to know
- The Xbox interfaces used are not officially documented for apps like this.
Amazon Luna Test
- Sign-in
- On the Amazon website. You complete passwords, one-time codes and image checks there yourself; Arcadist does not automate them.
- Arcadist stores
- Your Amazon session (cookies), encrypted on your phone.
- Arcadist reads
- Nothing is imported. This is a session test only.
- Good to know
- The session may give broad access to your Amazon account, including purchases and payments, and Amazon's terms may prohibit automated access. Arcadist cannot confirm which Amazon account you signed in with. Every test run asks again.
Questions
Write to contact@arcadist.app. How Arcadist handles all other data is described in the privacy policy.