Public beta: found a bug? Tell us on Discord.

Dolphin Depot

Privacy Policy

Last updated: May 6, 2026

1. Introduction

This Privacy Policy explains what data Dolphin Depot collects when you use the website, the public API, or the GameCube Client, why we collect it, how it is processed, and what rights you have over it. It applies to all users of the Service and the Client, as those terms are defined in our Terms of Service.

2. Who is the data controller

The data controller responsible for processing your personal data is the Dolphin Depot project, represented by the project maintainers (the "Operator"). The maintainers and their contact details are listed on the About page.

3. What data we collect

We collect a deliberately small set of technical data:

  • From the website:
    • IP address: automatically present in HTTP requests; used by our hosting provider's server logs.
    • User Agent string: the browser, browser version, and operating system reported by your browser.
  • From the Client (GameCube):
    • CPU ECID: a unique identifier burned into the GameCube CPU at manufacturing. It identifies the specific console contacting the Service.
    • User Agent string: sent by the Client; contains the Client's version, the console hardware type, and the console region.
    • IP address: automatically present in network requests from the console.

We do not ask for or store your name, email address, postal address, phone number, or payment details. The Client does not collect any personal data beyond what is described above.

4. Why we collect it (purposes of processing)

  • System stability and abuse prevention: rate limiting, blocking malicious traffic, and banning specific CPU ECIDs that violate our Terms of Service.
  • Aggregate statistics: understanding which Client versions, console hardware types, and regions are in use, and how popular individual catalog applications are. These statistics are produced in aggregated form and do not identify individual users.
  • Operational logs: diagnosing errors, investigating outages, and improving the reliability of the Service.

5. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on our legitimate interest (Art. 6(1)(f) GDPR) to keep the Service secure, to prevent abuse, and to operate the Service reliably. For data strictly necessary to deliver the Service to you when you use the Client (such as authenticating requests via CPU ECID), we also rely on the performance of a contract with you (Art. 6(1)(b) GDPR); that contract is our Terms of Service.

6. How long we keep it

  • Server access logs (IP addresses, User Agents, request paths) are retained for up to 90 days, then deleted or anonymised.
  • CPU ECID records: kept for as long as your console interacts with the Service; banned ECIDs are kept on the ban list for the duration of the ban (which may be permanent).
  • Aggregated statistics: retained indefinitely in a form that does not identify individual users or consoles.

7. Who we share data with

We do not sell your data and we do not share it with advertisers. Your data is processed on infrastructure provided by the following service providers acting as data processors on our behalf:

  • Cloudflare: website hosting (Cloudflare Pages) and CDN. Cloudflare may process IP addresses and request metadata as part of routing and DDoS protection.
  • Cloud infrastructure providers: used for hosting the public API and the catalog database.

We may also disclose data when required to do so by law or to protect the security of the Service.

8. International transfers

Some of the service providers we rely on (notably Cloudflare) operate global networks and may process data outside the European Economic Area. Where data is transferred outside the EEA, we rely on the safeguards offered by those providers (such as Standard Contractual Clauses approved by the European Commission) to ensure an adequate level of protection.

9. Your rights

Where the GDPR or a similar privacy law applies to you, you have the following rights with respect to your personal data:

  • the right to access the data we hold about you;
  • the right to request rectification of inaccurate or incomplete data;
  • the right to request erasure of your data;
  • the right to request restriction of, or to object to, certain processing;
  • the right to data portability for data we hold based on contract or consent;
  • the right to lodge a complaint with a supervisory authority if you believe your rights have been violated.

Because we collect very little identifying information, exercising some of these rights (in particular access, rectification, or erasure) may require you to identify the console you used by providing the relevant CPU ECID.

10. How to exercise your rights

To exercise any of the rights described above, contact the project maintainers via the channels listed on the About page. We will respond within the timeframe required by applicable law (usually within one month under the GDPR).

11. Cookies and similar technologies

The Dolphin Depot website does not set its own analytics or advertising cookies. Our hosting and CDN provider (Cloudflare) may set strictly technical cookies necessary for security, fraud prevention, and routing. These cookies are not used for tracking across other sites.

12. Children's privacy

Dolphin Depot is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Security

Traffic between your browser and our servers is encrypted using HTTPS.

Traffic between the GameCube Client and our servers is sent over plain HTTP. This is a deliberate technical choice: the GameCube hardware and the homebrew toolchain do not provide a practical, well-tested TLS stack within the console's memory and performance constraints. As a result, the data the Client sends (CPU ECID, Client User Agent, IP address) and receives (catalog metadata) can in principle be observed by anyone with access to the network path between your console and our servers, such as someone on the same local network or an upstream network operator. We do not transmit authentication credentials, personal identifiers beyond those listed above, or any sensitive personal data through the Client.

All distribution files (application binaries and packages) served through Dolphin Depot are digitally signed by the Operator. The Client verifies the signature on the console before installing or launching any file, so even though Client traffic is unencrypted, tampered or spoofed payloads delivered over the network cannot be installed or executed on the console.

We apply reasonable technical and organisational measures to protect the data we hold from unauthorised access, alteration, disclosure, or destruction. No system is perfectly secure, however, and we cannot guarantee absolute security.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through the website or the Client. Your continued use of Dolphin Depot after changes take effect constitutes acceptance of the updated Policy.

15. Contact

For questions about this Policy or how we handle your data, reach out to the project maintainers via the channels listed on the About page.