Where every game came from
Every store game can be traced to the store that sold or gave it, with the store's own record, Cartmark's log and the receipt. Real examples below, and a PC game's files checked against the store's own build.
Every game has a paper trail
Every store game should be traceable to where it legally came from. Cartmark keeps that evidence as it goes, in three layers:
The store's own record
The store's library, read through the store's own sign-in, lists the game with the store's id for it and, where the store says, the date it was added. That is the store vouching for the licence.
Cartmark's log
Every claim, code kept, key redeemed and download is an entry with a time and who did it. Codes and keys are never written into it.
The store's receipt
Order emails, Epic's and GOG's order histories, Microsoft's "You're good to go" page, Legacy's confirmation. These live with the store and in the owner's mail, and Cartmark's record points back to them.
For a game that's downloaded and kept, a fourth: the installer is checked against the store's own checksum, so the file on the server provably is the one the store sold.
A PC game proved against the store's own build
Since 0.39.0.13 a Windows game's files are checked against GOG's own build lists: every file's path, size and checksum against the build GOG published, so a PC game shows the version it is and whether it matches a real build, an older one included. A file a repack replaced is named, and the match never covers it. This is the same idea as RetroAchievements' hash for a ROM, applied to a PC game: the store's list is the one reference, whichever store the game came from.
What the stores can't show
- Microsoft: the Xbox service Cartmark uses only reports what's been played, not what's owned. A redeemed code shows up once the game is played; until then the proof is Microsoft's order history and Cartmark's claim entry.
- Steam doesn't give other apps the purchase date, only that the account owns it. Steam's own purchase history has the date.
- Legacy Games and Amazon have no account Cartmark can read. Their confirmations and emails are the record.
- Taken back: if a store removes a game from an account, Cartmark marks it revoked rather than deleting it, so the history of what was held and when stays intact.
Examples from different stores
Real claims and purchases, as recorded.
| Game | How it was acquired | The evidence |
|---|---|---|
| Astrea: Six-Sided Oracles | Epic weekly giveaway, claimed from Cartmark's Free page | Epic library entry f3ac42b6…, added at 10:50. Cartmark: claimed by the account's owner at 10:51. |
| Mechabellum | Epic weekly giveaway | Epic library entry 32dc85f4…, added the day before. |
| Knytt Classic | GOG giveaway, "Get for free" at GOG's checkout | GOG product 1940274368 on the account from that evening; GOG order history. |
| High On Life | Prime Gaming, added to the linked Epic account by Luna | Luna's "available from your Epic library" confirmation. Epic entry e90781f7…, added at 11:22. Cartmark: claimed at 11:23. |
| DOOM + DOOM II | Prime Gaming GOG code, redeemed on GOG | GOG product 1413291984 on the account, read at 11:36. Cartmark: code kept, claimed at 11:27 (the code itself not logged). |
| DOOM Eternal | Prime Gaming Microsoft code, redeemed on Microsoft's site | Microsoft's "DOOM Eternal Standard Edition (PC) is ready for you" page and order history. Cartmark: code kept 11:21, claimed 11:22. |
| The Da Vinci Cryptex | Prime Gaming Legacy Games code, redeemed on Legacy's page | Legacy's "Thanks for redeeming your Amazon Luna code" confirmation and email. Cartmark: code kept 11:24. |
| Sid Meier's Civilization V | Steam purchase | Steam app 8930 in the account's library, with play time. Steam's purchase history holds the receipt. |
| THE CORRIDOR | Humble order, DRM-free download | In the Humble order history read from the account; Humble's receipt email. |
| Switch games | Nintendo eShop purchases going back years | 10 orders pasted from nintendo.com's order history, each with its order number and date. |
The same games show in the stores' own apps. Epic's launcher library lists Astrea Six Sided Oracles, Botany Manor, Clash - Artifacts of Chaos, Drop Duchy and the rest, each ready to install, matching what Cartmark read.
At the time, the accounts held 111 games on Steam, 29 on Epic, 20 on GOG, 12 DRM-free on Humble and 10 Switch purchases, every one read from the store itself.
The other half of the library
Cartridge and disc images are a different kind of evidence. Each file is hashed and matched against the preservation groups' lists (No-Intro for cartridges, Redump for discs), which say exactly which physical release it is a copy of, and against RetroAchievements' list of known dumps. Since 0.39 each system's page shows its own Redump or No-Intro list, filtered by region, with what is held against it. That proves what a file is, not that it was bought, so for those the family's own cartridges and discs remain the source. Keeping which copies came from which owned original is on the list for the external version.
Arcade sets are proven the same way against MAME's own list for the MAME the box runs, and FinalBurn Neo's: every file inside an arcade zip is checked, and a complete set goes on the mame shelf under the name MAME finds it by.