Privacy Policy

This policy covers the game and this website. It is written to be read, not to be survived.

Who is responsible

The operator of this service is the data controller. Use the contact form to reach us about anything in this policy, including a request to see or erase your data.

What we collect

When you create an account: your email address, the trainer name you choose, and a hashed password. A hash is not reversible — we cannot see your password, and neither can anyone who obtains the database.

If you sign in with Google: your Google account identifier, the email address on it, and the display name. We store the identifier because it is what identifies you on future sign-ins. We never receive your Google password.

When you play: everything the game needs to be a game — your Pokemon, items, money, location, battle and trade history, chat messages, friendships, and when you were last active.

Automatically: your IP address and browser user-agent, in server logs, for security and abuse investigation.

Analytics: only if you consent. See the Cookie Policy.

We do not collect payment details, because nothing is for sale. We do not collect a real name, postal address, phone number, or date of birth.

Why we are allowed to

| Data | Reason | | --- | --- | | Account and game data | To provide the service you asked for | | Server and security logs | Our legitimate interest in keeping the service working and unabused | | Analytics | Your consent, which you may withdraw | | Moderation records | Our legitimate interest in enforcing the rules |

Who else sees it

• Google, if you choose to sign in with it, and only what that flow requires.
• Cloudflare, which runs the anti-bot check on the registration and contact forms.
• Google Analytics, only after you consent.
• Our hosting provider, which stores the database and the logs.

Your trainer name and public statistics appear on the public leaderboards, which anybody can read without an account.

We do not sell your data. There is no advertising network on this site.

How long we keep it

Account data lives as long as the account does. Server logs are kept for a short operational window. Moderation records outlive an account deliberately, so that a permanent suspension cannot be shed by deleting and re-registering.

Your rights

You may ask us to show you the data we hold, correct it, erase it, restrict what we do with it, or hand it over in a portable form. You may object to processing based on legitimate interest, and complain to your local data protection authority.

Deleting your account — read this part

You can delete your account from your profile. It is anonymised rather than erased, and that distinction is real.

Destroyed: your email address, your trainer name, your password, any linked Google account, your bio, your avatar, your location, your sessions, your friendships, your notifications, and the contents of every message you sent.

Kept, with nothing left pointing at you: your trades, the battles you fought and their results, and the origin-trainer record on Pokemon somebody else now owns.

The reason is that those rows are other players' records too. Deleting a completed trade would erase it from the other player's history as well; deleting the origin record would corrupt the provenance of a Pokemon that now belongs to somebody else. So we destroy everything that identifies you and leave the structure standing with no way back to you.

Deletion cannot be undone, and the account cannot be signed into afterwards.

Children

The service is not directed at children below the age of digital consent where they live. If you believe a child has given us data, contact us and we will remove it.

Changes

Material changes are announced before they take effect.