Privacy Policy

PokéTracker is a fan-made Pokémon collection tracker. This page describes what the service stores about you, why it stores it, how long it keeps it, and how to get it back or delete it. It describes what the software actually does today rather than what it might do.

What is collected

Because you gave it to us

• Account — your email address, a password (stored only as a bcrypt hash), and a display name.
• Profile — username, display name, biography, avatar, trainer card theme and icon, favourite and partner Pokémon, and any friend codes you add. Everything here is optional except the username, and each of these is public if you have made your profile public.
• Your collection — Pokédexes, entries, catch records, notes, tags, shiny hunts, teams, trade wishlists and listings, and trade proposals you send or receive.
• Things you write for other people — comments, feedback reports and template ratings. These are visible to others by design.

Because the software has to

• Session records — an IP address and browser user-agent string are stored against your session so you can stay signed in. They are deleted when the session expires.
• Browsing history within the app — which Pokémon and reference pages you have looked at, so the app can show you recent items. Automatically deleted after 90 days.
• A user-agent string on a feedback report, so a bug report about a rendering problem says which browser it happened in.
• Cookies — a session cookie, a CSRF token, and small display preferences (theme, sidebar state, units, shiny default, sprite style). The preference cookies work whether or not you have an account. Google Analytics sets its own cookies to count visits. There are no advertising cookies.

Who else sees it

Running the service means a small number of other companies handle some of this data on our behalf:

• Cloudflare — serves the site, stores images, and runs the anti-bot challenge on the signup and password reset forms.
• Mailgun — sends account email (verification, password resets, notifications) and receives replies to support mail.
• Google Analytics — aggregate page-view statistics.
• Bunny Fonts — serves the site's typeface. It is used in place of Google Fonts specifically because it sets no cookies and logs no visitor data.
• Sprite and audio archives — most images are served from our own storage, but item icons and Pokémon cry audio are still loaded straight from GitHub, and a few sprites from Pokémon Database and Pokémon Showdown. Your browser fetches those files from them directly, so those hosts see your IP address and browser while a file loads. We are moving them onto our own storage.

Your data is not sold, and it is not shared with anyone else except where the law requires it. Pokémon reference data comes from PokéAPI; nothing about you goes to them.

What is public

Your profile is private until you make it public. When it is public, your username, display name, biography, avatar, trainer card, achievements, follower counts, and any Pokédexes you have individually marked public can be seen by anyone — including by search engines. Comments you leave are visible to anyone who can see the page they are on. You can make your profile private again at any time from your profile settings.

How long it is kept

• Your account and collection are kept until you delete them.
• In-app browsing history is deleted automatically after 90 days.
• Session records are deleted when the session expires.
• Encrypted backups of the database and uploaded images are taken so the service can be restored after a failure. They rotate and are overwritten as they age out, so data you delete can remain inside a backup for a limited period afterwards.

Your rights over it

Both of these are built into the app, not a request you have to email in:

• Take a copy. Settings → Your data exports everything the service holds about you as a file.
• Delete it. Settings → Delete account closes your account and permanently erases the details that identify you — email address, username, display name, biography and avatar. Records you created, such as Pokédex entries and comments other people have replied to, stay in the service in a form that is no longer linked to you.

You can also correct anything on your profile at any time. If you are in the UK, EU, or a US state with its own privacy law, these are the access, portability, correction and erasure rights those laws give you; if you would rather exercise them by email than by clicking, write to the address below and we will do it for you.

Where your data is

PokéTracker is operated from the United States, and your data is stored and processed there. Using the service from outside the US means your information is transferred to the US. Nothing in our terms removes a right that the law of the country you live in gives you and does not let you sign away.

Children

PokéTracker is not directed at children under 13 — or under the higher minimum age your country sets, where it sets one — and accounts are not knowingly created for them. We do not ask anyone for their date of birth. If you believe a child has created an account, contact us and it will be removed.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top of this page changes and account holders are told in the app or by email.

Contact

Questions, corrections, or a request you would rather make in writing: [email protected].

PokéTracker is a fan project and is not affiliated with Nintendo, Game Freak, Creatures Inc. or The Pokémon Company. Pokémon data is provided by PokéAPI.