Privacy Policy

Account: username, email and password hash (never the plain password). Optionally: display name and bio.

Content you create: teams, versions, ratings, likes, saves, comments, follows and reports.

Profile picture (optional): cropped and resized in your browser before upload, which removes metadata such as GPS location. It is public on your profile and comments.

Player profile (optional): your Pokémon Champions trainer name and Doubles rank, public on your profile. For rank verification, both screenshots are read on our server (OCR, no external services) and deleted right after; the left part of the screenshot (avatar) is cut off in your browser before upload. From your Trainer ID we only keep an irreversible code (HMAC) to stop the same game account from being used on two accounts; we never show it.

AI Team Builder (premium): your request text and the game data needed are sent to the AI provider (Anthropic) only to generate the team. We do not send your name, email or private teams not included in the request. We store the request and result for quota and support.

Session: a random identifier in an essential cookie; only its hash and expiry date are stored in the database.

Service emails: email confirmation (link valid for 48 hours) and password recovery (30 minutes). We store only the hash of each single-use code and the confirmation date. Emails are sent through Resend (Resend, Inc., USA), which receives the address and message text only to deliver them. We don't send newsletters or advertising.

Moderation: reports, internal notes and moderation actions (hiding comments, locking teams, suspending accounts) are recorded for community safety.

Minimal security logs (sensitive actions, no message content). IP addresses are used only in memory for abuse rate limiting and are not stored in the database.

To provide the service you requested (GDPR art. 6(1)(b)): authentication, saving and publishing teams, community features.

Security and abuse prevention (legitimate interest, art. 6(1)(f)).

We do not sell data, run ads or third-party analytics, and we do not train AI models on private teams.

For as long as your account exists. Sessions expire after 30 days and notifications after 90. When you delete your account your data and content are removed from the database immediately (backups are overwritten in the normal rotation cycle).

Forks other people made of your public teams keep your username as a text attribution.

Access and portability: export all your data as JSON in Settings.

Rectification: in Settings and the Team Builder. Erasure: Settings → Delete account.

You may lodge a complaint with your data protection authority (in Portugal, the CNPD).