Privacy policy
Last updated:
This is a translation provided for convenience. In case of discrepancy, the Spanish version prevails.
Last updated:
This is a translation provided for convenience. In case of discrepancy, the Spanish version prevails.
This policy explains what personal data PokéAtlas Lab processes, why, and how to exercise your rights under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Starting principle: ask for and keep as little as possible. You can play without an account and without giving any data.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email account: name, email address and password (stored only as a salted hash), sign-up date and whether the address is confirmed. | Create and maintain your account and, if the site sends email, confirm your address and send you the password-recovery link when you request it. | Performance of the contract for using the service (art. 6.1.b GDPR). | Until you delete the account. |
| Guest account: a random identifier and a fictitious technical email generated by the system. No data of yours. | Keep your progress without signing up. | Performance of the contract (art. 6.1.b). | Until you delete it or turn it into an email account. |
| Sign-in with GitHub (only if enabled): GitHub account identifier, name, email and the tokens GitHub provides. | Sign in without a password of your own. | Performance of the contract (art. 6.1.b). | Until you delete the account. |
| Profile: public handle, display name, trainer portrait (generated or customised), partner Pokémon, chosen showcase of achievements and trophies, public or private profile setting and rankings appearance setting, experience, level and achievements. | Show your profile and progression. | Performance of the contract (art. 6.1.b). | Until you delete the account. |
| Games: minigame, mode, difficulty, score, correct answers, duration and date; for verified games, whether they are excluded from competition and the team's review (reason, status, note and date). | History, progression, achievements, leaderboards, weekly leagues, monthly seasons with their trophies, and duels. | Performance of the contract (art. 6.1.b). | Until you delete the account. |
| Sign-in sessions: IP address, browser (user agent) and dates. | Account security and abuse prevention. | Legitimate interest in protecting the service and your account (art. 6.1.f). | Until the session expires (30 days without use) or you sign out; expired sessions are deleted. |
| Verified challenge sessions: answers, times measured on the server and browser (user agent). | Validate competitive games and detect cheating. | Legitimate interest in fair competition (art. 6.1.f). | The browser is erased after 90 days; the rest, until you delete the account. |
| Anomaly log: your user identifier and the type of anomaly (for example, an impossible response time). | Human review of possible cheating or abuse. | Legitimate interest (art. 6.1.f). | 180 days. |
| Question reports: minigame, question text, reason and the optional comment you write. | Correct or remove wrong questions. | Legitimate interest in content quality (art. 6.1.f). | While useful for review. If you delete your account, the report is kept without author and without your comment. |
| Moderation: suspensions and their reason, and the log of team actions. | Enforce the terms of use and account for every action. | Legitimate interest (art. 6.1.f). | The team action log is kept after the account is deleted, without your contact details. |
| Rate limits: IP address or user identifier, in memory or in the rate-limit store (Redis) if the site uses one. | Prevent abuse (for example, mass password attempts). | Legitimate interest (art. 6.1.f). | Seconds or minutes: discarded when each window expires. |
What other people see: rankings, weekly leagues, challenges and duels show your handle, score, games and time. With a public profile they also show your display name, portrait and level, linked to your profile. With a private profile only your handle is shown, without a link, unless you turn off “Appear in rankings with my username” in your account settings: you then appear as “Private trainer”. Guest accounts start with a private profile and a visible handle. Showing the handle in these tables is part of the competitive service (art. 6.1.b) and you can turn it off at any time.
Advertising: the site shows Google AdSense ads. Google LLC and its partners may use cookies and browser identifiers to measure ads and, only if you accept it in the notice shown when you arrive, to show you ads tailored to your interests; if you do not accept, non-personalised ads are shown. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time from “Privacy and ads” in the footer of every page. We never sell or hand over your account data; Google processes ad data as described in how Google uses information from sites that use its services.
Your local game history, Pokédex favourites and light or dark theme are kept in your browser's local storage and are not sent to the server. They are explained, together with cookies, in the cookie policy.
Some Pokémon images (sprites, type and item icons) and the cries are loaded directly from GitHub's servers (raw.githubusercontent.com), where the PokeAPI/sprites and PokeAPI/cries repositories are published. When loading them, your browser sends GitHub, Inc. (United States) your IP address, your browser identifier and the resource address, which shows which Pokémon you are viewing. GitHub processes that data under its privacy statement.
Large artwork is served through our server, which downloads it from GitHub without any data of yours. Typefaces are hosted on our own server: there are no requests to Google Fonts. There is no analytics, tracking pixels or social media buttons. With advertising on, your browser also connects to Google's servers (googlesyndication.com, doubleclick.net, google.com) to load the ads and the consent notice; Google receives your IP address and the data described in section 2.
The site owner can enable a mode without third-party resources, in which official images are replaced by original placeholders and your browser does not connect to GitHub.
Your data is processed only, on behalf of the site owner and under a contract complying with article 28 GDPR, by the technical providers essential to run the service: hosting (contabo), database and, if used, the rate-limit store. It is not disclosed to anyone else unless required by law.
Account emails (confirmation of your address and password recovery) are delivered by the email provider Resend (Plus Five Five, Inc., Estados Unidos), which receives your address and the message content only to send it.
Advertising: Google LLC (United States) and the advertising partners listed in the consent notice receive the ad data described in section 2. Google is certified under the EU-US Data Privacy Framework, which the European Commission recognises as an adequate safeguard for that transfer.
Apart from your browser's connection to GitHub described above, there are no international transfers unless the hosting provider is outside the European Economic Area; in that case it will be stated here with the applicable safeguards.
Leaderboards, weekly leagues (group, promotions and relegations) and monthly season trophies are calculated automatically from your results, and rate limits may temporarily slow down excessive requests. None of these produces legal effects on you. The only automatic measure is keeping a game with answers given in an impossible time out of the leaderboards while a person reviews it; voiding results or suspending an account is always decided by a person.
The site is suitable for all ages. In Spain, people under 14 need consent from their parents or guardians to create an email account (art. 7 LOPDGDD). We recommend guest mode, which asks for no personal data. If we detect an account of someone under 14 without that consent, we will delete it.
We will reply within one month. If you disagree with the reply, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the supervisory authority of your country.
Passwords are stored with a strong hashing algorithm (scrypt) and never in plain text. Connections are encrypted (HTTPS) and session cookies are HttpOnly and secure. We apply rate limits, validate every competitive game on the server and restrict the admin panel by roles, logging every action.
The date of the current version appears at the top. If a change materially affects how we process your data, we will announce it on the site.