Privacy policy

Who we are

PokéGogo is a Pokémon collecting game that runs as a Discord bot, with a companion website at pokegogo.xyz (the "website"). In this policy, "PokéGogo", "we" and "us" mean the people who run the bot and the website. You can reach us through the contact form or in our support server.

PokéGogo is a fan project. It is not made, endorsed or sponsored by Nintendo, The Pokémon Company, Creatures Inc. or GAME FREAK inc.

The short version

• We know your Discord account id, name and avatar, and everything you do in the game.
• We don't ask for your email, real name, age, address or payment card, and we never see your Discord password.
• We don't sell your data and we don't show ads.
• The website uses one login cookie. There are no advertising or tracking cookies.
• You can ask us to delete your data at any time.

What we collect

From Discord

When you use the bot or log in to the website with Discord, we receive your Discord user id, username, display name and avatar. The website asks Discord only for the identify permission: we can't see your email, your servers, or your messages outside PokéGogo. Inside the Discord activity, Discord also lets us set the activity status you see on your profile.

Your game

Everything that makes up your trainer: your Pokémon, items, gold and other currencies, bank balance, badges, progress, battle and game results, trades, market listings, clan membership, friends, style items, settings and the times you played.

What you write

Messages you send in the website's lobby chat, clan chat, direct messages and group chats, your custom status, bio, clan descriptions and similar text you choose to add. Direct and group messages are only shown to the people in that conversation, but they are stored on our server and staff can read them when handling a report.

When you contact us

What you write in the contact form, the topic, and the email or Discord name you leave for our answer. If you're logged in, the message is linked to your Discord account. Staff with inbox access can read it. Handled messages are deleted after a year.

When you use the website

• A login cookie (connect.sid) that keeps you logged in for 30 days after your last visit. The session it points to is stored on our server.
• Page view counts: which page was opened on which day, as a total. We don't store IP addresses, user ids or cookies with these counts.
• Online status: when you were last on the website and which page you're on, so the member list can show it.
• Settings kept in your browser (local storage), such as your chat tab, sound on or off, your team builder and which "new" ribbons you've seen. These never leave your device.
• Push notifications, only if you turn them on: the address your browser gives us to deliver them, and which topics you picked.

Like every website, our server receives your IP address with each request. We use it only to deliver the page and to protect the site (for example rate limits), and we don't keep it in our database.

Why we use it

• To run the game: saving your progress, paying rewards, running battles, trades and the market.
• To show your trainer to other players where you choose to (leaderboards, profile cards, the member list, chat).
• To keep the game fair and safe: stopping cheating, bots and abuse, and handling reports and bans.
• To improve the website, using the page view counts.

Where the law asks for a reason (a "legal basis"): running the game you asked to play is necessary to provide the service to you; keeping the game fair and safe and improving it are our legitimate interests; push notifications are based on your consent, which you can withdraw at any time.

Who else sees it

• Other players see your name, avatar, public game stats, the badges and styles you wear, what you post in public chat, and your profile if you make it public. Your friends can see your profile even when it's private.
• Staff (people the owner gives a staff role) can see account details needed to moderate, such as gold, bans, mutes and reported messages.
• Discord handles your login and runs the bot and the activity. Discord's own privacy policy applies to your Discord account.
• Services the website loads: Google Fonts (text fonts), YouTube (only when you play music in the YouTube player), KLIPY (GIF search in chat, which receives what you search for), and Pokémon TCG card images. These services see your IP address and browser like any website you visit.
• Our hosting provider, where the server and database run.

We don't sell your data, we don't share it with advertisers, and we don't use it to build profiles for anyone else. We'll only hand it over to someone else if the law requires it.

How long we keep it

• Your game data is kept while you play, so you don't lose progress. If you ask us to delete it, we do.
• Login sessions end 30 days after your last visit.
• Lobby chat keeps only the most recent messages; clan chat keeps the latest 200 messages per clan.
• Page view totals are kept to see how the website is used over time.
• Moderation records (like bans and the admin log) are kept as long as needed to keep the game safe.

Your choices and rights

• Log out any time from the website menu. That ends your session.
• Make your profile private from the dashboard (friends still see it).
• Turn push notifications off in the Notifications panel or in your browser.
• Get a copy, fix or delete your data: send a privacy request through the contact form, or ask us in the support server. We may need to check that the account is yours first. Deleting your data resets your trainer and can't be undone.

Depending on where you live (for example the EU, the UK or California), you may have more rights, such as objecting to how we use your data or complaining to your data protection authority. Ask us and we'll help.

Children

You need to be old enough to have a Discord account (at least 13, or older where your country requires it) to use PokéGogo. We don't knowingly collect data from younger children. If you think a child under that age is using PokéGogo, tell us and we'll remove their data.

Keeping it safe

The website is served over https, the login cookie can't be read by page scripts, and access to the server and database is limited to the people who run PokéGogo. No system is perfectly safe, but we work to protect your data and will tell affected players if something goes wrong.

Changes

If we change this policy, we'll update the date at the top, and for bigger changes we'll post a note in the website's "What's new" and the support server.