Privacy Policy

Who we are

PokeFeed ("PokeFeed", "we", "us", "our") is a community-driven, fan-made website for competitive Pokémon Champions teams, where users can publish, share, and vote on team compositions. PokeFeed is a personal, non-commercial project operated by Lorenzo Boffredo, based in Italy, who acts as the data controller.

For any privacy-related request or question, contact us at privacy@pokefeed.app.

This Privacy Policy explains what personal data we collect, why, how we use it, who we share it with, and the rights you have. It applies to all visitors and registered users worldwide. Because we are based in the European Union, we follow the EU General Data Protection Regulation (GDPR), and these protections apply to all users regardless of where they live.

What data we collect

We keep data collection to the minimum needed to run the service.

We do not ask for your real name, date of birth, address, phone number, or payment information. We do not knowingly collect any data beyond what is listed above.

How we use your data

We use your data only to:

• create, secure, and operate your account;
• display the content you choose to publish;
• run core site features (voting, saving, rental code copy counts);
• send essential service emails (account confirmation, password reset);
• check user-submitted text against automated moderation, and review or remove content manually, to keep the community safe (see "Content moderation");
• maintain security, prevent abuse, and keep the service working, including an automated anti-bot check on the login, signup, password reset and confirmation-email pages, and when you publish a team without an account;
• understand general, anonymous usage trends to improve the site.

We do not sell your data, and we do not use it for advertising or profiling.

Legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract: to provide the account and features you sign up for, including saving and displaying your content and checking submitted text through moderation before it is published.
• Legitimate interests: to keep the service secure, prevent abuse, and understand anonymous usage, and to document public results of official tournaments (see "Official tournament results"). We balance these interests against your rights.
• Consent: we do not currently rely on consent for any processing. Accepting the Terms at sign-up is part of our contract with you, not consent under the GDPR.
• Legal obligation: where we must process data to comply with the law.

Who we share data with

We do not sell or rent your data. We share it only with the service providers ("processors") needed to run PokeFeed, and only as required for them to perform their function:

• Supabase: authentication and database hosting. Stores your account and content data, and the content of our blog. Data is hosted in the European Union (Frankfurt).
• Vercel: website hosting and content delivery, including the content management system behind our blog. Vercel is based in the United States; this means some technical data (such as requests and server logs) may be processed outside the EU.
• Cloudflare: provides bot and abuse protection (Turnstile) on the login, signup, password reset and confirmation-email pages, and when you publish a team without an account, processing your IP address and browser and device signals to tell humans from bots; and stores and delivers the images of our blog (Cloudflare R2, img.pokefeed.app). United States.
• OpenAI: automated content moderation. When you submit certain text (such as a username, team title, description, display name, or bio), that text is sent to OpenAI's moderation service to check it against safety categories before it is saved. This text is processed for moderation only. United States.
• Vercel Web Analytics: anonymous, aggregated usage statistics, without cookies (see "Analytics").
• Resend: delivery of essential service emails (account confirmation and password reset), sent through our authentication provider. Processes your email address and the content of those emails. United States.

Each provider processes data under its own privacy and security terms. We choose providers that offer appropriate safeguards.

International data transfers

Some of our providers (Vercel, Cloudflare, Resend and OpenAI) are based in the United States. Where personal data is transferred outside the European Economic Area, it is protected as follows. Vercel, Cloudflare and Resend are certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection; Vercel also relies on Standard Contractual Clauses, and Cloudflare relies on them should its certification lapse. OpenAI is not certified under the Data Privacy Framework; transfers to it rely on the Standard Contractual Clauses in its data processing terms.

Cookies

PokeFeed uses the minimum cookies necessary to function:

• Essential session cookie: set by our authentication provider (Supabase) to keep you logged in. This cookie is strictly necessary for the site to work and cannot be turned off without breaking login. No consent is required for strictly necessary cookies.

On phones, we store a small flag in your browser's local storage to remember that you closed the "Get the PokeFeed app" banner, together with a count of up to three page views that decides when it first appears. It stays on your device, is never sent to us, and does not identify anyone.

We do not use advertising cookies, tracking cookies, or third-party marketing cookies. Because of this, PokeFeed does not show a cookie consent banner.

Our bot-protection provider (Cloudflare Turnstile) does not set cookies on this site. Cloudflare may use storage strictly necessary to run its security check on its own domain when you visit the pages where it runs (see "Bot and abuse protection").

Analytics

We use Vercel Web Analytics on every page to understand general, anonymous usage trends (such as total page views, which pages are most visited, and the general country traffic comes from). This analytics service does not use cookies, does not track you across other websites, and does not collect or store information that could identify you personally. Data is aggregated and anonymous.

Content moderation

To keep the community safe, certain text you submit (username, team title and description, display name, and bio) is automatically checked by OpenAI's moderation service before it is saved. This check looks for harmful content (such as hateful, violent, sexual, or otherwise unsafe material). The text is sent for this purpose only and is not used for advertising or profiling. If content is flagged, it may be blocked from being published.

This check is automated. Flagged text is not saved; you can change it and try again, and it has no other effect on your account. We may also review and remove published content manually; those decisions are made by a person, the operator of PokeFeed. If you think a decision is wrong, contact us at privacy@pokefeed.app and a person will review it.

Bot and abuse protection

To protect our account pages and publishing without an account from automated abuse, we use Cloudflare Turnstile, a bot-detection service. When you sign in, create an account, reset your password, ask for a new confirmation email, or publish a team without an account, Turnstile runs a security check that processes your IP address and signals about your browser and device to distinguish real users from automated bots. This check runs only on those pages. The result is verified by our authentication provider, or by our own servers when you publish without an account; we receive only whether the check passed, never your raw verification data. The legal basis for this processing is our legitimate interest in keeping the service secure and preventing automated abuse (Article 6(1)(f) GDPR). Cloudflare acts as a processor and is based in the United States. Turnstile does not set cookies on this site; Cloudflare may use storage strictly necessary to run the security check on its own domain.

Official tournament results

Our tournaments page republishes the results of official Pokémon Champions events from their public team lists, imported from pokedata.ovh. For each Day 2 player we store the name, country and in-game trainer name as they appear in those lists, together with the placing, the match record and the team. We show only the player's name, placing, record and team; the country and the trainer name are never shown, and are used only to tell apart players with the same name and to link the same player's results across events. The legal basis is our legitimate interest in documenting public competitive results (Article 6(1)(f) GDPR); this information is already published by the events, and we balance this interest against your rights.

If you are a player and want your name removed, contact us at privacy@pokefeed.app with the event and your name as it appears. We will replace your name with "Anonymous" on every event we list, delete the stored name, country and trainer name, and stop linking your results across events; the placing and the team stay, without your name, as part of the event's results. Future imports keep it anonymous.

How long we keep your data

We keep your account and content data for as long as your account is active. If your account is deleted, your personal data and the content associated with it are permanently removed from our database. We do not keep hidden backups of deleted accounts beyond what our infrastructure providers retain for their own short-term technical and backup purposes.

Server logs held by our providers (Supabase and Vercel) are kept for up to 24 hours, for security and operational purposes. Analytics data is aggregated and anonymous. Teams published without an account are kept until they are removed at your request or through moderation.

Tournament results are kept for as long as the event is listed on the site.

Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability: receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with a data protection authority (in Italy, the Garante per la protezione dei dati personali).

Right to object. You can object at any time to processing based on our legitimate interests, including the publication of tournament results under your name (Article 21 GDPR). Contact us at privacy@pokefeed.app.

You can edit much of your profile data directly from your account settings, and delete your account at any time from Edit profile > Delete account: this permanently removes your account, your teams, votes and saves. To request access to, or deletion of, your data, contact us at privacy@pokefeed.app.

Children

PokeFeed is not intended for anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at privacy@pokefeed.app and we will remove it.

Security

We rely on reputable providers (Supabase, Vercel, Cloudflare) and standard security practices to protect your data. Passwords are stored in hashed form. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date at the top of this page. We encourage you to review this page periodically.

Contact

For any privacy question or request, contact us at privacy@pokefeed.app.