Privacy

Without an account

Nothing is saved on our side. A Pokebox you build while signed out stays in your own browser (local storage) and never leaves your device. The offline feature keeps a copy of some pages in your browser cache. Clear your browser data to remove both.

With an account, we store

• Your email address (to log you in) and, if one is set, a display name.
• A bcrypt hash of your password. We never store or see the password itself.
• Your Pokebox: every Pokemon you add, with its level, IVs, moves, any nickname you give it, and your tags and favourite marks.
• Your saved parties (raid and Max Battle teams).
• The date the account was created.
• Cookies, only after you sign in or create an account (none are set before that): authjs.session-token (a signed login token that keeps you signed in, about 30 days) and authjs.callback-url (the page to return to after signing in, cleared when you close the browser). The sign-in library may also set authjs.csrf-token (a safety token for its forms) on its own sign-in endpoints. All are essential, first-party and HttpOnly. There are no advertising or analytics cookies.
• Sign-up and login throttling counters. To stop automated abuse we keep short-lived counters keyed by a one-way hash of your IP address and of the email typed. They cannot be turned back into an IP or email and expire within hours. Each sign-up form also carries a one-time code (stored the same hashed way, for at most two hours) so it cannot be replayed. Because of them, more than twenty sign-up attempts per hour from one connection, or five for one email, or ten wrong passwords in 15 minutes for one email, are refused for a while (the page tells you how long). The trade-off: someone who knows your email could lock it out of logging in for up to 15 minutes, but cannot get in.

Features that store more, only when you use them

Share links. When you create one, we store a random, unguessable token tied to your account, whether it shares your Pokebox or one saved party, any label you give it, when it was made, how many times it was opened and when it was last opened. Anyone who has the link can see a live, read-only view of that Pokebox or party (the Pokemon and their details, including nicknames). The view does not show your email or account. The page is not indexed by search engines. You can revoke a link at any time and it stops working at once; deleting your account removes every link too.

Push notifications. If you turn them on, we store what your browser gives us to reach it: its push endpoint address and the encryption keys that go with it, the server key it was registered under, the browser description (user agent) and when we last sent to it. We also store the bosses you follow and a record of which alerts were already sent, so you do not get the same one twice. Turn notifications off in your browser or the site and the subscription is removed; deleting your account removes all of it.

Where it is kept

The site runs on Vercel, and the database is a Neon Postgres database. Like any host, Vercel keeps standard server logs (such as your IP address and the page requested). We do not sell, share or give your data to anyone else.

Export and delete it yourself

On your account page you can download everything stored for you as one JSON file, change your password, or delete the account. Deleting removes your email, password hash, Pokebox, parties, share links, followed bosses, push subscriptions and alert records permanently and immediately.

No tracking, no ads

There are no ads, no analytics, no tracking pixels and no third-party scripts that follow you around. Your data is used only to run the features above.

Questions

PoGoBattler is a hobby project run by one person. If something here is unclear, ask whoever shared the link with you, or delete your account any time from the account page.