Privacy Policy

Effective date: 22 May 2026 · Last updated: 2 October 2026

MyPokéSpace (“we”, “us”) is a trainer-profile site for Pokémon trainers, operated as a fan project by herrero.io at https://mypoke.space. This Privacy Policy explains what information we collect about you when you use the service, how we use it, and the choices you have.

Questions about this policy or requests about your data should go to emma@mypoke.space.

1. Information we collect

You provide most of this information directly when you create and use an account:

Account credentials. Your email address and a password you choose. Passwords are stored hashed by our authentication provider (Supabase Auth) — we never see or store your password in plain text.
Profile content. Your handle, display name, pronouns, avatar, background image, status blurb, music link, Top 8 Pokémon and friends, decklists, tournament results, and any other content you choose to add to your space. Images you upload are re-encoded on our server, which removes their hidden photo metadata (such as location and device details).
Game notes, tags and saved lines. Notes you write on games, quick tags, and saved lines. These may be visible to others according to your privacy settings; they are not stored as secret data, so don’t put anything in them you would not want another trainer to read.
Invite metadata. If you joined with an invite code: the code you redeemed, who invited you, and the codes you generated for others.
Tournament player name. If you use “Find me at majors”, the name you played under at official events. Only you can see it; we use it to match you to published standings and offer you those results.
Claim proof photos. If you claim a result from a major event, a screenshot you upload to prove it is yours. It is kept in private storage that only our reviewers can open, has its photo metadata removed, and is deleted as soon as an admin approves or rejects the claim or you withdraw it.
Places. If you save a home area or other places for finding events near you, the postal code you enter and the approximate coordinates of that postal area. We never ask for a street address. Only you can see your places; where we use them to show stats near you, the location is rounded to roughly 10 km.
Your current location. Only if you tap “Near me now” on Events (or turn on “Follow me when I travel” and have already allowed location), your device’s location is rounded to about 1 km on your device and used to show events near you for that visit. We don’t save it or put it in our analytics. Saving it as a spot stores a postal code, like any other place. The follow setting stays on your device, and we only check your location when you open the page, never in the background.
Linked accounts. If you link a Limitless TCG username, we store it and import your public results from Limitless.
Bug reports. What you write in a bug report or feature request, the page you were on, your browser’s user agent and screen size, and any screenshot you attach.
Activity data. Server-side analytics events (which actions you take in the editor — e.g. picking a Pokémon, saving a deck) tied to your profile id, used to measure feature usage and debug regressions.
Technical data. Standard request logs collected by our hosting provider (Vercel) such as IP address, user agent, and request timestamps. Aggregate, anonymous page-view counts and page-speed measurements via Vercel Analytics and Speed Insights. We also log which pages are visited (the path, the referring site if you arrived from elsewhere, and your profile id when signed in) to learn which parts of the site trainers use. Our scheduled jobs keep a log of how many requests they make to outside services; it contains no personal data. We do not set advertising cookies.
Abuse protection. To stop a few actions being repeated too quickly, we count recent attempts per account or network address. Those counts are kept as one-way scrambled values, not stored in readable form, and are cleared out after about a day.
Cookies & local storage. A session cookie set by Supabase Auth so you stay signed in, and a small theme value in your browser’s localStorage to remember light/dark mode, and a random per-tab id in sessionStorage (cleared when the tab closes) used to group page views into visits.
Sign-up protection. To limit automated sign-ups we count recent attempts per network address and per email address. Those are kept as one-way scrambled values, not stored in readable form, and are cleared out after about a day.
Calendar feed and schedule. If you turn on the calendar feed, we create a private link to your event schedule. There is no sign-in on that link: anyone who has the link can see the events on it, including calendar services you add it to. You can replace the link, which stops the old one working, or turn the feed off from your settings at any time. Separately, mutual friends see which events you are going to on event listings unless you hide your schedule in the same settings.

We also import public tournament results (player names as published, decklists and standings) from Limitless TCG, so some of that information may be about you even before you join.

2. How we use your information

To run the service: authenticate you, render your profile, and surface activity to your friends graph.
To moderate user-submitted text and images (see “Third parties” below) and keep the platform safe.
To understand how features are used and to debug problems.
To contact you about your account (e.g. password resets, security notices).

We do not sell or share your personal information for advertising or any other purpose, and we do not run third-party advertising.

3. Public profile content

By design, your profile at /u/<handle> — including your handle, Top 8 picks, friend list, public decks, and tournament history you have not marked private — is visible to anyone with the link, including unauthenticated visitors and search engines. Treat anything you put on your profile as public.

4. Third parties

We rely on a small number of service providers to operate MyPokéSpace:

Supabase — managed Postgres database, authentication, and file storage. Your profile data and credentials live here.
Vercel — application hosting and aggregate analytics. Receives standard request logs and anonymous page-view pings.
Our email provider (currently Resend) — delivers account emails such as password resets and email confirmations. It receives your email address and the message.
Cloudflare Turnstile — when switched on, the human check on the sign-up, sign-in and password-reset forms. Cloudflare receives your IP address and browser details to decide whether a request is automated.
OpenAI Moderation API — text you submit (bio, deck names, tournament notes, etc.) and images you upload are sent to OpenAI’s moderation endpoint for safety classification. Per OpenAI’s terms, this data is not used to train their models.
Zippopotam.us — when you save a place, we send it the postal code (and nothing else about you) to look up the area’s coordinates.
Limitless TCG (including labs.limitlesstcg.com) and pokedata.ovh — sources of public tournament results and event listings that we import. We send them only what is needed to fetch public data, such as a Limitless username you linked.
PokéAPI, Pokémon Showdown and card-image hosts — we display public Pokémon sprites and card images from these services. Your browser requests the image directly when the page loads, so they see a normal web request (like your IP address) but no account information.
Music players — if a profile has music, the player is loaded from that service (YouTube, Spotify or Apple Music) when you visit. That service’s own privacy policy applies to it.
TCGplayer — “Buy on TCGplayer” links open TCGplayer in a new tab with the card or list filled in. We send it nothing about you; what you do there is covered by TCGplayer’s own privacy policy.

5. Data retention

We keep your account and profile data for as long as your account is active.
When you ask us to delete your account, we remove your profile and the content associated with your profile id within 30 days. Analytics events and page views are kept, but no longer linked to you. Copies in our database backups roll off within 7 days after that.
Moderation and abuse records may be kept for up to 12 months to keep the platform safe. Invite-graph metadata needed to preserve other trainers’ invite lineage may be kept in de-identified form.
Claim proof photos are deleted when the claim is decided or withdrawn, and abuse-protection counts after about a day.

6. Your rights

Wherever you live, you can ask us to:

Access — tell you what personal information we hold about you and give you a copy.
Correct — fix information that is wrong.
Delete — delete your account and personal information.
Export — give you your information in a portable, machine-readable format.
Object — stop using your information for a particular purpose, such as analytics.

To exercise any of these rights, email emma@mypoke.space from the address tied to your account. We aim to respond within 30 days. You will not be treated differently for making a request. If you are in the EEA or the UK, you can also complain to your local data protection authority.

You can also edit or remove most profile content yourself from /edit, export your tournaments and decklists from the app, and sign out at any time.

7. Age requirement

MyPokéSpace is for adults: you must be at least 18 to have an account. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, please contact us and we will delete it.

8. Security

We use industry-standard practices: TLS in transit, hashed passwords, row-level security policies in the database to keep tenants isolated, private storage for sensitive uploads, and least-privilege access for admin tooling. No system is perfectly secure; please use a strong, unique password and notify us immediately if you believe your account has been compromised.

9. International users

MyPokéSpace is open to trainers worldwide. It is operated from the United States, and your data is processed in regions selected by our hosting providers (which may include the United States and the European Union). By using the service you consent to this processing.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Material changes will be announced in-app or via email.