Privacy Policy

Effective date: 22 May 2026 · Last updated: 24 May 2026

MyPokéSpace (“we”, “us”) is an invite-only trainer-profile site for Pokémon trainers, operated as a fan project at https://mypoke.space. This Privacy Policy explains what information we collect about you when you use the service, how we use it, and the choices you have.

Questions about this policy or requests about your data should go to emma@mypoke.space.

1. Information we collect

You provide most of this information directly when you create and use an account:

Account credentials. Your email address and a password you choose. Passwords are stored hashed by our authentication provider (Supabase Auth) — we never see or store your password in plain text.
Profile content. Your handle, display name, avatar, background image, status blurb, music link, Top 8 Pokémon and friends, decklists, tournament results, and any other content you choose to add to your space.
Invite metadata. The invite code you redeemed, who invited you, and the codes you generate for others.
Activity data. Server-side analytics events (which actions you take in the editor — e.g. picking a Pokémon, saving a deck) tied to your profile id, used to measure feature usage and debug regressions.
Technical data. Standard request logs collected by our hosting provider (Vercel) such as IP address, user agent, and request timestamps. Aggregate, anonymous page-view counts via Vercel Analytics. We do not set advertising cookies.
Cookies & local storage. A session cookie set by Supabase Auth so you stay signed in, and a small themevalue in your browser’s localStorage to remember light/dark mode.

2. How we use your information

To run the service: authenticate you, render your profile, deliver invites, and surface activity to your friends graph.
To moderate user-submitted free text (see “Third parties” below) and keep the platform safe.
To understand how features are used and to debug problems.
To contact you about your account (e.g. password resets, security notices).

We do not sell your personal information. We do not run third-party advertising.

3. Public profile content

By design, your profile at /u/<handle> — including your handle, Top 8 picks, friend list, public decks, and tournament history you have not marked private — is visible to anyone with the link, including unauthenticated visitors and search engines. Treat anything you put on your profile as public.

4. Third parties

We rely on a small number of service providers to operate MyPokéSpace:

Supabase — managed Postgres database, authentication, and file storage. Your profile data and credentials live here.
Vercel — application hosting and aggregate analytics. Receives standard request logs and anonymous page-view pings.
OpenAI Moderation API— free-text fields you submit (bio, deck names, tournament notes, etc.) are sent to OpenAI’s moderation endpoint for safety classification. Per OpenAI’s terms, this data is not used to train their models.
PokéAPI and Pokémon Showdown — we fetch public Pokémon sprite images from these services to display on your profile. They do not receive your personal information; your browser requests the image directly when the page loads.

5. Data retention

We retain your account and profile data for as long as your account is active. Analytics events are retained indefinitely in aggregate. When you delete your account (see “Your rights”), we delete your profile and the content associated with your profile id; some records (e.g. moderation flags, invite-graph metadata needed to preserve other users’ invite lineage) may be retained in de-identified form.

The database is hosted on Supabase’s Pro plan and is included in their automated daily physical backups. Deleted data may persist in those backups until they age out of the standard retention window.

6. Your rights

Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA/CPRA), you may have rights to access, correct, port, or delete your personal information, and to object to certain processing. To exercise any of these rights, email emma@mypoke.space from the address tied to your account. We aim to respond within 30 days.

You can also edit or remove most profile content yourself from /edit, and sign out at any time.

7. Children

MyPokéSpace is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it.

8. Security

We use industry-standard practices: TLS in transit, hashed passwords, row-level security policies in the database to keep tenants isolated, and least-privilege access for admin tooling. No system is perfectly secure; please use a strong, unique password and notify us immediately if you believe your account has been compromised.

9. International users

MyPokéSpace is operated from the United States, and your data is processed in regions selected by our hosting providers (which may include the United States and the European Union). By using the service you consent to this processing.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Material changes will be announced in-app or via email.