This Privacy Policy explains how the operator of Shiny Pokes (the “Service”) collects, uses, shares, and protects your information. The Service is the website at shinypokes.com (including when installed to your device as a web app), the ShinyPokes iOS app on the Apple App Store, and the ShinyPokes Android app on Google Play. They share one account and one set of data: a hunt you start in an app is the same hunt on the website. Shiny Pokes is a personal-project tool that helps Pokémon players track shiny hunts. By creating an account or using the Service, you agree to this Policy.
The Service is operated by an individual (“we,” “us,” or “the operator”), not a company. For any privacy question or request, contact us at privacy@shinypokes.com. For users in the European Economic Area (EEA) and the United Kingdom, the operator is the “data controller” for your personal data.
We collect only what the Service needs to function. We do not ask for your phone number, mailing address, or payment card details.
a. Account information (from your sign-in provider)
You sign in with Discord, Google, a sign-in link sent to your email, or, in the iOS app, Sign in with Apple. We do not store passwords. With email sign-in we email you a one-time link and keep only a hashed, expiring token, sent from our own mail server (no third-party email service). From Discord and Google we receive and store your email address, your display name, your profile image, and a provider account identifier used to keep you signed in. From Apple we receive a provider account identifier, the email address you choose to share (which may be a private relay address if you use Apple's Hide My Email), and your name only if you choose to share it the first time you sign in; Apple sends no profile image. With email sign-in we store only your email address. Your email address is never shown publicly anywhere on the Service. Other users see only the username and display name you choose.
b. Profile information (provided by you)
A chosen username and display name; an optional bio, favorite game, and banner Pokémon; and an optional custom avatar you upload.
c. Activity data you create
Your hunts (Pokémon, game, method, encounter and chain counts, timer duration, status, and whether the hunt was part of an event such as Safari Week), your catches (including nickname, nature, public/private status, evolution history if you evolve a catch, and an optional photo and short description you add), your settings, community chat messages and the @-mentions you send or receive, Pokémon you add to event planning lists (e.g. a Safari Week wishlist), support messages and any image attachments you send, and feature ideas you submit. We also keep a per-day tally of your hunting activity (how many encounters you log each day) so we can show your hunting streak and weekly activity.
When you use the encounter counter we record the times of day it moved, so the Count history on your stats page can show you when you counted and point out a press that looks like a double tap or an unusually long gap. These times are yours alone, are never shown to anyone else, and are kept for 30 days before being deleted automatically. Your per-day totals are unaffected and are kept for as long as the hunt is.
We also store your time zone (for example “America/Chicago”), which your browser reports automatically the first time you use the Service and whenever it changes. We use it only so that dates the server works out on your behalf, such as which day or month a hunt counts toward and the date shown on your public catch pages, match your own calendar rather than the server's. You can choose a different time zone, or stop it following your device, in Settings. It is never shown to other users.
If you choose to answer the occasional feedback panel, we store your answer: which option you picked for how you found the Service (and the short line of text you type if you pick “somewhere else”), and any star rating and optional comment you leave. Answering is entirely optional and the panel can be dismissed. We store how you found the Service against your account only so that we never ask you again, and we record when the panel was last shown to you so it does not keep reappearing. Admins see these answers as counts only: how many people picked each option, and the average rating. Never against your name. Any text you type is shown to admins without your name attached.
d. Technical and log data
Like virtually all websites, our web server automatically records standard request logs that may include your IP address, browser or app type, and timestamps, used for security and debugging. The iOS and Android apps talk to the same server as the website, so the same applies to them. The application itself does not store your IP address against your account. The apps contain no analytics, advertising, or crash-reporting code of their own.
e. Push notifications
Push notifications come from the iOS and Android apps only; the website does not send them. If you allow notifications in an app, we store the push token your phone provides (used only to deliver notifications, such as a reply from the team or when someone @-mentions you), along with the platform (iOS or Android), the app version and the OS version, so notifications work reliably. A notification is delivered through Apple's push service on iOS or Google's Firebase Cloud Messaging on Android, so its title and text (for example, the first part of a reply to you) pass through that service on the way to your phone. You can turn notifications off in your phone's settings at any time. On the website, replies and mentions show in the notification bell instead.
f. Photos and images you upload
You can upload an avatar, a photo on a catch, and screenshots to support or with a bug report. In the apps you choose these with your phone's photo picker, which gives the app only the photo you pick; the apps do not ask for access to your whole photo library, your camera, your location, or your contacts. Before we store any image, we remove its hidden metadata, such as the place a photo was taken and the phone that took it. A catch photo is only shown to other people if the catch is public and you have chosen to show its photo.
g. What the apps keep on your phone
To keep you signed in, the apps store a sign-in token on your phone (in the iOS Keychain, or in the Android app's private storage), which expires after 60 days. They also keep your display settings on the phone. Deleting an app removes this, but does not delete your account. The Android app can show a floating counter over other apps, only if you turn it on and grant Android's “display over other apps” permission; it shows your count and does not read anything from the apps underneath.
To create and maintain your account; provide core features (tracking hunts, recording catches, showing stats and badges); power community features according to your sharing settings; respond to support requests; maintain security and prevent abuse; and improve the Service.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We run no ad networks and no third-party analytics or tracking. We share information only:
a. Public and community features
Information you choose to make public (public catches, your public hunter page, and leaderboard standings) is visible to anyone and may appear in social-media preview images. If you enable your hunter page, it shows your total shinies, encounters and hours, and (unless you switch that section off) the hunts you have in progress: the Pokémon, game and method, a live encounter count that updates while you hunt, how long you have been hunting it, your average time per encounter, when the hunt started, and when you were last active. In addition, some community features are visible to other signed-in users: messages and @-mentions you post in community chat (which show your display name or username), catches you share into chat, and your active hunts on the live-hunts feed (which shows your handle unless you enable the “Anonymous Hunter” option). Aggregate, non-identifying event stats (for example, the most-planned Pokémon during Safari Week) may also be shown. See Section 6 for your controls.
b. Service providers
Sign-in providers (Discord, Google, and Apple in the iOS app) authenticate you. Apple's push service and Google's Firebase Cloud Messaging deliver app notifications, as described in Section 2e. The App Store and Google Play distribute the apps; they handle downloads and updates under their own terms, and may give us anonymous, aggregate figures such as install and crash counts, according to the choices you make in your phone's settings. We send no data of any kind to an AI provider. We fetch public Pokémon information and images from PokéAPI, Bulbapedia, and a public sprite repository. No personal data about you is sent to them. Our hosting provider stores all account and activity data.
The home page shows how many people are in our Discord. Our server asks Discord for that public count, not your browser, so nothing about you reaches Discord unless you click through to join. There is no Discord content embedded in the page.
c. Legal reasons
We may disclose information if required by law, to protect our rights or user safety, or in response to a valid legal request.
We use a single essential cookie: the authentication session cookie that keeps you signed in. It is strictly necessary, so no consent banner is required. The website also saves a few preferences in your browser's own storage, such as your theme and which notices you have closed, so they stay the way you left them; these never leave your browser. The apps sign in with a token instead of a cookie (see Section 2g). We do not use advertising cookies, analytics cookies, tracking pixels, or third-party trackers, on the website or in the apps.
Do Not Track: because we do not track you across other websites, our behavior is the same whether or not your browser sends a DNT signal.
Shiny Pokes is built to be private by default:
/h/{username} if you opt in.Depending on where you live, you may have the right to access, correct, delete, object to or restrict processing, and obtain a portable copy of your personal data, and to withdraw consent.
To exercise any other right, email privacy@shinypokes.com. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.
If you are a California resident:
Where the GDPR or UK GDPR applies, we process your data to perform our contract with you (providing the account and features), with your consent (optional features such as making your profile public or turning on app notifications, and you can withdraw consent anytime), and for our legitimate interests (keeping the Service secure, preventing abuse, and improving it).
We keep your account data for as long as your account exists. When you delete your account, your associated data is removed right away, and it drops out of our nightly database backups within 14 days, when those backups are discarded. The full steps are on the Delete your account page. Server request logs are retained only briefly for security and troubleshooting. We may retain limited information where required by law.
The Service is hosted on servers located in the United States. If you access the Service from outside the United States, including from the EEA or United Kingdom, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. Where required for such transfers, we rely on appropriate safeguards such as the Standard Contractual Clauses.
We protect your information with: no password storage (you sign in through Discord, Google, Apple, or a one-time email link); encryption in transit (HTTPS/TLS) for the website and the apps; sign-in tokens kept in your phone's protected storage in the apps; validation of uploaded images by type, size, and file signature, with their metadata removed; access controls restricting support attachments and private catches to authorized viewers; and access-controlled server credentials. No method of transmission or storage is 100% secure. If we become aware of a breach affecting your personal data, we will notify affected users and any required authorities as the law requires.
The Service is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, contact privacy@shinypokes.com and we will delete it. Users between 13 and the age of digital consent in their country should use the Service only with parental involvement where local law requires it.
The Service integrates with third-party services (Discord, Google, Apple, the App Store, Google Play, Firebase Cloud Messaging, PokéAPI, Bulbapedia). Their handling of your data is governed by their own privacy policies, which we encourage you to review.
We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide a more prominent notice. Continued use of the Service after changes take effect means you accept the revised Policy.
Questions, requests, or concerns about your privacy: privacy@shinypokes.com.