Privacy Policy

Last updated: April 26, 2026

This is a small hobby site for running Pokemon-themed draft leagues on Discord. We try to collect as little as possible and never sell or share your data. This page explains what we keep and why. If anything here is unclear, email [email protected].

1. What we collect

To run the league we keep:

• Your account: a username, and either your Discord identity (user ID, display name, avatar) if you sign in with Discord, or your email address and a hashed password if you sign up with email.
• League activity: the picks you make, results you report, transactions and trades you submit, teamsheets, your draft queue, leagues you follow, and any team profile details you set (team name, slogan, banner, featured Pokemon).
• Discord identifiers we need to make the bot work: server ID, channel IDs, and the message IDs of bot posts (so the bot can react to confirmations and update its own messages).
• In-app notifications we have shown you (e.g. trade offers, draft turn alerts), with read/unread status.

That's it. We don't collect Discord messages, your server list, payment information, real-world identity, or location. The Discord OAuth token used at login is held in memory just long enough to fetch your username and is never stored.

2. How we use it

Only to run the league: registering teams, recording picks and results, displaying standings, and sending you the notifications you've opted into. We do not advertise, profile users, or share data with anyone outside the processors listed below.

3. What's public

Anyone visiting the site can see:

• Your username, team name, coach name, and abbreviation
• Your roster, slogan, banner, and any featured Pokemon
• Your match results, standings, and draft picks for any league you participate in
• Trades and free-agent transactions you've completed

Your Discord user ID and email are never shown publicly. Your public profile URL uses a random opaque ID, not your Discord ID.

4. Where it's stored

Data is held in a PostgreSQL database on a server in the European Union. We do not transfer data outside the EU ourselves. Active league data is kept while a league is running, and for up to 24 months after a league completes so participants can review history. After that we may archive or delete it.

5. Cookies and on-device storage

• Session cookie: a single first-party cookie keeps you signed in. It is HTTP-only, sent only over HTTPS, and expires after seven days of inactivity. A CSRF token is included inside it to protect form submissions.
• Browser storage: your dark mode preference is saved locally in your browser. It is never sent to us.

We do not use third-party analytics, advertising, or tracking cookies.

6. Third-party services we rely on

• Discord - account login and bot operation. Discord's Privacy Policy.
• Cloudflare - sits in front of the site to protect against attacks and speed up delivery. As with any CDN, Cloudflare may see standard connection details (such as IP address and browser type) for security purposes. Cloudflare's Privacy Policy.
• Hetzner - the hosting provider for the database and application. Hetzner's Privacy Policy.
• Proton Mail - delivers verification emails (only if you signed up with email). Proton's Privacy Policy.

7. Your rights

You can manage and remove your data yourself from your account page:

• Download my data exports a JSON file with everything we have linked to you.
• Delete my account removes your personal information immediately. To preserve the integrity of league history for other players, the teams you registered are kept under an anonymized name.

If you are in the European Union or the UK, you also have the right to ask us to correct your data, restrict how it's used, or object to its processing. You can lodge a complaint with your local data-protection authority. The lawful bases we rely on are: contract (running the league for you), consent (email verification, optional avatars, Discord notifications), and legitimate interest (security and league history).

For anything not covered by the self-serve options, email [email protected] and we'll handle it.

8. Children

This service is not directed at children under 13, or under the minimum digital-consent age in your country. If you believe a younger child has signed up, contact us and we will remove the account.

9. Changes

If this policy changes in a way that affects you, we will update the date above. Continued use after changes are posted means you accept the revised policy.

10. Contact

Questions, requests, or anything else: [email protected].