Privacy Policy

1. Data we collect

Account: your trainer name and, if you link one, the public address of your Solana wallet. We never receive your private key or seed phrase.

Guest accounts: a random device key stored in a cookie on your browser. We store only a one-way hash of it.

Game: progress, Pokémon, items, in-game transactions, chat messages and reports.

Technical: IP address, session cookie, browser and device type, and server access and error logs.

Notifications (optional): the delivery address your browser creates, only if you turn them on.

Sign-in with Google, Facebook or X (optional): the account id that provider gives us, your name or @handle and, if the provider shares it, your e-mail. We never receive your password and we don't keep the provider's access tokens.

Purchases: the pack, amount, status and dates of each payment and the payment provider's reference. We don't store card or bank details.

2. What we use it for

To run the game and keep your account and progress.

For security, preventing cheating and abuse (including limits on new guest accounts), chat moderation and fixing bugs.

To check eligibility for vault card prizes and to link your game profile to your POKÉDEX profile, if you link a wallet.

To send notifications, only if you turn them on.

We don't use your data for advertising and we don't sell it.

To open the same account on any device when you sign in with Google, Facebook or X.

To process Diamond purchases, deliver them, handle cancellations and refunds, and prevent payment fraud.

3. Who we share it with

Our hosting provider (DigitalOcean), where the game runs.

The POKÉDEX site (pokedex.fund), for wallet-linked accounts: your wallet address and a public summary of your game progress (badges, Pokédex count, team) for your POKÉDEX trainer profile.

Your browser's notification service (Google, Apple or Mozilla), only if you turn notifications on.

Other players see your trainer name, public profile, showcase and the messages you send in public chat.

Authorities, when the law requires it.

Google, Meta (Facebook) or X, only when you choose to sign in with them: they confirm who you are. We don't post for you or read your contacts.

Payment processors, only when you buy Diamonds. Mercado Pago (Pix) receives the amount, a purchase reference and the e-mail used for the payment, and processes the payment under its own privacy policy; your bank and Pix details stay with Mercado Pago and your bank.

Stripe (international card), only while card payments are active: it receives the amount and a purchase reference, and you enter your card details on Stripe's own payment page, under Stripe's privacy policy. Card details never reach our servers. From either processor we receive only the payment status and its reference.

4. How long we keep it

Chat messages: 7 days. Reports: 90 days. Server logs: a few days. Database backups: up to 14 days.

Account and progress: while the account exists. Guest accounts that stay inactive for a long time may be deleted.

Public blockchain data (such as wallet addresses and burns) is on-chain and outside our control.

Payment records: for as long as tax and consumer-protection laws require.

5. Cookies and local storage

We use only what the game needs: a session cookie (to keep you signed in), a guest device cookie (to bring you back to your guest account), a security cookie against cross-site requests, and local storage for settings such as sound.

No advertising or third-party tracking cookies.

6. Your choices

You can ask us for a copy of your data, to correct it, or to delete your account. Contact @pokedexfund on X. Deleting a guest account also happens if you clear your cookies and the account stays inactive.

To remove a Google, Facebook or X sign-in, use Profile → Sign-in methods or see play.pokedex.fund/data-deletion. Removing POKÉDEX IDLE from your Facebook apps deletes your Facebook link automatically. Transaction records and public blockchain data stay, anonymized.

7. Security

Encrypted connections (HTTPS), session and device keys stored only as hashes, restricted database access and logs without secrets. No system is perfectly secure, but we work to protect your data.

8. Where data is processed

The game servers are in the United States. By playing, your data is processed there.

9. Children

The game is not directed at children under 13. If you are under the age required in your country to use online services on your own, play only with a parent's or guardian's permission.

10. Changes and contact

We may update this policy; the version and date are shown at the top of this page. Questions: @pokedexfund on X (x.com/pokedexfund).