Privacy Policy
Last updated: October 14, 2026
This policy explains what personal data PokéTT (“we”, “us”, the “service” at pokett.app and m.pokett.app) collects, why, who handles it for us, how long we keep it and what you can do about it. PokéTT is a market-analytics site for Pokémon trading cards. We do not sell personal data and we do not show ads. Questions or requests: privacy@pokett.app.
1. Who is responsible
2. What we collect, why, and on what legal basis
2.1 Visiting the site without an account
| Data | Why | Legal basis |
|---|---|---|
| IP address, browser / user-agent, page requested, time | Deliver the page; protect the service from scraping and abuse (rate limits, automatic temporary blocks) | Legitimate interest (keeping the service running and secure) |
| A one-time browser check (graphics renderer) to spot headless / automated browsers — nothing is stored in your browser | Anti-scraping security | Legitimate interest |
| Page-performance measurements (Core Web Vitals) via Vercel Speed Insights | Make pages faster | Legitimate interest |
| Cookieless page-view counts (page, referrer, country, device type) via Cloudflare Web Analytics — no cookie, no persistent visitor ID | Know which pages are used | Legitimate interest |
| Product-usage events via PostHog (EU): which features are used — e.g. a search was run, a card was added, a tool was opened; page path without query string; for searches with no results, the search text (max 60 characters). No cookies or local storage, no IP address stored, no session videos, no clicks or form input recorded. Signed-in users: a one-way hashed id, never e-mail or name. Not loaded if your browser sends Do Not Track or Global Privacy Control | Understand which features are used so we can improve the service | Legitimate interest |
| Error reports via Sentry (may include IP address, browser, page and error details) | Find and fix bugs | Legitimate interest |
| Session replay via Sentry (a recording of on-screen actions, text masked) — only if you click Accept in the banner | Reproduce bugs | Consent (withdraw any time by clearing this site’s browser storage) |
2.2 When you create an account
Sign-up and login are handled by Clerk. Depending on the method you choose, Clerk processes your e-mail address, your name / profile picture from the sign-in provider (e.g. Google) and login and security metadata (device, IP address, session). We never see or store your password. In our own database we store:
| Data | Why | Legal basis |
|---|---|---|
| E-mail address, Clerk account ID, account role, creation date | Link your login to your PokéTT data | Contract (providing the service you signed up for) |
| Profile: display name, @handle, short bio, status (your own words or a preset phrase), the avatar image you upload (resized to 256×256 and stored in our database), profile-visibility choices | Show your profile and — only for sections you make public — your public page at /u/<handle> | Contract; publishing a section is your choice in Settings |
| Settings (currency, language, display preferences, digest opt-in) | Remember your preferences across devices | Contract |
| Portfolio (cards, grade, quantity, purchase / sale prices and dates, marketplace, notes) and sale history; watchlists; wishlist (target prices); price alerts; in-app notifications; private card notes; pack-simulator progress; saved layouts; messages you send us from the app | The features you use | Contract |
| CSV files you import into the portfolio (each row as uploaded, plus the matching result) | Process the import and let you review it | Contract |
| Corrections you submit about card data (contributions) | Improve the catalogue | Legitimate interest |
Please don’t put sensitive personal information in notes, your bio or other free-text fields.
2.3 E-mail
- Weekly digest — only if you opt in, sent through Resend to your account e-mail. Every e-mail has a one-click unsubscribe. Legal basis: consent.
- Account e-mails (sign-up codes, security notices) are sent by Clerk. Legal basis: contract.
- If you write to privacy@pokett.app, we keep the conversation to answer you (see retention below).
2.4 Mobile web app (m.pokett.app) and card scanner
The camera scanner sends one small, low-resolution frame to our server to identify the card. It is processed in memory and not stored. If the server can’t be reached, matching happens on your device. The app keeps a copy of public market data in your browser for speed; your personal data (portfolio, alerts, profile) is never written to the device’s storage, and the cached copy is wiped when you sign out.
2.5 What we do not do
No advertising or cross-site tracking cookies. No sale or rental of data. No automated decisions with legal or similarly significant effects on you. Card prices are collected from public marketplace pages; we store prices, dates, grades, listing titles and links, and we do not store seller or buyer names or usernames.
3. Who handles data for us
We use a small number of providers (“processors”) that handle data on our behalf:
| Provider | What for | Data | Where |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosts our API, database and cache, and the server copy of our backups | All account and in-app data, abuse-prevention data, server logs | Japan (Tokyo) |
| Clerk, Inc. | Sign-up, login, sessions | E-mail, name / picture from the sign-in provider, login metadata | USA |
| Vercel Inc. | Hosts the website; Speed Insights | IP address, request data, performance metrics | USA + global edge network |
| Cloudflare, Inc. | DNS, CDN, security / firewall, the secure tunnel in front of our API, cookieless Web Analytics, R2 storage (card images and off-site database backups) | IP address, request data; the off-site database backups (whole database, including e-mail addresses) are encrypted before upload and only the owner holds the key | USA + global edge network |
| Functional Software, Inc. (Sentry) | Error reports; session replay with your consent | IP address, browser, page, error details; replay only if you accepted | EU (Germany) — our Sentry project is on Sentry’s EU region |
| PostHog Inc. | Product analytics: which features are used, in aggregate | Pseudonymous event data: page path (public profiles recorded as /u/:handle), event name, card / set id, device and browser type, country and approximate city (derived from the IP address, which is then discarded); signed-in users as a one-way hashed id. No cookies, no IP address stored | EU (Frankfurt, Germany) — PostHog EU Cloud |
| Resend | Sends the weekly digest (opt-in only) | E-mail address, digest content | USA |
| Telegram | Operations messages to the owner’s own chat | Counts of accounts and, when the owner asks for it, the public @handle or display name of the 5 most recent sign-ups (never an e-mail address) | Telegram FZ-LLC (UAE); per Telegram’s privacy policy, data of EEA / UK accounts is stored in the Netherlands |
Google (and any other sign-in provider you pick in Clerk) is an independent controller for your account with them. Healthchecks.io receives uptime pings from our server that contain no personal data.
4. International transfers
Our database is in Japan, which the European Commission recognises as offering adequate protection (adequacy decision). Our Sentry data is stored in the EU. Where a provider above is in the United States, we rely on the EU-US Data Privacy Framework where that provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses included in the provider’s data processing agreement. You can ask us for a copy of the relevant safeguards at privacy@pokett.app.
5. How long we keep data
| Data | How long |
|---|---|
| Account, profile and in-app data | While your account exists |
| When you delete your account | Your Clerk login is deleted, and your e-mail, name, @handle, avatar, bio, status, settings and profile-visibility choices are erased immediately. Watchlists, wishlist, alerts, notifications, private card notes, CSV imports, pack-simulator progress, saved layouts and messages you sent us from the app are deleted. Your portfolio lots and sale records are kept without anything that identifies you (their notes are erased) so aggregate market statistics stay correct. Card-data corrections you submitted stay in the catalogue, no longer linked to you. |
| CSV import files (the uploaded rows) | 30 days after the import, then deleted automatically. The import summary (file name, row counts, date) stays until you delete your account. |
| Database backups | Backups are stored on our server, on Cloudflare R2 (encrypted before upload) and on the owner’s computer and rotate out within about 5 weeks. Data you deleted may survive in a backup until it rotates out; backups are only used to restore the service. |
| Rate-limit counters (per IP address, or per IPv6 /64) | 60 seconds |
| “Suspicious traffic” flag on an IP address | 30 minutes |
| Automatic / honeypot IP block | 24 hours |
| Abuse-tracing tokens for suspected scrapers (IP address, user-agent, path, time) | 90 days |
| Server logs (API: method, path, status, timing; IP addresses only on block events) | At most 30 days |
| Product-analytics events (PostHog) | 12 months |
| Vercel, Cloudflare, Sentry and Clerk logs | Per each provider’s own retention policy |
| Messages to privacy@pokett.app | Up to 2 years after the last message |
6. Your rights
If the GDPR (EU / EEA), UK GDPR or a similar law applies to you, you can:
- access your data and get a copy in a portable, machine-readable format;
- correct it;
- delete it;
- restrict or object to processing based on legitimate interest;
- withdraw consent at any time (session replay, digest) — this does not affect processing before the withdrawal;
- complain to your data-protection authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
7. Cookies and browser storage
We use only what the site needs: Clerk cookies to keep you signed in, Cloudflare security cookies against abuse, and browser storage for your preferences, layouts, pack-simulator state and your answer to the replay banner. PostHog, Cloudflare Web Analytics and Vercel Speed Insights set no cookies, and we use no advertising cookies — so the banner only asks about Sentry session replay. Full list: Cookie Policy.
8. Public profile
Your profile is private by default. If you make a section public, your display name, @handle and avatar, plus the sections you chose, are visible to anyone who has the link pokett.app/u/<handle>. Profile pages ask search engines not to index them. You can make sections private again at any time.
9. Children
PokéTT is not intended for children. You must be at least 16 to create an account, and by signing up you confirm that you are. If you believe someone under 16 has given us personal data, write to privacy@pokett.app and we will delete it.
10. Security
Data travels encrypted (HTTPS). The database is not exposed to the internet; the API is reached only through Cloudflare’s secure tunnel. Access to the servers and the database is limited to the owner.
11. Changes to this policy
When we change this policy we update the date at the top. For significant changes we will show a notice on the site and tell account holders by e-mail or in-app notification before they take effect.
12. Contact
PokéTT (pokett.app) — privacy@pokett.app.