Privacy policy
Last updated: August 5, 2026
This Pokédex is a non-profit fan project, but it processes personal data the moment you create an account, so the GDPR applies to it like to any other service. This is everything it does with that data, with no small print.
Data controller
A2R Crew S.L is the controller of the data described here. For anything about this policy, or to exercise your rights, write to isabel@a2r.com.
Without an account there is almost nothing
You can read the whole Pokédex without signing up: browse entries, filter, compare and move between all nine language versions. Until you sign in, the only things stored are your own browser's technical preferences — language, theme, volume — and the logs any web server leaves behind. An account is needed to save your game and to use the AI features.
What data is processed
- Account
- Your email address and the details of the sign-in method you choose, including a third-party account if you use one. Clerk manages them; we never see or store passwords at any point.
- Your game
- Favourites, team, card collection, tournament history and progress, saved battles, the comparator duel and your settings (theme, language, volumes, screen mode). All of it tied to your account identifier.
- Conversation with Professor Oak
- The text of your messages and any images you attach. The most recent messages are kept so the chat has memory; older ones, and their images, are deleted automatically.
- Model usage
- Each AI call records the route, the model, the token count, the cost, the latency and whether it failed. The content of the request is not stored, only its measurements.
- Technical data
- The IP address, browser and timestamp of each request — what any web server logs in order to run and to defend itself against abuse.
What for, on what basis and for how long
Each processing activity has a specific purpose and a legal basis from Article 6 GDPR. Where the basis is your consent, you can withdraw it at any time and processing stops.
| Purpose | Legal basis | Retention |
|---|---|---|
| Create your account, identify you and keep your session open. | Performance of the service you requested (Art. 6(1)(b)) | While you have the account, and until you ask for deletion |
| Save your game and carry it from one device to another. | Performance of the service you requested (Art. 6(1)(b)) | While you have the account, and until you ask for deletion |
| Answer what you ask the AI: Professor Oak, the coach, the comparator, the battle engine and the tournament. | Performance of the service you requested (Art. 6(1)(b)) | The most recent messages; the rest is deleted automatically |
| Keep track of what each model call costs and detect abusive usage. | Legitimate interest (Art. 6(1)(f)) | While you have the account; on deletion it is anonymised (see below) |
| Serve the site, keep it running and protect it against attacks and fraud. | Legitimate interest (Art. 6(1)(f)) | The hosting provider's own window, on the order of weeks |
| Measure how many visits each page gets and which sections are used, in aggregate. | Your consent (Art. 6(1)(a)) | Until you withdraw consent |
| Load the embedded YouTube soundtrack. | Your consent (Art. 6(1)(a)) | Until you withdraw consent |
Who else sees this data
The following providers process data on our behalf and under our instructions, as processors. We do not sell data to anyone, nor share it with third parties for their own purposes.
| Provider | Purpose | Located in |
|---|---|---|
| Clerk, Inc. | Accounts and sessions | United States |
| Convex, Inc. | Database and file storage | United States |
| OpenAI, L.L.C. | AI generation | United States |
| Vercel, Inc. | Hosting and audience measurement | United States |
| Google Ireland Ltd. | Soundtrack playerOnly with your consent | European Union |
The Pokédex's data sources — PokéAPI and TCGdex — are queried from our server, images included. Your browser never talks to them, so they do not even receive your IP address.
What you tell the AI
When you use Professor Oak's chat or any assisted feature, the text you write and the images you attach are sent to OpenAI to generate the answer. Some queries additionally trigger a web search, in which case those search terms go out to the search engine. Under its API terms, OpenAI does not use this content to train its models.
Even so, do not write or upload anything you would not want leaving your device: health data, identity documents, passwords or photographs of other people. It is a chat about Pokémon and it needs none of that.
Automated decisions
No automated decisions with legal effects are made about you, and no profile of you is built. The AI generates team suggestions, battle commentary and chat replies; it does not assess you, classify you, or decide anything that affects you.
Minors
You must be at least 14 to hold an account — the age Spanish law sets for consenting to the processing of your own data. Below that age, authorisation from a parent or guardian is required. If we find an account belonging to a minor without it, we delete it.
International transfers
Clerk, Convex, OpenAI and Vercel are established in the United States, so processing your data with them constitutes an international transfer. All are certified under the EU–U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection, and additionally apply the standard contractual clauses.
Security
All traffic is encrypted. Access to your data is checked on the server against your session's signed token rather than whatever the browser claims, so no query can ask for another account's game. Provider keys live in server environment variables and never reach the browser.
Your rights
The GDPR grants you these rights over your data, and you can exercise all of them by writing to us:
- Access: know what data we hold about you and obtain a copy.
- Rectification: correct anything wrong or incomplete.
- Erasure: ask for it to be deleted.
- Objection: object to processing based on legitimate interest.
- Restriction: ask that data be kept but no longer used while a complaint is resolved.
- Portability: receive your data in a machine-readable format.
- Withdraw consent: at any time and as easily as you gave it, without affecting what was processed until then.
Write to isabel@a2r.com stating which right you wish to exercise. We will reply within the one-month deadline the regulation sets. If you believe your request was not honoured, you can lodge a complaint with the supervisory authority: Agencia Española de Protección de Datos (AEPD).
Account deletion
If you ask for your account to be deleted, every table holding your game is erased — favourites, team, collection, tournaments, battles, duel, settings and the entire conversation with its images — along with your account at the identity provider. Write to isabel@a2r.com to request it.
One nuance worth reading before you ask: the model-usage record is not deleted, it is ANONYMISED. The route, model, tokens, cost and month are kept — the spending already happened and the accounting has to keep adding up and stay fully auditable — but the row stops pointing at your account and moves to an anonymous user, with no way to link it back to you. It never held the content of what you wrote.
Cookies
What is stored in your browser — cookies, local and session storage — is detailed in a separate document, with the complete list and the specifics of each one:
Cookie policyChanges to this policy
If the processing, the providers or the retention periods change, this page and its revision date are updated. If the change affects something you consented to, you are asked again before it is applied.