Privacy policy
Last updated 18 October 2026
PokéLobby is a free fan project. This policy explains which personal data we process, why, on what legal basis, for how long, who else is involved, and what your rights are under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is the private individual who runs PokéLobby. Contact for anything about privacy: support@pokelobby.com. We have no data protection officer, because the law doesn't require one for a project of this size.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Random user ID, nickname, lobbies you host or join (raid, game version, notes, link code), when you were last active in a lobby | Running lobbies: showing them to other players, matching players, removing inactive ones | Contract (art. 6(1)(b)): providing the service you ask for |
| Accounts: email address, hashed password, in-game names, raid history and stats | Logging in on any device, showing your profile, history and stats | Contract (art. 6(1)(b)) |
| Discord login: Discord user ID, username, display name, avatar link and the email Discord shares | Logging in with Discord, suggesting a nickname, showing your Discord name in lobbies | Contract (art. 6(1)(b)), only if you choose Discord |
| Emails you send us | Answering support requests and reports | Legitimate interest (art. 6(1)(f)) in answering you |
| IP address, browser and device details, time of requests | Security, preventing spam and abuse (including the human check below), fixing errors | Legitimate interest (art. 6(1)(f)) in a safe, working service |
You don't have to give us any data beyond a nickname: you can play as a guest without an email. Without a nickname the lobbies can't work. We don't sell your data and we make no automated decisions about you. Advertising is explained in section 7.
3. What other players see
Your nickname, your in-game name for that game, and your Discord name (if linked) are visible to people browsing lobbies or inside your lobby. The link code of a lobby is only shown to its members. Your email address, raid history and stats are visible only to you.
4. How long we keep it
- Lobbies: deleted 24 hours after they close or expire.
- Guest profiles: deleted automatically after 30 days without a visit.
- Accounts, in-game names and raid history: until you delete your account.
- Server and security logs: up to 14 days.
- Support emails: until the matter is resolved, at most 12 months.
5. Who else processes data
We use these service providers. Those acting on our behalf are bound by data processing agreements.
- netcup GmbH (Germany): the server that runs the website and our email.
- Supabase, Inc. (USA): database and login system. Your data is stored in the EU (Frankfurt, Germany). Supabase may access it from outside the EU for support and operations, protected by the EU Standard Contractual Clauses.
- Cloudflare, Inc. (USA): Turnstile, the invisible check that a visitor is human, which replaces puzzle CAPTCHAs. It sees your IP address and basic browser signals and does not set tracking cookies. Cloudflare is certified under the EU-U.S. Data Privacy Framework.
- Discord Inc. (USA): only if you log in with Discord. Discord is responsible for what happens on its own site; see Discord's privacy policy.
- Google Ireland Limited: advertising, only once ads are switched on and as described in section 7.
6. Cookies and browser storage
Always used (strictly necessary, no consent needed):
- A login cookie from Supabase that keeps you signed in (as a guest or with your account).
- Your settings in your browser's local storage: join alerts on or off, and the last game version you hosted with.
- Once advertising is switched on (section 7): a cookie that remembers your consent choices.
Only with your consent: advertising cookies and similar technologies, as described in section 7. We don't use analytics cookies. Non-essential cookies are never set before you agree, and you can say no as easily as yes.
7. Advertising
Current status: PokéLobby shows no ads yet. We plan to show ads from Google AdSense to cover running costs. Nothing in this section happens until ads are switched on; on that day we will update the date at the top of this page and show the consent banner described below.
How it will work
- Who: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its advertising partners. Google acts as an independent controller for the data it collects through its ads.
- Consent first: visitors in the EU, EEA, UK and Switzerland see a consent banner from a Google-certified consent platform (IAB Transparency & Consent Framework). You can accept, refuse, or choose per purpose and per partner. Refusing is as easy as accepting, and the site works the same either way.
- With consent: Google and its partners may use cookies and device identifiers to show ads based on your interests, measure ads and limit how often you see the same ad. Legal basis: your consent (art. 6(1)(a) GDPR and the ePrivacy rules on cookies).
- Without consent: you may still see non-personalised or limited ads, chosen by the page content and your approximate location. Google then processes your IP address and browser details only to deliver the ad and to prevent fraud.
- What Google processes: IP address, cookie and device identifiers, browser and device type, the pages you view here, and how you interact with ads. We never give Google your email, nickname or raid history.
- Outside the EU: Google may process data in the USA. Google is certified under the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses.
- Changing your mind: a "Privacy and cookie settings" link in the footer will reopen the banner so you can withdraw consent at any time. Withdrawing doesn't affect processing that happened before.
- More control: Google's ad settings at adssettings.google.com and how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.
- Children: players we know are under 16 (for example from account details) will only get non-personalised ads.
8. Your rights
Under the GDPR you have the right to:
- get a copy of your data (access and portability);
- correct it;
- have it deleted;
- restrict its processing;
- object to processing based on our legitimate interest;
- withdraw consent you gave (for example for ad cookies) at any time;
- lodge a complaint with a data protection supervisory authority, especially in the EU country where you live.
You can do most of this yourself on your profile: change your nickname and in-game names, use Download my data to get everything we store about you as a file, or Delete your account or guest profile permanently. For anything else, email support@pokelobby.com. We answer within one month.
9. Security
All connections are encrypted (HTTPS). Passwords are stored only as hashes. Database rules make sure each player can only read their own private data.
10. Children
You need to be at least 16 to create an account, or have permission from a parent or guardian if you are younger. Guests don't give us any contact details. If you believe a child has given us data without permission, email us and we will delete it.
11. Changes
If we change this policy, we update the date at the top. If a change affects how we use data you already gave us, we will tell you on the site first.