This Privacy Policy explains how the operator of Shiny Pokes (the “Service”) collects, uses, shares, and protects your information. The Service is the website at shinypokes.com (including when installed to your device as a web app), the ShinyPokes iOS app on the Apple App Store, and the ShinyPokes Android app on Google Play. They share one account and one set of data: a hunt you start in an app is the same hunt on the website. Shiny Pokes is a personal-project tool that helps Pokémon players track shiny hunts. By creating an account or using the Service, you agree to this Policy.
The Service is operated by an individual based in the United States (“we,” “us,” or “the operator”), not a company. You can reach the person responsible for your data at privacy@shinypokes.com, for any privacy question or request. For users in the European Economic Area (EEA) and the United Kingdom, the operator is the “data controller” for your personal data.
We collect only what the Service needs to function. We do not ask for your phone number, mailing address, or payment card details.
a. Account information (from your sign-in provider)
You sign in with Discord, Google, a sign-in link sent to your email, or, in the iOS app, Sign in with Apple. We do not store passwords. With email sign-in we email you a one-time link and keep only a hashed, expiring token, sent from our own mail server (no third-party email service). From Discord and Google we receive your email address, your name, your profile picture, and a provider account identifier used to keep you signed in. We store the email address, the identifier, and the name (which is never shown to other users). For new accounts we do not keep the profile picture. From Apple we receive a provider account identifier, the email address you choose to share (which may be a private relay address if you use Apple's Hide My Email), and your name only if you choose to share it the first time you sign in; Apple sends no profile image. With email sign-in we store only your email address. Your email address is never shown publicly anywhere on the Service. Other users can see your username and display name, your profile picture (one you uploaded or, for older accounts that use one, your Google or Discord picture), your hunter level if it is shown, and the catches and hunts you choose to share.
New accounts do not use your Google or Discord name or picture. They are given an assigned username and display name (such as “shinyhunter1027”) and a simple default icon, which you can change on your Profile. Accounts created before this change kept the picture they already had. If you signed in with Google or Discord and your account uses that picture, your Google or Discord profile picture is shown publicly wherever your picture appears.
b. Profile information (provided by you)
Your username and display name (assigned to new accounts, and changeable at any time); an optional bio, favorite game, and banner Pokémon; and an optional custom avatar you upload.
c. Activity data you create
Your hunts (Pokémon, game, method, encounter and chain counts, timer duration, status, and whether the hunt was part of an event such as Safari Week), your catches (including nickname, nature, public/private status, evolution history if you evolve a catch, and an optional photo and short description you add), your settings, community chat messages and the @-mentions you send or receive, Pokémon you add to event planning lists (e.g. a Safari Week wishlist), support messages and any image attachments you send, bug reports (including any screenshots) and feature ideas you submit. We also keep a per-day tally of your hunting activity (how many encounters you log each day) so we can show your hunting streak and weekly activity.
When you use the encounter counter we record the times of day it moved, so the Count history on your stats page can show you when you counted and point out a press that looks like a double tap or an unusually long gap. These times are yours alone, are never shown to anyone else, and are kept for 30 days before being deleted automatically. Your per-day totals are unaffected and are kept for as long as the hunt is.
We also store your time zone (for example “America/Chicago”), which your browser reports automatically the first time you use the Service and whenever it changes. We use it only so that dates the server works out on your behalf, such as which day or month a hunt counts toward and the date shown on your public catch pages, match your own calendar rather than the server's. You can choose a different time zone, or stop it following your device, in Settings. It is never shown to other users.
If you choose to answer the occasional feedback panel, we store your answer: which option you picked for how you found the Service (and the short line of text you type if you pick “somewhere else”), and any star rating and optional comment you leave. Answering is entirely optional and the panel can be dismissed. We store how you found the Service against your account only so that we never ask you again, and we record when the panel was last shown to you so it does not keep reappearing. Admins see these answers as counts only: how many people picked each option, and the average rating. Never against your name. Any text you type is shown to admins without your name attached.
d. Technical and log data
Like virtually all websites, our web server automatically records standard request logs: your IP address, your browser or app's user agent, the time, and the page requested. We use them for security and debugging, and keep them only for a limited time (see Section 10). The iOS and Android apps talk to the same server as the website, so the same applies to them. The application itself does not store your IP address against your account. The apps contain no analytics, advertising, or crash-reporting code of their own.
e. Push notifications
Push notifications come from the iOS and Android apps only; the website does not send them. If you allow notifications in an app, we store the push token your phone provides (used only to deliver notifications, such as a reply from the team or when someone @-mentions you), along with the platform (iOS or Android), the app version and the OS version, so notifications work reliably. A notification is delivered through Apple's push service on iOS or Google's Firebase Cloud Messaging on Android, so its title and text (for example, the first part of a reply to you) pass through that service on the way to your phone. You can turn notifications off in your phone's settings at any time. On the website, replies and mentions show in the notification bell instead.
f. Photos and images you upload
You can upload an avatar, a photo on a catch, and screenshots to support or with a bug report. In the apps you choose these with your phone's photo picker, which gives the app only the photo you pick; the apps do not ask for access to your whole photo library, your camera, your location, or your contacts. Before we store any image, including GIFs, we re-encode it to remove its hidden metadata, such as the place a photo was taken and the phone that took it. A catch photo is only shown to other people if the catch is public and you have chosen to show its photo.
g. What the apps keep on your phone
To keep you signed in, the apps store a sign-in token on your phone (in the iOS Keychain, or in the Android app's private storage), which expires after 60 days. They also keep your display settings on the phone. Deleting an app removes this, but does not delete your account. The Android app can show a floating counter over other apps, only if you turn it on and grant Android's “display over other apps” permission; it shows your count and does not read anything from the apps underneath.
To create and maintain your account; provide core features (tracking hunts, recording catches, showing stats and badges); power community features according to your sharing settings; respond to support requests; maintain security and prevent abuse; and improve the Service.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We run no ad networks and no third-party analytics or tracking. We share information only:
a. Public and community features
Information you choose to make public (public catches, your public hunter page, and leaderboard standings) is visible to anyone and may appear in social-media preview images. If you enable your hunter page, it shows your total shinies, encounters and hours, and (unless you switch that section off) the hunts you have in progress: the Pokémon, game and method, a live encounter count that updates while you hunt, how long you have been hunting it, your average time per encounter, when the hunt started, and when you were last active. Your profile picture is shown with your name on these pages. In addition, some community features are visible to other signed-in users: messages and @-mentions you post in community chat (which show your display name or username), catches you share into chat, and, if you choose to share them, your active hunts on the Live Hunts feed (which shows your handle unless you enable the “Anonymous Hunter” option). Aggregate, non-identifying event stats (for example, the most-planned Pokémon during Safari Week) may also be shown. See Section 6 for your controls.
b. Service providers
Sign-in providers (Discord, Google, and Apple in the iOS app) authenticate you. Apple's push service and Google's Firebase Cloud Messaging deliver app notifications, as described in Section 2e. The App Store and Google Play distribute the apps; they handle downloads and updates under their own terms, and may give us anonymous, aggregate figures such as install and crash counts, according to the choices you make in your phone's settings. We send no data of any kind to an AI provider. Our server fetches public Pokémon information from PokéAPI and Bulbapedia, and sends nothing about you with those requests. Some images and sounds (Pokémon sprites, cries and profile pictures) are loaded directly from GitHub, Google and Discord, which see your IP address when they load.
Our hosting provider, Hostinger, provides the virtual private server (VPS) in the United States where the Service runs and where all account and activity data is stored.
The home page shows how many people are in our Discord. Our server asks Discord for that public count, not your browser, so nothing about you reaches Discord unless you click through to join. There is no Discord content embedded in the page.
c. Legal reasons
We may disclose information if required by law, to protect our rights or user safety, or in response to a valid legal request.
The website stores the following on your device:
The apps sign in with a token instead of a cookie (see Section 2g). We do not use analytics or advertising cookies, tracking pixels, or third-party trackers, on the website or in the apps. Because we use none, there is no cookie consent banner.
Do Not Track: because we do not track you across other websites, our behavior is the same whether or not your browser sends a DNT signal.
New accounts start private: their catches are private, they do not appear in the global feed, and their active hunts are not shared on Live Hunts. Accounts that existed before this change keep the settings they had already chosen. You can change any of this in Settings, Sharing. You can change your name and picture on your Profile.
/h/{username} if you opt in.Depending on where you live, you may have the right to access, correct, delete, object to or restrict processing, and obtain a portable copy of your personal data, and to withdraw consent.
To exercise any other right, email privacy@shinypokes.com. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.
If you are in the EEA or the United Kingdom, you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to sort out your concern first, but you do not have to contact us before you complain.
If you are a California resident:
Where the GDPR or UK GDPR applies, we process your data to perform our contract with you (providing the account and features), with your consent (optional features such as making your profile public or turning on app notifications, and you can withdraw consent anytime), and for our legitimate interests (keeping the Service secure, preventing abuse, and improving it).
We keep your account data for as long as your account exists. When you delete your account, your associated data is removed right away, and it drops out of our nightly database backups within 14 days, when those backups are discarded. The full steps are on the Delete your account page. Server request logs (IP address, browser user agent, time, and page requested) are kept for a limited time for security and troubleshooting, then rotated out. Each part of the Service keeps at most about 50 MB of logs (five files of 10 MB), and the oldest entries are overwritten as new ones arrive. Logs are not linked to any analytics. We may retain limited information where required by law.
Your data is stored and processed in the United States, on a server rented from Hostinger. If you access the Service from outside the United States, including from the EEA or United Kingdom, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.
We protect your information with: no password storage (you sign in through Discord, Google, Apple, or a one-time email link); encryption in transit (HTTPS/TLS) for the website and the apps; sign-in tokens kept in your phone's protected storage in the apps; validation of uploaded images by type, size, and file signature, with their metadata removed; access controls restricting support attachments and private catches to authorized viewers; and access-controlled server credentials. No method of transmission or storage is 100% secure. If we become aware of a breach affecting your personal data, we will notify affected users and any required authorities as the law requires.
The Service is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. When you create an account, we ask for your birth year. If you are under 13, the account is not created and nothing is stored. We do not keep the birth year itself, only the fact that the check was passed. Accounts created before this check was added were not asked. If you believe a child under 13 has provided us with personal information, contact privacy@shinypokes.com and we will delete it. Users between 13 and the age of digital consent in their country should use the Service only with parental involvement where local law requires it.
The Service integrates with third-party services (Discord, Google, Apple, the App Store, Google Play, Firebase Cloud Messaging, PokéAPI, Bulbapedia, GitHub, Hostinger). Their handling of your data is governed by their own privacy policies, which we encourage you to review.
We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide a more prominent notice. Continued use of the Service after changes take effect means you accept the revised Policy.
Questions, requests, or concerns about your privacy: privacy@shinypokes.com.