Privacy policy

The short version

• The website’s pages (everything except the game at /game) count page visits with PostHog: which page, which site or link brought you there, and a random id for your browser. They record no session recordings and never your name or email address.
• To play, you sign in with Google. We keep your Google account’s name, email address and profile picture address, your saves and your multiplayer results.
• The game records analytics events and full recordings of play sessions with PostHog, and once you are signed in they are tagged with your email address.
• There are no adverts, nothing to buy, and we do not sell or rent anyone’s data.
• You can ask us to delete everything we hold about you.

Signing in with Google

Story Mode and Battle Mode both need a Google account. Sign-in is run by Neon Auth, the sign-in service of our database provider, Neon; Google’s consent screen may show Neon’s name. We never see your Google password.

From Google we receive and keep your account’s name, email address, whether Google has verified that email, and the web address of your profile picture. The sign-in service also keeps the sign-in tokens Google issues and, for each signed-in session, when it started and expires and the IP address and browser it came from.

A cookie set by the sign-in service on its own address keeps you signed in. Signing out (your profile picture in the corner of the game’s title screen, then Sign out) ends that session.

Your saves

Story Mode keeps nothing in your browser: each account has an Autosave and three save slots in our database. A save holds your journey: the names you gave your trainer and rival, your trainer’s look, your Pokémon and their moves, your Bag and money, badges and story progress, the trainers you have beaten, where you are in the world, the in-game time and weather, and how long you have played. Each save also records when it was made.

Battle Mode never writes to those saves. Its last setup and your most recent Battle Mode battles are kept only in your browser.

Multiplayer battles

When you invite a friend, or open a friend’s invitation, the other player sees your Google account name (up to 24 characters) and your profile picture. They never see your email address.

For each multiplayer match we keep both players’ account ids and names, the result and how it ended, the stage, the team size, the Pokémon each side drafted and how many each knocked out, and when it started and ended. This is your record and match history, and your opponent sees the same match in theirs. The live state of a battle room is deleted 30 days after the room ends; match results are kept.

Analytics and session recordings

We use PostHog, a product analytics service, to understand how people find the game and how they play: how many people visit and play and come back, how far they get, what they catch and win, and what went wrong.

On the website’s pages (everything except the game at /game), each page you open sends PostHog one page view: the page’s address, the site that sent you there (only its domain, such as google.com), any campaign tags in the link you followed (utm_source and the like), your browser, operating system, screen size and an approximate location PostHog works out from your IP address, and the same random browser id the game uses. The script loads after the page has finished loading. The website records nothing else: no session recordings, no clicks or scrolling, and never your name or email address, even if you have signed in to the game in that browser.

So that we can tell which pages lead people to play, the browser tab remembers where your visit started (the first page, the referring domain and the campaign tags) and the game sends that with its events.

The game sends PostHog:

• Events about what you do in the game, such as choosing a mode, starting and finishing a battle, catching a Pokémon, earning a badge or saving, with measures of your progress (story step, region, badges, Pokémon owned and caught).
• Technical details sent with each event: browser, operating system, device type and screen size, the page address and the site that sent you, the game’s version, and an approximate location PostHog works out from your IP address.
• A recording of each play session: what the page shows, including the 3D game view, menus, dialogue and the names you type into the game, with mouse movements and clicks, the game’s console messages and the timing of its network requests (not their contents). Recording pauses while you are away from the keyboard.

Once you sign in, PostHog links that browser to your account: your Google email and name are stored on your PostHog profile and every event sent while you are signed in carries your email, so we can look at one player’s sessions and progress. What you did on the title screen before signing in is joined to your account when you sign in. Your email is hidden in recordings, sign-in tokens are removed before anything is sent, and Google’s own sign-in page is never recorded.

The game sends its events through its own address, which passes them on to PostHog’s servers in the United States, and its session recordings straight to those servers. There is no setting in the game to turn analytics or recording off at the moment.

Cookies and browser storage

The website and the game at /game use:

• The sign-in service’s session cookie, which keeps you signed in (the game only).
• PostHog’s cookie and local storage, shared by the website and the game: a random id for your browser, your email once you sign in to the game, your latest progress measures and the current analytics and recording session.
• Session storage, while the tab is open: where your visit started (the first page, the referring domain and any campaign tags), for the analytics described above.
• The game’s own local storage: your settings, Battle Mode’s last setup and recent battles, and a note of graphics problems so the game can pick safer graphics next time.
• The game’s short-lived session storage that lasts only while the tab is open: which mode to open after a sign-in that leaves the page, a friend’s invitation while you sign in, and which Story save the tab is playing so a refresh goes straight back to it.

None of these are used for advertising.

Who else handles your data

• Vercel hosts the website and the game on its worldwide network and runs the game’s servers in Singapore. Like any web host it logs requests (IP address, browser and the address requested) to run and protect the service.
• Neon stores the database (saves, multiplayer results and sign-in accounts) on Amazon Web Services in Singapore, and runs the sign-in service.
• PostHog stores the analytics events (the website’s page views and the game’s events) and the game’s session recordings in the United States.
• Google runs the sign-in, and your profile picture is loaded from Google when the game shows it.

We share data with no one else, except where the law requires it.

How long we keep it

• Your sign-in account, saves and multiplayer match results: until you ask us to delete them.
• A multiplayer battle room’s live state: 30 days after the room ends.
• Session recordings: 30 days.
• Analytics events: for as long as PostHog’s plan for the project keeps them, unless you ask us to delete them sooner.

Deleting your data and other requests

To have your data deleted, to get a copy of it or to ask anything about this policy, email support@pokemonfight.com from the address of your Google account, so we can tell the account is yours. We then delete your sign-in account, your saves, your multiplayer records and your PostHog profile with its events and recordings. There is no delete button in the game yet.

You can also remove the game’s access to your Google account at any time in your Google Account’s settings (Security, then Your connections to third-party apps and services). That stops new sign-ins but does not delete what we already hold, so contact us as well.

Children

Pokémon Fight needs a Google account and is not directed at children under 13. Google lets younger children have an account only when a parent manages it through Family Link. If you are a parent and think your child has played without your permission, contact us and we will delete their data.

A fan project

Pokémon Fight is an unofficial, non-commercial fan project. It is not affiliated with, endorsed or sponsored by Nintendo, Creatures, GAME FREAK or The Pokémon Company. Pokémon and all related names are trademarks of their respective owners. It is non-commercial: there is nothing to buy and no advertising, and the data above is used only to run the game and understand how it is played.

Changes to this policy

When the game starts collecting something new, or stops, this page changes with it, and the date at the top says when it last did.