privacy policy
Your privacy matters. Learn how we protect your data.
Last updated:
Overview
Random Pokémon Picker ("we", "our", or "us") operates the website randompokemonpicker.com (the "Service"). This policy explains what data the Service collects, why, and which third-party providers handle that data on our behalf.
We've tried to keep this short and honest. If anything is unclear, please reach out via the Contact page.
What We Collect
Browsing & usage data
When you visit the site, our hosting and analytics providers receive standard technical information: your IP address, browser and device type, the pages you visit, referring site, and timestamps. This is used for analytics, security (rate limiting and bot protection), and basic operations.
Pokémon votes
When you tap “Smash” or “Pass” in the Smash or Pass game, the choice is sent to our server along with the Pokémon ID. We store the aggregate count per Pokémon (e.g. “Pikachu: 412 smash / 38 pass”) so we can show leaderboards. We do not store who voted — individual votes are not tied to any account or identifier.
Contact form
If you fill in the form on the Contact page, we receive the name, email address, subject, and message you submit. We use it solely to read and reply. We do not add you to a mailing list and we do not share it.
On-device storage
Several features (Favorites picker, Smash or Pass history, Pokémon Wordle stats, picker settings) save their state to your browser's localStorage. This data never leaves your device — it's only used to remember your progress between visits. You can clear it any time through your browser's site-data controls.
Third-Party Services We Use
The Service is built on the providers below. Each one receives a specific slice of your data to perform its function:
Google Analytics
We use Google Analytics 4 to understand how the Service is used in aggregate — page views, popular tools, broad geographic distribution. Google receives your IP address (which it anonymizes by default), device type, and the pages you visit. You can opt out using the Google Analytics opt-out add-on or by enabling “Do Not Track” / blocking third-party cookies in your browser. See Google's privacy policy.
Cloudflare (Turnstile & CDN)
Cloudflare powers our content delivery and protects the contact form via Cloudflare Turnstile, a CAPTCHA alternative. When you submit the contact form, Turnstile receives device signals (browser fingerprint, behavioural metrics) to verify you're not a bot. See Cloudflare's privacy policy.
Supabase
Pokémon vote counts are stored in a Postgres database hosted by Supabase. Only aggregate per-Pokémon counts live there — no user identifiers, IPs, or session data. See Supabase's privacy policy.
Upstash Redis
To stop the same source from abusing our API endpoints, we use Upstash, a hosted Redis service, for rate limiting. Your IP address is stored briefly (typically a few minutes, up to one hour for the contact endpoint) and is automatically deleted when the rate-limit window expires. See Upstash's privacy policy.
Email delivery
Messages submitted through the contact form are delivered to the site owner via Purelymail. Your message contents are processed in transit by that provider; once delivered, the email lives in the owner's inbox until manually deleted. We do not forward your email address to any other party.
Cookies
We do not set any tracking cookies of our own. Cookies set on this site come from the third parties above — primarily Google Analytics (which sets functional and analytics cookies) and Cloudflare (which sets a security cookie to detect malicious traffic).
You can refuse or delete cookies from your browser settings. Doing so will not break the Service's core features because we keep all interactive state in localStorage on your device, not in cookies.
Data Retention
- Vote counts: kept indefinitely as aggregate numbers — not tied to anyone.
- Rate-limit records (your IP): deleted automatically within minutes to one hour of your request.
- Analytics data:kept according to Google Analytics' default retention (currently 14 months).
- Contact form messages: retained for as long as needed to respond and follow up; otherwise deletable on request.
- localStorage on your device: stays until you clear it.
Your Rights
Depending on where you live (e.g. GDPR for the EU/UK, CCPA for California), you may have the right to:
- Request a copy of any personal data we hold about you (in practice, this is usually limited to contact-form messages you've sent).
- Ask us to delete that data.
- Ask us to correct anything inaccurate, or to stop using your data for analytics.
- Lodge a complaint with your local data-protection authority if you believe we've mishandled your data.
To exercise any of these, email us via the Contact page with a brief description of your request.
Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has submitted information through the contact form, please let us know and we'll delete it.
Policy Updates
We'll revise this page if our data practices change — e.g. if we add or remove a third-party provider. The “Last updated” date at the top of the page reflects the most recent revision. For significant changes, we'll also try to flag the change visibly (e.g. via a notice on the homepage) for a reasonable period.
Contact
Questions, requests, or feedback about this Privacy Policy? Reach out through the Contact page.