Privacy Policy — PokeGuess

Last updated: 23 May 2026 · Effective: 23 May 2026

1. Overview

PokeGuess ("the App") is an unofficial, fan-made mobile application. This policy explains what data the App processes, why, and the rights you have. We do not sell your personal data. The data controller for personal information processed in connection with the App can be contacted at pokeguess@hotmail.com.

2. Data We Process

2.1 Data stored only on your device

• Game progress: captured Pokémon, scores, trophies, eggs, settings, language preference. Stored locally in the device's SQLite database. Never leaves your device unless you sign in (see 2.2).
• App preferences: theme, sound, haptics, tutorial state. Stored locally in AsyncStorage.

2.2 Data we process when you sign in (optional)

• Account identifier: your email address and a unique user ID provided by Google Sign-In.
• Synced game progress: a copy of your game progress is uploaded so you can restore it on another device.

This data is stored on Supabase (EU region) under our project. Legal basis: contract performance (GDPR Art. 6(1)(b)) — providing the cloud-save feature you requested by signing in.

2.3 Data processed by advertising

• Advertising identifiers (AAID on Android, IDFA on iOS) and limited device/usage signals, used by Google AdMob to serve ads.
• Consent choice: in the EU/EEA/UK, we display a Google UMP consent dialog before loading ads. Your choice (personalized vs non-personalized ads) is stored locally and respected on every ad request. Legal basis: consent (GDPR Art. 6(1)(a)).
• Outside the EU/EEA/UK, ads may be personalized by default in accordance with local law.

2.4 Data processed for in-app purchases

• Purchase receipts and entitlement state: processed by RevenueCat (our subscription/IAP provider) and by Google Play / Apple App Store to validate purchases and restore them. Legal basis: contract performance.

2.5 What we do not collect

• No precise location.
• No contacts, photos, microphone, camera or files.
• No analytics SDK tracking user behaviour beyond what AdMob requires to serve ads.

3. Third-Party Services

The App relies on the following processors. Please review their privacy policies:

• Google AdMob (advertising) — policies.google.com/privacy
• Google Sign-In (authentication) — policies.google.com/privacy
• Google User Messaging Platform (UMP) (EU/UK consent) — policies.google.com/privacy
• Supabase (cloud backup) — supabase.com/privacy
• RevenueCat (in-app purchase management) — revenuecat.com/privacy
• Google Play Billing / Apple App Store (payment processing) — see Google / Apple privacy policies.

4. Data Retention

• Local data: kept on your device until you uninstall the App or clear its storage.
• Cloud account data: kept while your account is active. Deleted within 30 days of an account-deletion request (see Section 6).
• Advertising identifiers: see Google's retention policy. You can reset your advertising ID in your device settings at any time.

5. International Transfers

Supabase hosting is in the EU. Google AdMob, Google Sign-In and RevenueCat may transfer data outside the EU/EEA under Standard Contractual Clauses or equivalent safeguards published by those processors.

6. Your Rights

6.1 EU/EEA/UK (GDPR / UK GDPR)

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. To exercise these rights, email pokeguess@hotmail.com. You also have the right to lodge a complaint with your local data protection authority.

6.2 California (CCPA / CPRA)

California residents have the right to know what personal information we process, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information. We do not sell personal information. To exercise these rights, email pokeguess@hotmail.com.

6.3 How to delete your account and data

To request deletion of your account and all associated cloud data:

• Email pokeguess@hotmail.com with the subject "Account Deletion Request" from the email address linked to your account.
• Your account and all associated synced data will be permanently deleted from our Supabase backend within 30 days.
• To also remove local data, uninstall the App or clear its storage in your device settings.

An account-deletion link is also published at armytille.github.io/account-deletion.html.

7. Children

The App is not directed at children under 13 (or under the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it. In the US, we comply with COPPA: we do not knowingly collect personal information from children under 13 without verifiable parental consent.

8. Security

Data sent to Supabase is transmitted over HTTPS and protected at rest by the provider's encryption. We use Row Level Security so that each user can only access their own rows. No system is 100% secure; please use a strong, unique password for your Google account.

9. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be highlighted in the App.

10. Contact

Questions about this policy or about your data: pokeguess@hotmail.com.