Privacy policy

Joel Martínez Hernández (tax id 41747613Z), Menorca, Balearic Islands (Spain). For any data protection matter: system@pokemongomenorca.com.

No data protection officer has been appointed: the project does not meet any of the conditions requiring one (art. 37 GDPR).

We only process data if you create an account. You can browse the map, the gyms and the rest of the public sections without registering and without anything of yours being stored.

• Account data: email address and password (always stored encrypted, never in plain text).
• Profile data: name, trainer name, preferred language and, if you provide them, home municipality and phone number.
• Verification data: to verify your profile, a screenshot of your in-game profile is analysed to read your trainer name, team, level and avatar. The screenshot is NOT kept: it is processed and discarded, and only the crop of your avatar is stored as your profile picture.
• Game data you record yourself: gym medals, trainer medals, Pokédex, your Pokémon collection, objectives and their progress.
• Community data: friend code and its visibility, meetup attendance, gym correction proposals, trading preferences and listings.
• Technical data: last-active date and, temporarily and in memory only, your IP address to rate-limit requests and protect sign-up and log-in from abuse.
• Sign-up origin: if you arrived by scanning a printed QR code, your account stores the name of the poster you came in through. Nothing else: not where you came from, not which pages you looked at, not when.

This is the part worth reading closely, because part of the point of the app is helping the community find each other.

• Your trainer name, level and score appear on the public community leaderboard, visible without logging in.
• If you organise or join a meetup, your trainer name is visible to anyone who can see that meetup.
• Your friend code is only shown if you choose to make it public; it is private by default.
• You only appear in other trainers' trade matches if you switch trading on; while it is off, nobody is matched with you and you appear in no list.
• Your email address, your password and your real name are never shown to other users.

The app has no chat and no private messaging, so no user can contact you through the site.

You must be at least 14 to register, in accordance with article 7 of the Spanish Data Protection Act (LOPDGDD). Below that age, a parent or legal guardian must create and manage the account. Accounts found to belong to under-14s without that authorisation will be deleted.

We do not sell or share personal data. Only the providers needed to run the site are involved:

• Application and database hosting: OVHcloud (Francia).
• Cloudflare R2 (Cloudflare, Inc.): storage and delivery of the site's images, including your profile picture.
• Outgoing email provider: delivery of the service's essential emails.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision, such as the EU-US Data Privacy Framework.

• Your account data and progress, for as long as the account is active.
• If you delete your account, your personal data is deleted; content you contributed to the community (approved gym proposals, past meetups) may be kept in anonymised form, as it is part of the shared record.
• The verification screenshot is never retained.
• Rate-limiting data lives in memory for a few minutes and is not stored.
• Logs of emails sent are kept for as long as needed to evidence delivery and resolve incidents.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to system@pokemongomenorca.com. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

Many of these you can exercise yourself inside the app: edit your profile, change your friend code's visibility or switch trading off.

If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

• Passwords are stored encrypted and are never readable, not even by the site administrator.
• The session travels in a cookie that JavaScript cannot read and expires after 24 hours.
• After 5 failed log-in attempts the account is temporarily locked for 10 minutes.
• Sign-up, log-in and other sensitive actions are rate-limited.

If the processing changes, this page will be updated and, where the change is significant, you will be notified inside the app. The date of the last update appears at the top of the document.