This policy explains what personal data 8192 ("we", "us") processes
through 8192.app, why, on what legal basis, who else is involved, how
long it's kept, and what rights you have under the EU General Data
Protection Regulation (GDPR). 8192 is a fan-made Pokémon Gen 4
shiny-hunting reference site, shop, and community site.
Who is responsible
The controller responsible for your data is the operator of 8192 —
full name and postal address are in the Impressum.
For any privacy question or request, email
8192.support@gmail.com.
We haven't appointed a data protection officer (we're not required to).
Just visiting the site
Even without an account, a few things necessarily happen whenever you
load a page:
-
Server logs. Our host, Netlify,
processes your IP address, the requested URL, time, browser/user
agent and referrer to deliver the page, and keeps them in short-lived
request and function logs for security and troubleshooting. Legal
basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering a
secure, working site.
-
Community feed. The home page's "Live from the
community" section is loaded straight from our database provider,
Supabase, so your browser connects to Supabase's
servers (your IP address is visible to them). Only catches from
public profiles are returned. Legal basis: Art. 6(1)(f) GDPR.
-
YouTube thumbnails. The home page shows video
thumbnails loaded directly from YouTube's image servers
(i.ytimg.com), which shares your IP address and browser details
with Google. We fetch the video list server-side via the YouTube
Data API, so no YouTube player or script is embedded. Clicking a
video takes you to youtube.com, governed by
Google's privacy policy.
Legal basis: Art. 6(1)(f) GDPR — our interest in showing current
community videos.
-
Embedded YouTube video (click to load). The
Infinite Strat guide shows a video placeholder. Nothing is loaded
from YouTube until you click it; only then does your browser load
YouTube's player from youtube-nocookie.com, which shares your IP
address and browser details with Google and may store data on your
device. Legal basis: your consent by clicking (Art. 6(1)(a) GDPR,
§ 25(1) TDDDG); simply don't click if you don't want this.
We don't run advertising, analytics, or tracking of any kind, and we
don't sell your data to anyone.
Accounts
Creating an account is optional. If you do, we process:
-
Login data: your email address and a securely hashed
password, or — only if you choose to sign in that way — the basic
profile (account ID, email, name, avatar) that Google
or Discord shares with us. Google and Discord only
learn that you signed in to 8192 when you pick their button.
-
Profile: display name, avatar image, and bio.
-
Collection data you enter: shiny catches (nickname,
form, date, game, location, encounter count, level, gender, ability,
nature, ball, IVs/EVs/stats, notes, favorite), photos and videos you
upload, hunt projects/targets/sections, and failed hunts.
Legal basis: Art. 6(1)(b) GDPR — providing the account service you
signed up for. Providing this data is voluntary, but without an email
(or a Google/Discord login) we can't create an account; everything
else is up to you.
Public profiles and the community feed
Profiles are private by default. If you switch your
profile to public (at sign-up or later in Settings), your display name,
avatar, bio, catches including their notes, hunt projects, and failed
hunts become visible to anyone on the
internet, and your public catches may appear in the home page's
"Live from the community" section. Legal basis: Art. 6(1)(a) GDPR —
your consent, which you can withdraw at any time by switching your
profile back to private in Settings; content then stops being shown
from that moment on (withdrawal doesn't affect what was shown before).
Avatars: to be displayable, avatar images are stored
in a public storage bucket. Anyone who has an avatar's direct URL can
load it, even while your profile is private. Photos and videos you
attach to catches are stored in a private bucket and are only ever
accessible to you — they're not shown on a public profile.
Shop purchases
Checkout — including pay-what-you-want orders of 0€ — is handled by
Stripe (cards, Apple Pay, Google Pay). We never see or
store your card details. Stripe collects your name, email, payment
details and, for physical items, your shipping address, and shares
with us what we need to fulfil the order. We store an order record
(email, items, amount, currency, Stripe session ID, and your account
ID if you were signed in) and email digital files to the address you
gave via Google's Gmail. When buying digital files we also record that
you agreed to immediate delivery and the resulting loss of your right
of withdrawal (see the Terms). Legal basis:
Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and
bookkeeping obligations). Stripe additionally processes data as an
independent controller for fraud prevention and its own legal
obligations — see
Stripe's privacy policy.
Feedback form
If you send feedback, we receive your message and, optionally, an
email address for a reply. It's emailed to the operator's Gmail inbox
and used only to read and answer it. Legal basis: Art. 6(1)(f) GDPR —
our interest in hearing and replying to you.
Security and abuse prevention
To stop spam and abuse, the feedback form and file-delivery endpoints
count requests per day using a one-way hash of your IP address (and,
where relevant, email address) stored in Netlify Blobs.
The hash can't be turned back into the address. Legal basis:
Art. 6(1)(f) GDPR — keeping the site and our inbox secure.
Who we share data with
Only these providers, each for the purpose described above. Where
they act on our behalf, we have data processing agreements with them
(Art. 28 GDPR).
-
Supabase (Supabase Inc.) — accounts, database, file
storage. Data is hosted in the EU (AWS region EU West, Ireland).
-
Netlify (Netlify Inc., USA) — website hosting,
serverless functions, logs, rate-limit storage.
-
Stripe (Stripe Payments Europe Ltd., Ireland, and its
affiliates) — payments.
-
Google (Google Ireland Ltd. / Google LLC) — Gmail for
sending order and file-delivery emails and receiving feedback;
YouTube Data API and thumbnail images; Google sign-in, only if you
choose it.
-
Discord (Discord Inc., USA) — sign-in only, and only
if you choose it.
Transfers outside the EU
Some of these providers are based in, or may access data from, the
USA. Where a provider is certified under the
EU-US Data Privacy Framework, transfers rely on the
European Commission's adequacy decision (Art. 45 GDPR); otherwise they
rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
How long we keep it
-
Account data (profile, catches, projects, uploaded
files): until you delete your account. Deleting it in Settings
permanently removes all of it, including your uploaded files.
-
Backups: encrypted nightly database backups are
kept for at most 14 days, so deleted data disappears from them
within 14 days.
-
Orders: 10 years, as required by German tax law
(§ 147 AO, § 257 HGB). If you delete your account, your orders are
kept but no longer linked to it.
-
Server and function logs: only for the short period
Netlify retains them (typically days, not weeks).
-
Rate-limit counters: one day.
-
Feedback emails: until the conversation is finished
and we clear them from the inbox.
Storage on your device
We don't use cookies for tracking. The site stores a few things in
your browser's localStorage/sessionStorage, each only to provide a
function you're using — so no consent banner is needed (§ 25(2)
TDDDG). Nothing here is used to track you:
- sb-…-auth-token — your login session (Supabase), only when signed in.
- nav-avatar, nav-signed-in — show your avatar in the navbar instantly instead of flashing "Log in".
- signup-public-choice — remembers your public/private choice for up to 30 minutes while you finish a Google/Discord sign-up.
- 8192-cart — your shopping cart.
- pkdex-sort, pkdex-scale, pkdex-color-icons — your Pokédex display preferences.
- debugTimeOfDay — a theme override used only during local development.
- 8192-free-result (sessionStorage, cleared when you close the tab) — shows the confirmation page after a free download request.
You can clear these at any time through your browser settings.
Your rights
Under the GDPR you have the right to:
- Access the data we hold about you (Art. 15).
- Rectification of incorrect data (Art. 16) — most of it you can edit yourself.
- Erasure (Art. 17) — delete your account in Settings at any time.
- Restriction of processing (Art. 18).
- Data portability — receive your data in a machine-readable format (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time with effect for the future (Art. 7(3)) — e.g. by making your profile private.
-
Complain to a data protection supervisory authority
(Art. 77), e.g. the one where you live or the one responsible for
us: the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–61, 10555 Berlin).
To exercise any of these, email
8192.support@gmail.com.
Minimum age
You must be at least 16 to create an account, or have permission from
a parent or guardian.
No automated decisions
We don't make automated decisions or create profiles about you within
the meaning of Art. 22 GDPR.
Changes
If this policy changes, we'll update it here and change the date at
the top of this page.