[{"data":1,"prerenderedAt":544},["ShallowReactive",2],{"legal-document-en-US-privacy":3},{"id":4,"title":5,"body":6,"description":536,"extension":537,"meta":538,"navigation":539,"path":540,"seo":541,"stem":542,"__hash__":543},"legal\u002Flegal\u002Fen-US\u002Fprivacy.md","Privacy policy",{"type":7,"value":8,"toc":510},"minimark",[9,16,21,24,32,35,39,42,45,49,54,57,61,64,67,71,74,78,81,85,88,92,95,98,102,188,192,195,198,202,205,274,281,288,292,295,368,371,375,378,381,385,447,450,453,457,460,466,476,480,483,486,490,493,497,500,503,507],[10,11,12],"p",{},[13,14,15],"em",{},"Last updated: August 10, 2026",[17,18,20],"h2",{"id":19},"_1-data-controller","1. Data controller",[10,22,23],{},"The data controller is Arnaud de Cuniac, a natural person, publisher of the PokéTrack service in a personal, non-professional capacity.",[10,25,26,27],{},"Contact: ",[28,29,31],"a",{"href":30},"mailto:a.decuniac@gmail.com","a.decuniac@gmail.com",[10,33,34],{},"Given the nature and volume of the processing involved, no data protection officer has been appointed.",[17,36,38],{"id":37},"_2-guiding-principle","2. Guiding principle",[10,40,41],{},"PokéTrack is a personal project. Only the data required to operate it is collected.",[10,43,44],{},"The Service carries no audience measurement, no advertising tracker and no behavioral analytics. Your data is never sold, rented or passed to third parties for commercial purposes, and is subject to no profiling and no automated decision-making.",[17,46,48],{"id":47},"_3-data-collected","3. Data collected",[50,51,53],"h3",{"id":52},"a-account","a. Account",[10,55,56],{},"Your name, your email address, whether that address has been verified, and the dates the account was created and last modified. If you sign in with a Google account, that account’s identifier and, where applicable, the profile picture address provided by Google.",[50,58,60],{"id":59},"b-authentication-material","b. Authentication material",[10,62,63],{},"The fingerprint of your password, stored hashed and never in clear text. The tokens issued by Google if you use that sign-in method, which may contain the email address of that Google account, along with the permissions granted to the Service. The one-time codes sent by email, stored hashed, along with address verification and password reset tokens.",[10,65,66],{},"During a Google sign-in or account link, a temporary technical state is also recorded: it holds the return address to the Service, a single-use security key and, in the case of a link, the email address and identifier of the account concerned.",[50,68,70],{"id":69},"c-sessions","c. Sessions",[10,72,73],{},"A session token and its expiry date, together with the IP address and browser identifier (user-agent) recorded when the session was opened.",[50,75,77],{"id":76},"d-collection","d. Collection",[10,79,80],{},"The identifiers of the cards you declare you own, along with the date they were added. No data is retrieved from the game: this list comes solely from what you enter.",[50,82,84],{"id":83},"e-preferences","e. Preferences",[10,86,87],{},"Whether secret cards should be counted towards your progress.",[50,89,91],{"id":90},"f-security","f. Security",[10,93,94],{},"Request rate-limiting counters, stored under a key that pairs your IP address with the route called. An IPv4 address is kept whole; an IPv6 address is truncated to its first 64 bits, both here and for sessions.",[10,96,97],{},"No sensitive data within the meaning of Article 9 of the GDPR is collected. The Service processes no payment data, since it involves no payments.",[17,99,101],{"id":100},"_4-purposes-and-legal-bases","4. Purposes and legal bases",[103,104,105,121],"table",{},[106,107,108],"thead",{},[109,110,111,115,118],"tr",{},[112,113,114],"th",{},"Purpose",[112,116,117],{},"Data involved",[112,119,120],{},"Legal basis",[122,123,124,136,147,156,166,177],"tbody",{},[109,125,126,130,133],{},[127,128,129],"td",{},"Creating and managing your account",[127,131,132],{},"a, b",[127,134,135],{},"Performance of the contract formed by the terms of use",[109,137,138,141,144],{},[127,139,140],{},"Authenticating you and keeping your session open",[127,142,143],{},"b, c",[127,145,146],{},"Performance of the contract",[109,148,149,152,154],{},[127,150,151],{},"Sending verification and password reset emails",[127,153,28],{},[127,155,146],{},[109,157,158,161,164],{},[127,159,160],{},"Recording your collection and computing your progress",[127,162,163],{},"d, e",[127,165,146],{},[109,167,168,171,174],{},[127,169,170],{},"Protecting the Service against abuse and intrusion attempts",[127,172,173],{},"c, f",[127,175,176],{},"Legitimate interest in the security of the Service",[109,178,179,182,185],{},[127,180,181],{},"Answering your requests",[127,183,184],{},"a and the content of your message",[127,186,187],{},"Legitimate interest in handling incoming inquiries",[17,189,191],{"id":190},"_5-emails-sent","5. Emails sent",[10,193,194],{},"The only emails sent are transactional: address verification, password reset, and a notice when someone attempts to sign up with an address already tied to an account.",[10,196,197],{},"No newsletter and no promotional email is ever sent.",[17,199,201],{"id":200},"_6-cookies-and-local-storage","6. Cookies and local storage",[10,203,204],{},"The Service sets four cookies, all strictly necessary for it to work. As such they are exempt from prior consent, and no cookie banner is displayed.",[103,206,207,220],{},[106,208,209],{},[109,210,211,214,217],{},[112,212,213],{},"Cookie",[112,215,216],{},"Role",[112,218,219],{},"Lifetime",[122,221,222,236,249,261],{},[109,223,224,230,233],{},[127,225,226],{},[227,228,229],"code",{},"__Secure-better-auth.session_token",[127,231,232],{},"Keeps your session open. Signed cookie, not readable by page JavaScript",[127,234,235],{},"30 days",[109,237,238,243,246],{},[127,239,240],{},[227,241,242],{},"__Secure-better-auth.session_data",[127,244,245],{},"Caches the session to avoid a database read on every page",[127,247,248],{},"5 minutes",[109,250,251,256,259],{},[127,252,253],{},[227,254,255],{},"__Secure-better-auth.state",[127,257,258],{},"Protects a Google sign-in or account link against request forgery",[127,260,248],{},[109,262,263,268,271],{},[127,264,265],{},[227,266,267],{},"i18n_redirected",[127,269,270],{},"Remembers the language you chose",[127,272,273],{},"1 year",[10,275,276,277,280],{},"The ",[227,278,279],{},"__Secure-"," prefix is added by the authentication layer when the Service is served over HTTPS, which is the case in production. Outside HTTPS the first three cookies carry the same names without that prefix.",[10,282,283,284,287],{},"The Service also stores two pieces of information in your browser’s local storage: the cards most recently searched in the booster tool, under a key prefixed ",[227,285,286],{},"poketrack.recent-target-cards",", and your theme preference (light, dark or system). This information is never sent to the server and disappears if you clear the site data.",[17,289,291],{"id":290},"_7-recipients-and-processors","7. Recipients and processors",[10,293,294],{},"Your data is only accessible to the publisher and to the following technical providers, acting on the publisher’s instructions:",[103,296,297,311],{},[106,298,299],{},[109,300,301,304,306,308],{},[112,302,303],{},"Provider",[112,305,216],{},[112,307,117],{},[112,309,310],{},"Location",[122,312,313,327,341,355],{},[109,314,315,318,321,324],{},[127,316,317],{},"Vercel Inc.",[127,319,320],{},"Site hosting and image delivery",[127,322,323],{},"Data passing through the Service, technical logs",[127,325,326],{},"United States, delivered through a global network",[109,328,329,332,335,338],{},[127,330,331],{},"Neon",[127,333,334],{},"Database",[127,336,337],{},"Account, authentication, sessions, collection, preferences",[127,339,340],{},"European Union",[109,342,343,346,349,352],{},[127,344,345],{},"Resend",[127,347,348],{},"Sending transactional emails",[127,350,351],{},"Name, email address, email content",[127,353,354],{},"United States",[109,356,357,360,363,366],{},[127,358,359],{},"Google",[127,361,362],{},"Google account sign-in, only if you choose that method",[127,364,365],{},"Authentication material",[127,367,354],{},[10,369,370],{},"Your data may also be disclosed to an administrative or judicial authority where the law requires it.",[17,372,374],{"id":373},"_8-transfers-outside-the-european-union","8. Transfers outside the European Union",[10,376,377],{},"The database, which holds the bulk of your data, is hosted within the European Union.",[10,379,380],{},"The hosting, email and authentication providers are established in the United States. Transfers to those providers are governed by the standard contractual clauses adopted by the European Commission and, where applicable, by their adherence to the EU \u002F US data protection framework.",[17,382,384],{"id":383},"_9-retention-periods","9. Retention periods",[103,386,387,397],{},[106,388,389],{},[109,390,391,394],{},[112,392,393],{},"Data",[112,395,396],{},"Period",[122,398,399,407,415,423,431,439],{},[109,400,401,404],{},[127,402,403],{},"Account, collection and preferences",[127,405,406],{},"For as long as the account exists. No automatic deletion is applied for inactivity",[109,408,409,412],{},[127,410,411],{},"Sessions",[127,413,414],{},"Valid for 30 days, or until you sign out",[109,416,417,420],{},[127,418,419],{},"One-time codes and reset tokens",[127,421,422],{},"Valid for 1 hour",[109,424,425,428],{},[127,426,427],{},"Google sign-in and link states",[127,429,430],{},"Valid for 10 minutes",[109,432,433,436],{},[127,434,435],{},"Rate-limiting counters",[127,437,438],{},"A few minutes",[109,440,441,444],{},[127,442,443],{},"Emails you send to the publisher",[127,445,446],{},"As long as needed to handle your request",[10,448,449],{},"Once the stated period has passed, a session, a one-time code, a reset token or a sign-in state stops being valid and can no longer be used. The matching row is not erased automatically, however: it stays in the database until a cleanup is carried out.",[10,451,452],{},"Deleting your account, requested as described in section 10, erases the account itself, your sign-in credentials, your sessions, your collection and your preferences. Three technical sets are not tied to the account and therefore do not disappear with it: verification and reset codes, which hold the email address they were sent to; Google sign-in and link states, which hold the return address and, for a link, the email address and identifier of the account; and rate-limiting counters, which hold an IP address. You may ask for those to be erased in the same request. Residual copies may also remain for a few days in the host’s backups, before being overwritten in turn.",[17,454,456],{"id":455},"_10-your-rights","10. Your rights",[10,458,459],{},"Under the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability and the right to set instructions on what becomes of your data after your death.",[10,461,462,463,465],{},"These rights are exercised by email to ",[28,464,31],{"href":30},". You will receive a reply within a maximum of 30 days. A verification element may be requested if there is serious doubt about your identity.",[10,467,468,469,475],{},"If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at ",[28,470,474],{"href":471,"rel":472},"http:\u002F\u002Fwww.cnil.fr",[473],"nofollow","www.cnil.fr",".",[17,477,479],{"id":478},"_11-security","11. Security",[10,481,482],{},"Exchanges with the Service are encrypted over HTTPS. Passwords and one-time codes are stored hashed. Session cookies are signed and not readable by page JavaScript. Every authentication route is rate limited, with tighter thresholds on sign-in, sign-up and password reset. Database access is restricted.",[10,484,485],{},"Since no system is infallible, and the Service is a personal project, no guarantee of absolute security can be given. If you discover a vulnerability, please write to the contact address rather than disclosing it publicly.",[17,487,489],{"id":488},"_12-minors","12. Minors",[10,491,492],{},"The Service is reserved for people aged 15 or over, in accordance with Article 5 of the terms of use. No data is knowingly collected from anyone younger. If such an account is reported, it is deleted and its data erased.",[17,494,496],{"id":495},"_13-changes","13. Changes",[10,498,499],{},"This policy may change, in particular if the way the Service works or the providers it relies on change. The date it was last updated appears at the top of the document.",[10,501,502],{},"In the event of a substantial change, users holding an account are informed by email or through a visible notice on the Service.",[17,504,506],{"id":505},"_14-language","14. Language",[10,508,509],{},"This policy is written in French. The English translation is provided for information only: in the event of any discrepancy, the French version prevails.",{"title":511,"searchDepth":512,"depth":512,"links":513},"",2,[514,515,516,525,526,527,528,529,530,531,532,533,534,535],{"id":19,"depth":512,"text":20},{"id":37,"depth":512,"text":38},{"id":47,"depth":512,"text":48,"children":517},[518,520,521,522,523,524],{"id":52,"depth":519,"text":53},3,{"id":59,"depth":519,"text":60},{"id":69,"depth":519,"text":70},{"id":76,"depth":519,"text":77},{"id":83,"depth":519,"text":84},{"id":90,"depth":519,"text":91},{"id":100,"depth":512,"text":101},{"id":190,"depth":512,"text":191},{"id":200,"depth":512,"text":201},{"id":290,"depth":512,"text":291},{"id":373,"depth":512,"text":374},{"id":383,"depth":512,"text":384},{"id":455,"depth":512,"text":456},{"id":478,"depth":512,"text":479},{"id":488,"depth":512,"text":489},{"id":495,"depth":512,"text":496},{"id":505,"depth":512,"text":506},"What PokéTrack does with your data","md",{},true,"\u002Flegal\u002Fen-us\u002Fprivacy",{"title":5,"description":536},"legal\u002Fen-US\u002Fprivacy","Cn_fGRuVd4g2smdAQtaBnGeF68B5dbwsT1dUhuVGzDw",1791074360963]