Privacy Policy

Pokebrowser is an independent, non-commercial hobby project operated by a single developer. There is no company behind it. For any privacy question, data request, or account deletion, contact kusuda.jordan@gmail.com.

We only collect what the game needs to function:

• Account information. When you sign up with email and password, we store your email address (your password is hashed and managed by our authentication provider, Supabase — we never see it). If you sign in with Google, we receive your basic Google profile (email, name, and profile picture) through that sign-in.
• Trainer profile. Your trainer name, chosen avatar, a generated friend code, your level and experience points (XP), and your profile privacy setting.
• Gameplay data. The Pokémon you catch (species, nickname, whether it is shiny, and the time of capture), your Pokédex progress, candies, achievement unlocks, encounter tokens, and lifetime statistics such as total catches, release count, and catch streaks.
• Website domains where you catch. Each time you catch a Pokémon, the extension records the hostname of the page you are on (for example github.com). See the next section for the full details — this is the most sensitive thing we store, so we want to be completely clear about it.
• Friends. Friend requests and friendships you create.

To make the game fun, encounters can happen on any site, and some achievements and a leaderboard reward catching Pokémon across many different websites. To support that, here is precisely what happens:

• When — and only when — you successfully catch a Pokémon, the extension sends the bare domain name of the current page (e.g. reddit.com) to our server.
• We store that domain on the caught Pokémon record, and we keep a list of the unique domains you have caught on so we can count them.
• The number of unique domains you have explored can appear on a public leaderboard alongside your trainer name. You can opt out of public leaderboards using the privacy toggle on your profile.

What the extension does NOT do:

• It does not record full URLs, query strings, or page paths — only the domain.
• It does not read, store, or transmit the content of pages you visit.
• It does not read form fields, passwords, or anything you type.
• It does not track your general browsing history. We only ever learn a domain at the moment you choose to catch a Pokémon there.

The extension requests permission to run on all websites (<all_urls>) because a wild encounter can appear on any page you visit. It uses Chrome's local storage to keep you signed in: your authentication tokens are saved on your own device and sent only to our authentication provider to keep your session active. The extension communicates with the Pokebrowser website to receive your login, and otherwise talks directly to our backend to record catches.

• To create and secure your account and keep you signed in.
• To run the core game: encounters, catches, your collection, and your Pokédex.
• To calculate levels, XP, candies, achievements, and stats.
• To power the friends system and public leaderboards.

We do not sell your data. We do not use it for advertising. We do not run any third-party analytics, tracking pixels, or ad networks.

If you do not enable the private profile setting, the following may be visible to other users or on leaderboards: your trainer name, avatar, level, and aggregate stats such as your total catches and the number of unique websites you have caught on. Your email address is never shown to other users.

We rely on a small number of services to operate Pokebrowser:

• Supabase — our database and authentication provider. It stores all of the account and gameplay data described above on our behalf and processes your login. Supabase's own systems may log technical information (such as IP addresses) as part of providing the service.
• Google — only if you choose "Continue with Google" to sign in. Google handles that authentication.
• Content delivery networks (for Pokémon sprites, trainer avatars, type icons, and fonts). When your browser loads these images and fonts, the CDN receives standard request information such as your IP address and browser type. We do not send any of your game or account data to these CDNs.

Pokémon species data is fetched only once when we build the app — never from your browser — so no personal data is ever sent to that source.

The website uses authentication cookies (provided by Supabase) to keep you logged in. The extension stores your session tokens in your browser's local storage. We do not use advertising or tracking cookies.

We keep your data while your account exists. You can request access to, correction of, or deletion of your data at any time by emailing kusuda.jordan@gmail.com. When you request deletion, we will remove your account and associated game data. Some information may persist briefly in backups before being overwritten.

Pokebrowser is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 18, you should use Pokebrowser only with the permission of a parent or guardian. If you believe a child under 13 has provided us information, contact kusuda.jordan@gmail.com and we will delete it.

We rely on Supabase's managed infrastructure and row-level security rules so that you can only access your own data. No method of storage or transmission is ever perfectly secure, but we take reasonable steps to protect your information.

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, or to object to certain processing. We honor these requests for all users — just email kusuda.jordan@gmail.com.

We may update this policy as the game evolves. When we make material changes, we will update the effective date at the top of this page. Your continued use of Pokebrowser after a change means you accept the updated policy.