Privacy policy

Effective November 2, 2026

The short version. Without an account, your roster never leaves your device. With an account, we store your email, your sign-in details and your roster so it can sync. We don’t sell your data. We count visits with cookie-free analytics, and if the app crashes it sends us an error report that never includes your roster. There are no ads today; when they arrive, Google may use cookies to serve them, and where the law requires it we’ll ask first.

RanchRadar is an independent fan project that helps you check Pokémon Champions recruits against the Pokémon you already own. In this policy, “we” means the developer who runs it. Questions go to ranchradar.dev@gmail.com.

Using RanchRadar without an account

Your roster, notes and settings are saved in your browser’s own storage on your device. They aren’t sent to us. Clearing your browser’s site data deletes them, which is why Settings has an export option for keeping a backup file.

What an account stores

Sign-in details. Your email address, and a password stored only as a secure hash that we can’t read. If you sign in with Google or Discord, we receive your name, email address, profile picture and account ID from that service. We never see your Google or Discord password.
Your profile. Your language setting, and when you agreed to the terms and confirmed you’re 13 or older.
Your roster. Once sync is on, the Pokémon you add, their details (status, trial timers, nature) and any notes you write, so they’re the same on every device.
Session data. Your browser keeps a sign-in token so you stay signed in. It’s stored in your browser’s storage, not in a tracking cookie.

How we use it

Only to run RanchRadar: to sign you in, save and sync your roster, send emails you ask for (confirming your address or resetting your password), keep the service secure, for example by limiting repeated sign-in attempts, fix crashes, and see which pages people use. We don’t use your roster or account details for advertising, and we don’t sell or rent them to anyone.

Services that handle your data for us

Supabase runs our database and sign-in, and sends account emails.
Sentry receives crash reports when something breaks in the app: the error, the app version, your browser and device type, and the last few screens and buttons you used. Reports never include your roster, notes or email address, and links are trimmed of any sign-in codes first.
Cloudflare hosts the site. Like any web host, it processes your IP address and browser details to deliver pages and block attacks. It also runs our visit counting (see below), and its Turnstile check runs on the email sign-in, sign-up and password-reset forms to keep bots out, looking at your browser and device signals for that one check. Our encrypted database backups are stored in Cloudflare R2.
Resend delivers the emails your account needs, like confirming your address and resetting your password. It receives your email address and the message.
Google and Discord handle sign-in if you choose them. Their own privacy policies apply to your accounts with them.

These providers may store data on servers outside your country, including in the United States.

Analytics

We use Cloudflare Web Analytics to count visits. It records which page was viewed, the site you came from, your browser, operating system and device type, your country, and how fast the page loaded. It doesn’t set cookies or use your browser’s storage, and Cloudflare says it doesn’t use your IP address or browser details to identify or follow you across sites. We only see totals, never a record of any one person’s visits.

RanchRadar doesn’t show ads yet. We plan to show them through Google AdSense to cover running costs, in places that stay out of the way of checking your roster. Ads won’t use your roster, notes or account details. Once they’re on:

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to RanchRadar and other websites.
Google’s advertising cookies let it and its partners serve ads to you based on your visits to RanchRadar and other sites on the internet. Third parties may also place and read cookies in your browser, or use web beacons, to collect information as a result of ads shown here.
You can turn off personalized ads in Google’s Ads Settings, or opt out of some other vendors’ personalized-ad cookies at www.aboutads.info. You’ll still see ads, just less tailored ones.
Visitors in the European Economic Area, the UK and Switzerland will be asked for consent before any advertising cookies are used, and can change their choice at any time.
We’ll name any ad networks besides Google here, with links to their sites, before they serve ads on RanchRadar.

Apart from those ads, RanchRadar doesn’t use cookies. Your sign-in session and settings live in your browser’s own storage, and they aren’t used to track you.

How long we keep it

We keep your account data until you delete your account. Deleting it removes your sign-in, profile, roster and everything else saved with the account from our database straight away, and the app clears its copy from the device you deleted it on. Other devices still signed in keep their own copy until you clear them or the browser’s site data. Copies can remain in backups for up to 90 days: our own weekly database backups, which are encrypted and kept in private storage, are deleted after 90 days, and our providers’ backups are overwritten on their own schedules.

Your choices and rights

Export your roster anytime from Settings. With an account, Download my data in the account menu saves everything the account holds as a JSON file, which you can also import later as a backup.
Delete your account anytime with Delete account in the account menu. If you can’t sign in, email ranchradar.dev@gmail.com from the address on the account and we’ll delete it for you.
Ask to see, correct or receive a copy of the data we hold about you. Depending on where you live, you may have further rights under laws like the GDPR or the CCPA. Email us to use any of them.

Children

RanchRadar isn’t directed at children under 13, and accounts are for people 13 and older. Every new account is asked its age once; answering under 13 deletes the account and its data straight away. If you believe a child under 13 has an account anyway, email us and we’ll delete it.

Security

Connections are encrypted, and each account can only read and change its own roster. No service is perfectly secure, so use a password you don’t use anywhere else.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change affects how your data is used in a meaningful way, we’ll also tell you in the app.