Privacy Policy

Pokegrind is an independent, non-commercial fan project, part of the Reawon ecosystem alongside Reafile and Polywon. For privacy questions or requests, contact us at privacy@pokegrind.com.

Pokegrind requires an account to save your progress. We store:

• Your account identity. If you sign up with email and password, we store your email address. If you sign in with Google or GitHub, we receive your email address, and where available your display name and profile picture. We never receive or store your Google or GitHub password.
• Your game progress. Your trainer level, experience and in-game coins, linked to your account.
• Your location, if you allow it.The game world is built from the real streets around you, so with your permission we read your device's coordinates and store your last playing position. This is the most sensitive thing we hold, so it has its own section below.
• Technical logs.Our host records standard server logs, including IP addresses, for security and reliability. We do not use these to build a profile of you. Pokegrind's application diagnostics contain only a fixed event label and safe error code, class or HTTP status. We do not put authentication credentials, request content, private messages or exact coordinates into those diagnostics. Unexpected browser failures send a fixed category, allowlisted error class and optional framework digest to our own server, which records a privacy-safe error fingerprint in the same technical logs. Error messages, stacks, page addresses and arbitrary browser data are discarded and no third-party tracker is loaded.
• Replays you choose to share. When you explicitly create a public replay link, we store a filtered copy containing your trainer name, both visible teams and the public battle events. It never contains your location coordinates, account ID, private move sets or the raw battle snapshot.
• Community routes you submit.A route contains the title and description you enter, its exact start and endpoint, and its verified distance. Pending routes are shown to nearby peer reviewers and approved routes are visible to nearby signed-in Trainers. Reports and votes are stored privately without exposing the reviewer's identity.

We do not ask for, and have no use for, your real name, postal address, phone number or payment details. Pokegrind has no payment system at all.

Map data comes from OpenStreetMap and is published under the Open Database License.

Pokegrind draws the map from the real streets around you, so it needs to know roughly where you are. Your browser will ask before sharing anything, and you can refuse: the game still runs, on a stand-in map somewhere else.

What leaves your device. When you allow it, your coordinates are used to work out which map squares to draw. Those square boundaries, not your exact position, are sent to OpenStreetMap data providers (the main Overpass service or its Private.coffee fallback) to fetch the streets and buildings. The data is published under the Open Database License. That request is made by our server rather than by your browser, so your IP address is never exposed to them, and each square is cached and shared between everyone playing nearby.

Current weather comes from Open-Meteo. Our server sends a rounded neighbourhood coordinate, never your account identity or IP address, and shares the resulting observation with nearby players for ten minutes. Pokegrind stores only the latest observation for each weather cell; it is not a history of your movements.

What we keep.We keep your last playing position, the spawn point you explicitly choose, and a private movement-integrity audit used to reject impossible jumps and verify distance-based rewards. The audit records requested and previously trusted positions, distance, acceptance status and server time; it is visible only to your account and game services and is deleted after 30 days. We do not read location in the background, and the game only receives new device coordinates while you have it open. Your device is asked for its position only when there is nothing to resume, which in practice means your first game, or when you ask to recentre on your real location. Returning to a saved game does not read your position at all. Your selected spawn point is also copied to this browser so it survives a refresh if cloud synchronisation is interrupted. Public map geometry for recently visited squares is cached in your browser for up to 30 days so stale map data can remain available during provider failures. At most 320 squares are kept, and clearing Pokegrind's site data removes these local copies. Revoking location permission stops new location readings immediately.

Route recording begins only when you press Record from here and ends only when you press Finish and submit. If submitted, the exact start and endpoint become visible to nearby peer reviewers and, after approval, nearby signed-in Trainers. Do not create a route from a private home, school entrance or other sensitive location.

Your account ID is used internally for ownership, duplicate-vote prevention, reports and exact-once rewards, but is not included in the route listing. A route requires two peer approvals. Three independent reports return an approved route to review. Route attempts use the private movement audit to verify proximity and distance; other Trainers cannot see who attempted or completed a route.

Battle replays are private by default. A replay becomes public only when you press the Share replay button. The resulting address contains an unguessable token and can be opened by anyone who receives it, without an account.

The public copy expires automatically after 30 days. You can revoke it immediately from Battle History, after which the link stops working. Friendly PvP and ranked League battles cannot currently be shared because they involve another participant or private competitive information.

This matters, so we want to be explicit about it. Pokegrind shares a single account system with the other Reawon apps (Reafile and Polywon). Your login and your basic identity (username, display name, avatar) are shared between them, which is what lets one account work everywhere. Your game progress is not shared: your Pokegrind trainer data is only ever read by Pokegrind, and the other apps' data is not visible to Pokegrind.

We store your account and progress for one reason: to give you back your save when you log in. Under the GDPR, our legal basis is the performance of a contract, that is, providing the game you asked to play. Server logs rest on our legitimate interest in keeping the service secure and online.

• Supabase hosts our database and handles authentication. Your account and progress live there.
• Vercel hosts and serves the site, and produces the technical logs mentioned above.
• Google, only if you choose to sign in with it, and only for that sign-in.
• OpenStreetMap Overpass and Private.coffee supply the map data. They receive map square boundaries from our server, never your identity and never your IP address. Private.coffee is used only when the main Overpass service is unavailable.
• Open-Meteo supplies current neighborhood weather. It receives a rounded coordinate from our server, never your account identity or browser IP address.

That is the complete list. We do not share, sell, rent or trade your data with anyone else beyond the providers described here. PostHog (US Cloud) receives page and feature events associated with your pseudonymous shared Reawon account ID. Analytics is on by default and can be turned off under Cookies below. We exclude email, typed text and precise location. Session replay is disabled.

Session cookies keep you logged in. We also remember your analytics choice in a first-party cookie and local storage, and PostHog stores an analytics identifier in local storage. Turning analytics off below also stops server usage events; contact us to request deletion of previously collected analytics.

• No advertising, and no advertising partners.
• No advertising or cross-site tracking; no session recording.
• No selling of personal data and no public sharing unless you explicitly create a replay link or submit a community route for review.
• No payments, no subscriptions, no in-game purchases, ever.

If you are in the EU or UK, the GDPR gives you the right to access your data, to correct it, to have it deleted, to receive a copy of it, and to object to its processing. If you are in California, the CCPA gives you comparable rights, including the right to know and to delete. We honour these requests wherever you live.

Deleting your accountremoves your Pokegrind progress permanently. Settings > Privacy lets you download a portable JSON copy first, then delete every Pokegrind-owned record immediately after typing an explicit confirmation phrase. Security and live-operations audit entries retain their event and timestamp but their account attribution is anonymised. Because your login is shared across the Reawon ecosystem, Pokegrind deletion preserves that login and data belonging to other Reawon products. To delete the shared Reawon identity itself, write to privacy@pokegrind.com and we will coordinate the ecosystem-wide request within 30 days. You also have the right to complain to your local data protection authority.

Your account and progress are kept for as long as your Pokegrind profile exists. Self-service deletion removes Pokegrind-owned rows from the live database in one transaction, and deleted data is purged from backups within 30 days. Anonymised operational audit events remain only for their applicable retention period. Inactivity never silently deletes your Pokémon or progress; after 90 days without activity, however, we clear your last saved coordinates and ask for location again when you return.

Public replay copies expire after 30 days or disappear sooner when you revoke their link. Account deletion also deletes every replay link you created. Retry responses expire after 24 hours, rate-limit records after two days, and notification read state after 180 days.

Resolved or dismissed safety reports are deleted 180 days after review; unresolved reports remain until a decision. Expired moderation actions and operational audit events are deleted after one year. Unfinished route recordings expire after 30 days and rejected routes after 180 days; approved route submissions remain available while published. Deleting your Pokegrind data removes your linked route records.

Pokegrind application diagnostics and hosting access logs have a maximum 30-day retention at our host. Database retention runs at most once daily when the service is active, using bounded cleanup batches.

Pokegrind is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has given us personal information, contact us at privacy@pokegrind.com and we will delete the account.

We may update this policy. The "Last updated" date above reflects the most recent revision. If a change materially affects how we handle your data, we will make it clear in the game rather than quietly editing this page.

For any privacy question or request: privacy@pokegrind.com.