Pokébot
Legal

Privacy Policy

Effective October 7, 2026 · Questions? Ask in the support server.

This Privacy Policy explains what Pokébot ("Pokébot", "we", "our" or "us") collects, why, where it goes and how to have it removed. It covers the Discord bot, the website at thepokebot.com, and the Pokébot Arena when it runs as a Discord Activity.

By using Pokébot, adding it to a Discord server, logging in to the website or opening the Activity, you agree to what is described here.

1. What this covers

  • The bot — the slash commands, buttons and game features inside Discord.
  • The website — thepokebot.com: the card database, leaderboards, the Market, the region map, server pages, trainer profiles, the dashboard and the Arena.
  • The Activity — the Arena opened inside Discord, which signs you in through Discord.

2. What the bot stores

Only what the game needs to work:

  • Discord user IDs, server IDs, and channel IDs an admin picks in /setup
  • Command use and interaction timestamps, cooldowns, streaks, votes, rewards and reminders
  • In-game currency balances (coins, gems, stardust), items and the ledger of how they moved
  • Cards: codes, rarity, condition, grades and sub-grades, 1st Edition numbers, shinies, error cards, binders, and who owns what
  • Packs opened, grading, trades, offers, auctions, the market, the Wanted Board, quizzes, quests, achievements, seasons and leaderboards
  • The Pokémon League: your team, Pokédex, badges, journey progress, the favourite Pokémon and trainer look you pick
  • The Arena: battles and their logs, results, Rank Points, seasons, Tower runs, cups and tournaments, badges, the trainer you battle with
  • Server settings: channels, the town's name and type on the map, text commands on or off, disabled features
  • Error and technical logs needed to fix bugs, prevent abuse and keep the bot running

Discord IDs are used only to connect game data to the right user, server or channel.

3. What the website stores

  • Logging in. The website signs you in through Discord (OAuth2, the identify scope only). Discord tells us your user ID, username, display name and avatar: nothing else, never your email or your messages. We keep that in a signed cookie in your browser for 60 days, renewed each visit, so you stay logged in; logging out clears it. There is no password.
  • The Activity. When the Arena opens inside Discord, the Activity exchanges a Discord authorization code for the same identify details and a session token of its own; nothing more is read from your Discord account.
  • What you do on the site. Changes you make on the dashboard (your wall picks and binder edits) are sent to the bot and stored with your game data.
  • Usage counting. To know whether anyone uses the site, we count page views per route, logins and visitors per day. A visitor is counted as a short hash of the IP address, browser and date; the IP address itself is not stored, and the counts are kept for 30 days. There are no advertising trackers and no third-party analytics.
  • Pictures. Card pictures are resized through the site's own proxy and an image CDN (wsrv.nl); the pictures the bot draws (slabs, shinies, error cards, wrappers) are cached on the site's own disk.

4. What is public

Pokébot is a game played in front of other people, and the website shows the same things the bot shows in a server:

  • Trainer profiles (thepokebot.com/t/<your Discord ID>) show your Discord display name and avatar, your collection, binders, League team, badges, wishlist, Arena record and the servers you play in. Leaderboards, the Market, the Wanted Board and the card database show the same names.
  • Server pages (thepokebot.com/s/<server ID>) and the region map show a server's name, icon, member count, its town, its seven Gyms and who leads them, and its trainers' public numbers.
  • The Arena shows your Arena name, trainer sprite, rank and results to other players, live and in replays.

Profile and server pages are marked noindex so search engines leave them alone, but anyone with the link can open them.

5. What we do not collect

Pokébot does not ask for, and does not want, real-world personal information: real names, email addresses, phone numbers, home addresses, passwords, payment details, precise location or government identification. Please don't put any of it into a command, a binder name or a trainer name.

6. How we use it

  • To run the game: inventories, currency, progress, battles, cooldowns and rewards
  • To show profiles, rankings, population numbers, the map and the Market on the website
  • To keep servers configured the way their admins set them
  • To prevent abuse: cheating, spam, duplicate claims, vote manipulation, economy exploits
  • To find and fix bugs, and to answer support and deletion requests

7. Message content

Pokébot reads a message only when a feature needs it: a quiz answer, a search term, a card code, a trade reply, or a text command in a server whose admin switched text commands on. It does not store chat logs, does not watch general conversation and does not use message content for advertising. Wherever it can, it uses slash commands, buttons, menus and modals instead.

8. Where it is kept

Game data lives in the bot's own database on its hosting provider. The website keeps an in-memory copy of the public game feeds the bot sends it, plus the caches and counts described above, on its own host. Access is limited to the owner and anyone they authorise to run or secure the service.

9. Who else sees it

Pokébot does not sell or rent data, and shows no advertising. Limited data is processed by:

  • Discord, to run the bot, the login and the Activity
  • Hosting providers for the bot and the website
  • top.gg, when you vote (it tells us your user ID so the reward can be paid)
  • Image services: the card scans' hosts and the wsrv.nl image CDN that resizes them; Pokémon sprites from PokeAPI (GitHub)
  • Anyone the law requires, and whoever is needed to investigate abuse or a security problem

Each of these has its own privacy policy, which we don't control.

10. How long we keep it

Game data is kept for as long as it is needed to run the game, keep your progress and prevent abuse, typically until you ask for it to be deleted or the owner clears inactive data. The website's usage counts are dropped after 30 days; the login cookie expires after 60 days without a visit.

11. Deleting your data

Ask in the support server with your Discord user ID and we will delete your game data where reasonably possible. Server admins can ask for their server's settings to be removed. Some records may be kept where they are needed for security, abuse prevention, legal reasons or the integrity of the game (a trade already made with someone else, for example).

12. Security

We take reasonable steps to protect stored data from unauthorised access, loss or alteration, but no online service can promise to be completely secure.

13. Children

Pokébot follows Discord's Terms of Service and age requirements and does not knowingly collect personal information from children. If you believe a child has provided some, contact us and it will be reviewed and removed.

14. Your rights

Depending on where you live you may have the right to access, correct or delete the data tied to your Discord user ID. Ask in the support server; we may need your Discord user ID to find it.

15. Changes

This policy changes when the game does. The date at the top is the version you are reading; continued use after a change means you accept it.

16. Contact

Questions, privacy concerns and deletion requests go to the bot owner in the official support server:

Support Server: discord.gg/zj9Sxz3reR

Thank you for playing Pokébot.