Who is responsible
The data controller is Yohan Arroyave, a natural person resident in Colombia. For any privacy matter, write to me at [email protected].
I apply Colombian Law 1581 of 2012 and, for visitors from the European Union, the United Kingdom, Switzerland or Brazil, also the GDPR, the UK GDPR and the LGPD where applicable.
What data I collect and why
The placeholder generator and the set pages work without an account. I only collect personal data if you sign in to the Collection Tracker or subscribe to the emails.
- Account: your email, your name and profile picture if you sign in with Google, and the username you choose. They make your collection yours and let me send you the sign-in code.
- Collections: the cards you mark, how many you have and in which finish. They are private by default. If you mark a collection as public, anyone with the link or with your username can view it.
- Optional emails: if you turn on the email digest, I store your preference and your language so I can send you a monthly summary of your collections and the week's price movements. You can unsubscribe with one click from any email.
- Browsing: pages you visit and actions on the site, in aggregate form and according to the consent you give (see Analytics).
I do not ask for or store payment data. Donations go directly to Ko-fi.
Cookies and local storage
The first-party cookies the site needs to work are few. Analytics and advertising cookies are only created if you accept them in the consent banner (in the regions where it is shown).
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-authjs.session-token | Keep you signed in | 30 days from your last visit |
| __Host-authjs.csrf-token | Protect sign-in against cross-site request forgery | For the duration of the visit |
| __Secure-authjs.callback-url | Return you to the page you were on after signing in | For the duration of the visit |
| __Secure-authjs.pkce.code_verifier, state, nonce | Complete the Google sign-in securely | 15 minutes |
| ph_* (PostHog) | Product analytics, only with your consent | 1 year |
| _ga, _ga_* (Google Analytics) | Audience measurement, only with your consent | 2 years |
| Cookies from Google and its advertising partners | Show and measure ads, only with your consent | Depends on each provider |
In addition, your browser stores some data in its local storage (localStorage and sessionStorage). It stays on your device except where the table says otherwise, and you can delete it from your browser settings.
| Key | Purpose |
|---|---|
| app_language | Remember the language you chose |
| pk_geo | The code of your approximate country (based on the network), for 24 hours, to know whether the consent banner should be shown |
| pkmn.ct.guest.v2 | Your collection as a guest without an account. It moves to your account when you sign in (at that point it is sent to the server) |
| pkmn.recentSearches.v1 | Your last six card searches |
| ct_setcta_variant | Which version of a generator message you were shown, to measure which one works better. It is only stored if you accept analytics; the value is sent to PostHog with the event. |
| ph_signin_pending, ct_bridge_setcta_fired, ct_guest_savecta_fired | Avoid counting the same event twice in the same tab |
You can change your cookie choice at any time with this button or from the link in the footer.
Analytics
I use two tools to understand how the site is used: Google Analytics 4, loaded through Google Tag Manager, and PostHog. PostHog receives the data through a proxy on my own domain and stores it on servers in the United States.
If you have not accepted or rejected the banner, both run in cookieless mode: they count visits and actions without identifying you, without storing identifiers in your browser and without recording the session. Your IP address is discarded when the data is received. If you accept, PostHog can link your actions to your account when you sign in and record the session to review usability errors. In those recordings, form fields are always masked.
Advertising
The site may show ads served by Google AdSense. Google and its partners use cookies to show ads based on your visits to this and other sites, and to measure them. They only do so if you accept in the consent banner.
You can turn off Google's personalized advertising in Ads Settings and that of other providers at www.aboutads.info/choices. For more detail on how Google uses data, see policies.google.com/technologies/partner-sites.
Consent for advertising is managed with the banner you see when you visit from a regulated region. You can change it whenever you want from the Privacy preferences button.
Providers and transfers
For the site to work, some data passes through these providers. Where data is transferred outside your country, it relies on standard contractual clauses or adequacy decisions.
| Provider | Purpose | Where |
|---|---|---|
| Hostinger | Server where the site and the database run | European Union |
| Cloudflare | Delivery network, protection and image storage (assets.pkmntools.com) | Global network |
| Resend | Sending emails: sign-in code and digests | United States |
| Sign-in, Analytics, Tag Manager and AdSense | United States and global | |
| PostHog | Product analytics | United States |
| Ko-fi | Donations. Its window only loads if you open it | United Kingdom |
| TCGdex, PokéAPI, flagcdn, GitHub, pokemondb | Card images, sprites and flags that your browser downloads directly | Various |
Legal bases
- Performance of the service: account, session and collections.
- Consent: optional emails, non-essential cookies, analytics with identification and personalized advertising.
- Legitimate interest: site security and aggregate measurement without cookies.
How long I keep the data
- Account and collections: for as long as the account exists. If you ask me to delete it, everything is removed within 30 days at most.
- Session: 30 days from your last visit.
- Sign-in codes: 10 minutes, stored encrypted.
- Guest collection without an account: only in your browser, until you delete it or sign in.
- Server logs: I do not store IP addresses in my own logs. Cloudflare and the hosting provider keep theirs according to their policies.
Your rights
You can ask for access, correction, deletion or portability of your data, object to a processing activity or withdraw a consent. Write to me at [email protected] from your account email and I will reply within 15 business days at most (Law 1581) or one month (GDPR).
If you think I have not handled your request properly, you can go to the Superintendencia de Industria y Comercio in Colombia, to the data protection authority of your country in the European Union, to the ICO in the United Kingdom or to the ANPD in Brazil.
Minors
The site is designed for adult collectors: prices, market and the history of the card game. I do not build advertising profiles of minors. If a minor created an account, their mother, father or guardian can write to me and I will delete it.
Changes to this policy
If I change anything relevant, I update the date on this page and, if you have an account and the change affects you, I let you know by email.
An honest note
I wrote this text myself, as carefully as I could, as a natural person who maintains a fan project. It is not a substitute for legal advice. If you see something missing or wrong, tell me and I will fix it.