Privacy Policy

1. Who is responsible

PokeAFK operates the site and the game and decides what happens to the data described here — it is the controller under the LGPD (Lei 13.709/2018).

Anything in this policy, including a deletion request, goes to the address at the bottom of this page.

2. What we collect

• When you create an account: your email address, and your password stored only as a salted hash. Your actual password is never stored and we cannot read it. If you use "Continue with Google" we receive your Google account identifier and the verified address on it, and no password exists at all.
• Where you came from: if you arrived through an invite or a campaign link, the code in that link is stored with your account so we can tell which channels bring players. It says nothing about you personally.
• Playing: your trainer, creatures, items, currency, hunts, purchases, chat messages, friends, party membership, and which days you were active.
• Technical: your IP address, seen by our network provider and used to rate-limit abuse; your language choice; and, only if you link WhatsApp, your device's timezone offset, so a notification does not arrive at 3am.
• Payments: what you bought, when, and whether it succeeded. Card numbers never reach our servers.

WhatsApp is different from all of the above, deliberately: there is nowhere on this site or in the game to type a phone number, and no endpoint that accepts one. You are shown a code in-game, you send it to our number from your own WhatsApp, and the number we then hold is the sender of that message. That way we can never message a stranger because somebody mistyped a digit. Reply STOP or PARAR at any time and it ends immediately.

3. Why we are allowed to

• To run your account and the game — that is the contract between us.
• Legitimate interest: keeping the service secure, stopping cheating and abuse, and understanding which channels bring players.
• Consent: WhatsApp notifications, which you give by messaging us and withdraw with one word.
• Legal obligation: keeping records of payments.

4. Cookies

One essential cookie holds your login session and your language choice. It is encrypted — its contents cannot be read by your browser, by a script on the page, or by anyone who is not our server.

We run no advertising cookies, no third-party analytics and no tracking pixels. If that ever changes, this section changes with it and we will say so before it does.

5. Who else sees it

• Brevo — sends account emails, and receives your address to do it.
• Stripe and Banco Inter — process payments. They receive what they need to charge you; we receive only the result. We never see or store a card number.
• Google — only if you sign in with Google, and only to confirm who you are.
• Cloudflare — carries every request to us, and sees IP addresses as part of that.
• WhatsApp (Meta) — only if you linked it, and only to deliver the messages you asked for.

Two in-game feeds are broadcast to WhatsApp groups: auction listings and bulletin posts. They carry game content only — never a phone number, never a participant list, and never anyone's contact details.

We do not sell your data, we have never sold it, and we are not going to.

6. What other players can see

Some things are public inside the game on purpose: your trainer name, level, title and badges, the story you write on your profile, your creatures' public history (who caught them, when, and with which ball), the leaderboards, and anything you type in a public chat room.

Your email address is never shown to another player.

7. How long we keep it

• Account and game data: while the account exists.
• Payment records: for as long as tax and consumer law require, even after an account is deleted.
• Security and rate-limit data: days, not months.

After a deletion request we remove or anonymise the account and its game data. A few records stay — a payment, a moderation decision, a creature's chain of custody with the name removed — where the law or the integrity of the game requires it.

8. Your rights

Under the LGPD you may ask us to confirm what we hold, give you access to it, correct it, delete it, hand it over in a portable form, tell you who we share it with, or withdraw a consent you gave.

Write from the address on the account and we will answer within 15 days. You may also complain to the ANPD, Brazil's data protection authority.

9. Children

The game is not for anyone under 13 and we do not knowingly collect their data. If you are a parent or guardian and believe a child under 13 has an account here, write to us and we will delete it.

10. Security

Passwords are hashed with PBKDF2 at 160,000 rounds. Traffic is encrypted end to end. Login, registration and password-reset endpoints are rate-limited. Payment credentials never touch our servers.

No system is perfect. If a breach ever affects your data we will tell you and the ANPD, as the law requires.

11. Where the data is

Some of the providers above process data outside Brazil. When that happens it is under the contractual safeguards the LGPD requires for international transfers.

12. Changes to this policy

We may update this policy. When a change matters we announce it on the site and on Discord, and the date at the top of this page changes.

Contact

Questions about this document, a data request, a refund, or anything else on this page — write to us. Use the email address on your account and a person will answer.

[email protected]