Privacy policy

1. Controller

Data controller: Alejandro Torres Castillo (España). Contact: tor.cas.alejandro@gmail.com.

Go-Dex is a personal fan project, not affiliated with Niantic, Nintendo, Creatures, GAME FREAK or The Pokémon Company.

2. Data we process

Account: email, trainer name, password (stored hashed; we never see it) and app language.

What you add: your catches and dex records, your trainer code (if you add it), your trade list, your friends, the users you block and your chat messages.

Notifications: if you turn them on, your device's address in your browser's or phone's notification service.

Technical data: server access and error logs (IP address, date and page) and anonymous, cookie-less usage and performance metrics.

3. Purposes and legal basis

Providing the service you sign up for (account, dex, trades, friends and chat): performance of a contract (Art. 6(1)(b) GDPR).

Sending required emails (account confirmation, password reset): performance of a contract.

Message notifications: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from your profile or device settings.

Security, abuse prevention and improving the app with anonymous metrics: legitimate interest (Art. 6(1)(f) GDPR).

We don't sell your data, show ads or make automated decisions about you.

4. Who can see your data

Any registered user sees your trainer name and trade list. If you generate the printable sheet, anyone who scans its QR code (or has its link) sees your trainer name and your Looking for and Offering lists, even without an account; you can turn that access off or renew the QR code in your profile. Only mutual friends see your dex and trainer code. While you have the app open, it shows your mutual friends that you're online. Messages are only visible to the people in each conversation.

We use processors on our behalf: Supabase (database and accounts; servers in Ireland, EU), Vercel (hosting and anonymous metrics), Resend (email delivery; EU region) and Cloudflare (bot protection at sign-up). If you turn on notifications, they're delivered through your browser's or system's service (Google, Apple or Mozilla).

Some of these providers are US companies; international transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

5. How long we keep it

For as long as you have an account. If you delete it, we immediately erase your account and all its data (catches, offers, friends, messages and devices). Server logs are deleted automatically within a few days.

6. Your rights

You can access, rectify, erase, object to or restrict processing of your data and request portability by emailing tor.cas.alejandro@gmail.com. You can delete your account and all your data directly from your profile.

You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local authority.

7. Minimum age

You must be at least 14 years old to sign up. If you're younger, a parent or guardian must sign up or give consent.

8. Cookies and storage

We only use strictly necessary cookies: your session and your chosen language. Your light/dark theme and some preferences are stored in your browser. We don't use advertising or tracking cookies, and usage metrics are anonymous and cookie-less, so no consent is needed for them.

9. Changes

If we change this policy we'll let you know in the app. Last updated: 2026-10-19.