Privacy Policy
This policy explains what personal data PokeRoamers handles, why, for how long, who else is involved, and how you can control it. It applies to the game at pokeroamers.com and to emails we send you. Contact: legal@pokeroamers.com.
The short version
- We collect what the game needs to run: your email, trainer name, a hashed password and your save data.
- No ads, no analytics, no tracking cookies, and we never sell your data.
- Your ROM files stay in your browser. They are never uploaded to us.
- Chat messages are delivered live and are not stored or logged by us.
- Voice chat goes through a relay, so other players never see your IP address.
- You can download all your data or delete your account yourself, in the game, at any time.
- We keep logs and backups for a short time (14 days) and IP addresses only briefly.
1. Who we are
PokeRoamers is a free, non-commercial, unofficial fan game run by volunteers, “the PokeRoamers team” (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us at legal@pokeroamers.com.
The game’s servers run on Render (in Frankfurt, in the EU) and on a dedicated server operated by the team.
2. What we collect, why, and for how long
The legal bases we rely on under the EU General Data Protection Regulation (GDPR) are:
- Contract (Art. 6(1)(b)): the processing is needed to give you the game you signed up for.
- Legitimate interests (Art. 6(1)(f)): the processing is needed for an interest of ours or of other players, such as keeping the game safe, fair and working, and that interest is not outweighed by your rights. The specific interest is named in each row below.
- Legal obligation (Art. 6(1)(c)): the law requires it.
Where a row says “until you delete your account”, the data is removed when you delete your account, and disappears from our database backups within 14 days after that.
2.1 Your account
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address | Your sign-in identifier; sending verification, password-reset and email-change codes and security notices. It must be verified with a mailed 6-digit code. | Contract | Until you delete your account |
| Trainer name | Your name in the game. It is public: other players see it. | Contract | Until you delete your account (see 9.2 about traded Pokémon) |
| Password | Signing in. We store only a one-way scrypt hash, never the password itself. | Contract | Until you change it or delete your account |
| Two-factor sign-in (optional) | If you turn on an authenticator app, we store its secret on the server to check your codes, and your recovery codes in hashed form. | Contract | Until you turn it off or delete your account |
| “Stay signed in” login tokens | Signing you in again on a device without your password. We store only a SHA-256 hash of each token. | Contract | Up to 180 days; revoked earlier when you log out, change your password or delete your account |
| Emailed codes | Verifying your email, resetting your password or changing your email. We store only a hash of the code. | Contract | Each code expires after 15 minutes |
| Terms acceptance record | Which version of the Terms you accepted and when, so we can show that you accepted them. | Legitimate interests (being able to demonstrate acceptance) and legal obligation | Until you delete your account |
2.2 Playing the game
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Save data | Your progress: position, party and PC Pokémon (including nicknames you typed), box names, items, in-game money, badges, story progress, Pokédex, rating and PvP wins, achievements, Hall of Fame entries, play time, the rival name you typed, and your character choice (boy or girl). | Contract | Until you delete your account |
| Social and trading data | Your friends list, guild and party membership, Market (GTS) listings with their in-game money prices, and Secret Base ownership. | Contract | Until you delete your account or remove the entry |
| Chat messages | Global, local, whisper, party and guild chat are delivered live to the recipients. We do not store or log them. Other players can still see, remember or screenshot what you send. | Contract | Not stored |
| Voice chat connection setup | Connecting party members who switch voice chat on. Our server passes along the setup messages with every IP address removed; the audio goes through Cloudflare’s relay, not through our servers (see section 4). | Contract (a feature you ask for) | Not stored |
| Play sessions | Start time and duration of each connection (no IP address). Used for support, moderation and service statistics. Legitimate interest: understanding how the game is used and investigating problems. | Legitimate interests | 12 months |
| Bug reports you file | Your text (up to 500 characters), your in-game position and zone, the game build, and, if you file within 10 minutes of a battle, that battle’s log. Legitimate interest: finding and fixing bugs and exploits. | Legitimate interests | Until 12 months after the report is closed |
2.3 Safety, moderation and anti-abuse
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Bans and suspensions | Who issued it, when, until when, and the reason (the rule broken). Legitimate interest: enforcing the Player Rules and protecting other players. | Legitimate interests | While the ban is in force; removed with the account |
| Staff action log | A record of game master actions such as giving items or Pokémon and teleports, which may involve your account. Legitimate interest: keeping staff accountable and preventing misuse of staff tools. | Legitimate interests | 12 months |
| IP address (rate limiting) | Held in server memory to limit sign-in attempts, signups, code requests and simultaneous connections. Legitimate interest: protecting accounts and the service from brute-force attacks and abuse. | Legitimate interests | While you are connected, and otherwise discarded within minutes; the mail log below is the only place our database keeps an IP address |
| Mail log | For each email we send: the address, the IP address that requested it, and the type of email. Used to cap how many emails an address or IP can trigger per day. Legitimate interest: stopping our email from being used to spam people. | Legitimate interests | 2 days |
| Bot check (Cloudflare Turnstile) | When you sign up or ask us to send you a code, Cloudflare checks your IP address and browser signals to tell people from bots. Legitimate interest: keeping automated account creation and email abuse out. | Legitimate interests | Not stored by us; see section 5 |
| Hosting and proxy logs | Technical request logs, which include IP addresses, kept by our servers and hosting provider. Legitimate interest: running the service securely and diagnosing faults. | Legitimate interests | Up to 14 days |
| Database backups | Copies of the database so the game can be restored after a failure. Legitimate interest: not losing everyone’s progress. | Legitimate interests | 14 days |
| Requests from authorities | If a competent authority lawfully requires it, we may have to disclose relevant data. | Legal obligation | As long as the law requires |
You can object to processing based on legitimate interests at any time (see section 9).
3. Things we don’t do
- We do not sell or rent your data to anyone.
- We show no advertising and have no advertising partners.
- We use no analytics services and set no tracking cookies. In fact, the game sets no cookies for players at all.
- We do not store or log chat messages.
- We do not receive your ROM files. They are read and processed in your browser, and the art and sound built from them stay on your device.
- We do not profile you, and we make no decisions about you based solely on automated processing that have legal or similarly significant effects. Rate limits and the bot check work automatically, but suspensions and bans are decided by people.
- We take no payments, so we hold no payment details.
4. Voice chat
- Voice chat is available only inside a party, is off until you switch it on, and needs your browser’s permission to use your microphone.
- The audio travels through Cloudflare’s TURN relay (WebRTC). Your browser connects only to the relay, never directly to another player, so other party members do not learn your IP address and you do not learn theirs.
- Our server gives your browser short-lived relay credentials when you join voice, and removes any IP address from the short setup messages it passes between party members.
- Cloudflare relays the encrypted audio stream and sees your IP address, as any relay must. Neither Cloudflare nor we record the audio.
- If you mute a party member, that choice is stored only in your browser.
5. Who else processes data
We use a small number of service providers. They process data for us under their data processing terms, or independently only where stated.
| Provider | What they do | Data involved |
|---|---|---|
| Render | Hosts the game servers (Frankfurt, EU). | The data the game handles while it runs, hosting logs |
| Resend (resend.com) | Delivers our transactional emails: codes and security notices. | Recipient email address, trainer name, the code or notice |
| Cloudflare (Turnstile) | Bot check on signup and on code requests. The widget is loaded from challenges.cloudflare.com only at those moments. |
IP address and browser signals; no tracking cookies |
| Cloudflare (Realtime TURN) | Relays party voice chat audio between browsers, only when you use voice chat, so players never connect to each other directly. | IP address; the encrypted audio stream in transit (not recorded) |
| GitHub and archive.org (optional) | Only if you choose the optional “Modern” art and music set: your browser downloads sprites and cries from PokeAPI repositories on GitHub and soundtrack uploads from archive.org. We do not send them any data; they see the request your browser makes, under their own privacy policies. | IP address and ordinary browser request data |
We may also disclose data where the law requires it, or where it is necessary to protect players or the service against serious harm, such as reporting illegal content to the authorities.
6. International transfers
Resend, Render and Cloudflare are headquartered in the United States, so data handled by them may be accessed from or transferred to the US. These transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses included in those providers’ data processing terms. You can ask us for more information about these safeguards.
7. Staff access
- Game masters and administrators can view and edit save data to provide support, fix problems and enforce the Player Rules.
- For support and moderation only, staff can sign in to the game as a player with a staff “take over” tool, for example to see a problem exactly as you see it. Staff actions such as giving items or Pokémon and teleports are logged (see 2.3).
- Only a small number of operators have access to the servers themselves.
- Staff never need your password or codes and will never ask for them.
8. Storage on your device
The game keeps some information in your browser’s storage on your device. All of it is strictly necessary for the game or for a setting you chose, so no consent banner is needed. None of it is used for tracking, and the game sets no cookies for players.
| Name | Type | Purpose |
|---|---|---|
pokeroamers-autologin | localStorage | Your trainer name and login token, only if you ticked “Stay signed in”. Removed when you log out. |
pokeroamers-stay | localStorage | Remembers whether the “Stay signed in” box is ticked. |
pokeroamers-res | localStorage | Your display resolution setting. |
pokeroamers-muted, pokeroamers-vol-* | localStorage | Your sound and volume settings. |
pokeroamers-binds | localStorage | Your key bindings. |
pokeroamers-turbo | localStorage | The speed toggle available to authorised testers. |
pokeroamers-radio-knob | localStorage | The station the in-game radio was last tuned to. |
pokeroamers-voice-muted | localStorage | Party members you muted in voice chat. |
pokeroamers-shell-* | Cache Storage | An offline copy of the game client, kept by a service worker so the game loads quickly. |
pokeroamers-art-* | Cache Storage | Cached copies of game files downloaded from our site, so they are not downloaded again. |
proam-rom-art-v1 | Cache Storage | The graphics and sounds built from your ROMs, and your art preferences. |
proam-rom-files-v1 | Cache Storage | Your ROM files, only if you chose “Remember these ROM files on this device”. |
You can remove all of this at any time by clearing the site data for pokeroamers.com in your browser’s settings. You will then need to sign in again and rebuild the game’s graphics and sounds from your ROMs.
9. Your rights
Under the GDPR you have the following rights. Many of them you can use yourself, in the game, without contacting anyone.
9.1 Access and portability
In the game, open ⚙ Settings → 👤 Account → “Download my data” to download a copy of your account and game data as a JSON file.
9.2 Erasure
In the same panel, “Delete account” deletes your account and game data immediately and permanently. You need to confirm with your password, and with a two-factor code if you have two-factor sign-in turned on. Deleted data disappears from our backups within 14 days.
One thing deletion cannot undo: a Pokémon you traded to another player keeps your trainer name as its original trainer, because it now belongs to that player’s save.
9.3 Rectification
You can change your email address and password in the game under ⚙ Settings → 👤 Account. For other corrections, email us.
9.4 Restriction and objection
You can ask us to restrict processing of your data, or object to processing based on our legitimate interests, by emailing legal@pokeroamers.com.
9.5 How we handle requests
We answer email requests within one month. To protect your account, we may ask you to prove that you own it, for example by sending the request from the account’s email address.
9.6 Complaints
If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to a data protection authority, either in the EU country where you live or in Greece:
Hellenic Data Protection Authority(Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifisias 1-3, 115 23 Athens, Greece
Website: www.dpa.gr
Phone: +30 210 6475600
10. Children
- You must be 18 or older to play, or between 13 and 17 with the permission of a parent or legal guardian who accepts the Terms on your behalf and is responsible for your account. (In Greece, the age from which a young person can give their own consent to online services is 15.)
- Children under 13 may not have an account. If we learn that a child under 13 has one, we delete it.
- Parents and guardians can contact us at legal@pokeroamers.com to ask about, obtain or delete their child’s data. We may ask for information showing that you are the child’s parent or guardian and that the account is theirs.
11. Security and breaches
- All connections to the game are encrypted with TLS.
- Passwords are hashed with scrypt; login tokens, recovery codes and emailed codes are stored only as hashes.
- You can protect your account further with two-factor sign-in using an authenticator app.
- Sign-in attempts, signups and code requests are rate-limited, and only a small number of operators have server access.
- No system is perfectly secure. If a personal data breach happens, we notify the Hellenic Data Protection Authority within 72 hours where the law requires it, and tell affected players without undue delay when the breach is likely to put them at high risk.
12. Changes to this policy
We may update this policy when the game or the law changes. The version date is shown at the top of this page. We announce material changes in the game or on the site, and where they come with updated Terms we ask you to accept them on your next sign-in. Previous versions are available on request.
13. Contact
For any privacy question or request, email the PokeRoamers team at legal@pokeroamers.com. Please include your trainer name, and send the email from your account’s address if you can.