Privacy Policy
Last updated 14 November 2026
KantoDex is a free, non-commercial fan site for tracking Pokémon card collections. This page explains what data the site keeps, why, and what you can do about it. The short version: we keep the minimum needed to save your collection, we don't track you, we don't show ads, and we never sell anything.
Who runs KantoDex
KantoDex is run by Kanto, an individual collector, who is the controller of the personal data described here. You can reach us with the contact form at the bottom of this page.
What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Your username and password. The password is stored only as a secure hash by our login provider, and nobody at KantoDex can see it. Your password-recovery code is stored the same way, only as a secure hash. Behind the scenes the login system uses an address like username@users.kantodex.app as an internal ID. It isn't a real email address and nothing is ever sent to it. | To let you log in and keep your collection safe. |
| Your collection | Which cards you've marked as collected (English, Japanese or Chinese), the prices you paid, your notes and which card version your binder shows. | This is the service itself: saving your progress so it's there whenever you log in, on any device. |
| Card suggestions | Card details, notes and images you send with “Suggest a card” or “Suggest a fix”, linked to your account. | So the admin can review them and keep the checklist accurate. |
| Bug reports and suggestions | What you write in “Report a bug” or in a set or idea suggestion, linked to your account if you’re logged in. If you leave the box ticked, also your browser type, screen size and which binder and tab you were on. | To find and fix problems on the site. |
| Contact messages | What you write in the contact form, plus your username or email if you choose to give them. | To answer you. |
| Technical logs | Your IP address, browser type and the time of requests, kept in our hosting providers' server and login logs. | To run the site securely and stop abuse. |
We don't ask for your real name, email address, date of birth or location to use KantoDex.
Stored on your own device
KantoDex uses your browser's local storage, not tracking cookies, for things that only make the site work: keeping you logged in, a copy of your collection so the app works offline (removed when you log out), your collection if you use the site without an account, and preferences such as sound, binder choice and page size. You can clear these at any time in your browser or with Settings → Account. There's no advertising and no third-party tracking. Fonts and code libraries are served from kantodex.app itself, so loading the site doesn't contact Google or other outside services. The one exception is card prices: to show them, your browser asks TCGdex (api.tcgdex.net), a free Pokémon card database, for the price of the cards you're looking at. Like any website, TCGdex sees your IP address when your browser contacts it, but KantoDex sends it nothing about you or your collection. Price links open Cardmarket only when you tap them.
Legal basis
- Providing the service you ask for (GDPR Art. 6(1)(b)): your account, collection and suggestions.
- Legitimate interests (Art. 6(1)(f)): keeping the site secure, preventing abuse and answering messages you send us.
Who processes the data
We use two service providers that process data on our behalf:
- Supabase: database, login and contact-form messages. Your account and collection are stored in Supabase's EU region in Stockholm, Sweden.
- Cloudflare: hosts the website and handles its domain name (DNS). Cloudflare is a US company, so some technical data may be processed in the United States under the safeguards the EU recognises for such transfers, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
Nobody else gets your data. We don't sell, rent or share it for marketing. The admin can access the database to maintain the site, but never uses your data for anything except running KantoDex.
How long we keep it
- Account, collection and suggestions: until you delete your account. Deleting it removes them from our database straight away. Photos from suggestions that were approved stay on the site as card art, but they're no longer linked to you.
- Contact messages: until your question is handled, and no longer than 12 months.
- Bug reports: until the problem is fixed, and no longer than 12 months. If you delete your account, your reports stay but are no longer linked to you.
- Technical logs: for the short periods our providers keep them, usually days to a few weeks.
Your rights
Under the GDPR you can:
- Get a copy of your data. Settings → Download spreadsheet gives you your whole collection at any time.
- Correct it: edit your ticks, prices and notes directly on the site.
- Delete it: Settings → Account → Delete my account removes your account and collection permanently.
- Object to or restrict how we use it, or ask anything else, through the contact form.
- Complain to the data protection authority in the country where you live, if you think we've handled your data wrongly. We'd appreciate the chance to fix it first through the contact form.
Children
KantoDex is for everyone who loves Pokémon cards. If you're under 13, please ask a parent or guardian before creating an account. Accounts don't need any personal details beyond a username.
Changes
If this policy changes, we'll update the date at the top. Important changes will also be mentioned on the site.
Contact
For privacy requests or any questions, send a message here. If you'd like an answer by email, include your address. It's only used to reply.