Privacy policy

What we collect

• Your sign-in identity. When you sign in with Discord we receive your Discord user ID, display name and avatar. With Google we receive your Google account ID, name, email address and profile picture. We never see or store a password.
• The games you submit. The replay link you paste, and the replay itself, which we fetch from Pokémon Showdown's replay server, and which player you were in it.
• Your teams. For a game without open team sheets, the team you paste. We keep it in your account so we can suggest it the next time it fits a game you submit.
• Feedback you send. What you write about a review, which review and turn it's about, and whether you let us open that review: if you do, we can view it to look into your feedback.
• Your Showdown names. When you tell us which player you were, we remember that name as yours, so next time we know which side is you.
• Your reviews. The review Stockkarp produces for each game, and a record of it (when it was made, the players, the format, its result) so you can find it again.
• Session data. A session record so you stay signed in, including when it was created and last used, and your browser's user-agent string.

We don't use advertising or analytics trackers, and we don't sell or rent your data.

Why

To sign you in, to review the games you submit and keep those reviews for you, to enforce daily review limits, and to keep the service secure and working. Your saved teams and Showdown names are used only to review your games and to fill in those choices for you.

Model training

Stockkarp's model will never be trained on your private reviews, your submitted games or your teams.

Who processes data for us

• Fly.io hosts the website.
• Modal runs the reviews: the replay and any team you paste are sent there to be analysed.
• Cloudflare provides DNS and the network in front of the site, and stores finished reviews (R2).
• PlanetScale hosts the database of accounts, sessions and review records.
• Discord and Google, when you choose them to sign in. We also send ourselves short alerts in a private Discord channel when someone signs up, submits a game or sends feedback, or a review fails: they include your display name, the game's player names and any feedback you wrote, never a private replay's link.

Pages also load fonts from Google Fonts, Pokémon images from Pokémon Showdown and a script library from unpkg. Those services receive your IP address when your browser fetches them, as with any website that uses them.

The browser extension

Stockkarp for Showdown is optional. It does nothing until you click its Review with Stockkarp button, and then sends Stockkarp only what that review needs: the game's replay link (a private replay's link includes its password), which player you were and your Showdown name, and for a game without open team sheets your six as the battle knew them (species, item, ability, moves, stats) plus any of your Showdown teambuilder teams with the same six Pokémon, so we can use the one you played. To upload the replay it sends Showdown the same command as Showdown's own replay button. It signs in with a token of its own, made when you connect it; you can disconnect it from the extension or your Account page. It reads nothing on other websites and keeps only that token in your browser.

Cookies and local storage

• sk_session: keeps you signed in (30 days, or until you sign out).
• sk_oauth: holds a sign-in in progress (10 minutes).
• Your theme choice (light or dark) is kept in your browser's local storage, on your device only.

These are needed for the site to work. There are no advertising or tracking cookies.

Who can see your reviews

Your reviews are visible only to you, unless you create a share link: anyone with that link can read that review, until you stop sharing it. Reviews of private Showdown replays are private by default in the same way.

How long we keep it

Reviews and their records, and your saved teams and Showdown names, are kept until you ask us to delete them or delete your account. Sessions end after 30 days or when you sign out. To enforce daily review limits, each review also records a one-way hash of the sign-in and email it was made with (no names, nothing readable); these are deleted after two days, including after you delete your account. Server logs kept by our providers are retained for their standard periods.

Your choices

You can sign out at any time and stop sharing any review. On your Account page you can remove your saved teams and remembered Showdown names, and delete your account: that deletes your account, your reviews and their share links, your teams and your names, and the stored copies of your reviews. Copies in our providers' backups expire on their own schedule. To get a copy of your data, or for anything else, write to [email protected]; we'll act on requests within 30 days. You can also remove Stockkarp's access from your Discord or Google account settings.

Security

Connections are encrypted, session tokens are stored only in hashed form, and each part of the service holds only the access it needs. No system is perfectly secure, but we'll tell affected users promptly if a breach affects them.

Children

Stockkarp isn't directed to children under 13, and we don't knowingly collect their data. If you believe a child has signed up, contact us and we'll delete the account.

Changes

If this policy changes, we'll update the date above, and for significant changes we'll let signed-in users know.