Privacy

Last updated October 24, 2026.

Guest play

You can play without an account. Your browser stores your trainer name and random room-seat tokens so you can rejoin. Rooms, draft teams and battles are held in server memory and disappear when the server restarts or the room expires.

Accounts and teams

If you register, the server stores your username, an individually salted password hash, account creation time, preferred party size and the default teams you save. The database does not store your plaintext password. No email address is requested; password recovery is not currently available.

An account cookie keeps you signed in for up to seven days. It is HttpOnly, SameSite=Lax and Secure on the HTTPS site. The server stores a hash of the session token. Signing out revokes that session and clears the cookie.

Battle privacy

Other trainers in your room can see your trainer name, connection/ready status, side assignment and number of team picks. Your team species stay hidden during selection. Once every trainer locks their party, all parties are revealed during a shared four-second preview before the battle. Battle actions are revealed when the simulator resolves them. The full filtered battle log is available to each player; it is not a public replay service.

Hosting and storage

The site is hosted by Render. Account records, sessions and saved teams are kept on persistent server storage; deploying or restarting the game does not delete those records. Render may process network information, including IP addresses and service logs, to provide hosting. The application also uses temporary connection information for rate limiting and abuse prevention.

A legacy browser profile token may also be stored for the currently unavailable ranked/unranked system. Its local rating data is separate from username accounts. The current site does not offer public matchmaking or a public leaderboard.

Your controls

You can sign out and replace a saved default team. Clearing browser storage removes local room/profile tokens but does not delete server-side accounts or saved teams. Self-service account deletion and password recovery are not available yet. For account or privacy requests, contact the person operating the game.