Privacy policy
Last updated 6 August 2026 · data controller: [legal entity not configured]
What we collect from Discord
Signing in uses the identify and email scopes and nothing else. That gives us:
- Your Discord user ID — the stable key we store your account under
- Your username and display name
- Your avatar hash
- Your email address
We cannot see which servers you are in, read any message, or post as you. The token we receive does not carry those permissions. Your username and avatar refresh each time you sign in so the site does not show a stale profile.
What we collect when you buy
- Order records: plan, quantity, price, discount, status, timestamps
- The licence keys issued to you
- Which payment provider you chose and that provider's transaction reference
We never see your payment details. Card numbers and wallet logins are entered on the provider's own site, not ours, and crypto is paid from your own wallet to an address the processor generates. No card data touches this server, and there is nothing here for an attacker to take.
What the bot collects
The desktop software sends a hardware identifier (HWID) to the licensing server so a key binds to one machine, along with your IP address and the account name you chose inside the bot. It logs activity events — encounters, shinies, captchas — so the Discord integration can relay them to you.
The bot does not read your files, your browser, your keystrokes outside the game window, or anything about your machine beyond the identifier used for licence binding.
Diagnostics the bot sends about itself
When something inside the bot goes wrong, it reports that failure so we can fix it. Those reports are about the software's own behaviour and nothing else: what failed, where in the bot it failed, and which client version it happened on. We use them to repair faults and to improve how reliably the bot reads the game.
They carry nothing about you and nothing about your game. No PokéMMO login, no chat, no team or box contents, no keystrokes, no file contents, and nothing from any other program running on your computer. A report is tied to the licence session that produced it — that is the only way to tell one person's recurring fault from a hundred unrelated ones — but what is inside the report is our own code's output, not yours.
Most of these are a single line — a map coordinate and a number describing the ground there. A small number are not: when the bot cannot work out a route at all, it also attaches its own two log files, which record what it did and which part of the screen it was looking at. Those are the bot's own output, the same as everything else described here, and it sends at most a few of them per day.
Bug reports you send yourself are different, on purpose. The Report a Bug window attaches a screenshot of your screen as well as those logs, because a picture of the moment it went wrong is usually the only thing that makes a bug fixable. A screenshot is only ever sent that way — when you fill in that form and confirm it, never automatically and never in the background. If a screenshot at that moment would capture something you would rather not send, close the window instead of confirming it.
Why we hold it
- To deliver what you bought and show it back to you on your licences page
- To stop one key being used by ten people
- To handle refunds, disputes and support tickets
- To meet tax and accounting obligations on completed sales
Who else sees it
We share data with a small number of processors, each for one job:
- NOWPayments — to take Bitcoin and Litecoin payments. They receive the amount, currency and order reference, and generate the address you send to.
- Discord — for sign-in, and to grant the premium role while your licence is active.
- Resend — to send receipts and expiry reminders, if email is configured.
PayPal and Skrill are not on that list because we do not send them anything. Those payments are arranged directly between you and the owner over Discord, so whatever you share happens in PayPal's or Skrill's own service under their privacy terms, not ours. All we store is that you chose that method and, once it is confirmed, the reference you quoted.
We do not sell your data, we do not run advertising trackers, and there is no analytics script on this site.
Cookies
Two, both strictly necessary and neither used for tracking: a session cookie that keeps you signed in, and a short-lived signed cookie holding your pending basket so it survives the login step. That is the entire list, which is why there is no consent banner in your way.
How long we keep it
- Account and licence records: while your account exists
- Order records: seven years after purchase, for tax purposes
- Webhook payloads and audit logs: two years
- Rate-limit counters: minutes
Your rights
You can ask for a copy of your data, ask us to correct it, or ask for deletion. Deletion removes your account, profile and licences; order records tied to completed payments are retained where the law requires it, reduced to what that requires. Ask in Discord. We aim to respond within 30 days.
Security
Traffic is served over HTTPS. Licence keys are never written to logs in full — only the last four characters, enough to match a support ticket and useless to anyone who obtains the logs. Administrative actions are recorded in an append-only audit log.