Privacy Policy

Your teams are yours. We keep things simple.

What we collect

Teams you create. When you create a team on crob.at, the team data (Pokémon, movesets, items, EVs) is stored on our server so the link works when someone opens it. Public teams may appear in the gallery and search; unlisted teams are accessible through their direct link but are excluded from discovery. Creators can change a team's visibility using their signed-in account or the private management capability stored in the browser that created it.

Usage and reliability data. We use self-hosted Plausible to understand page and feature usage without analytics cookies or account identifiers. We also keep short-lived operational request logs for security and reliability. Those logs contain a route pattern, response status, timing, country code, coarse browser family, and coarse referral class. To estimate use of the public API without counting crob.at's own interface, eligible external API calls may include a keyed anonymous caller code that rotates each month. It is not added to first-party interface calls or bots and cannot be linked across monthly periods. The logs do not contain query values, raw IP addresses, full referrers, cookies, authorization headers, or full user-agent strings.

Account activity (optional). For signed-in accounts, we record a small first-party activity ledger for signup, visits, team creation, reopening, saving, copying, editing, and Pokémon Showdown clone outcomes so we can measure whether account features are useful across visits. It uses our internal numeric account and team IDs plus bounded product context such as the page surface, format, and outcome. It does not contain email addresses, handles, team contents, URLs, search text, IP addresses, browser fingerprints, or analytics session tokens. Logged-out visitors are not assigned a crob.at analytics identifier.

Account data (optional). If you create an account, we store your crob.at handle, email address, password hash, email-verification status, and session token. If you use Google login, we store the Google account identifier and email returned by Google. If you link Pokémon Showdown, we store your Showdown username and OAuth token so you can verify authorship and clone teams into your teambuilder. Your Showdown password is never handled by us.

What we don't collect

• No tracking cookies from our self-hosted Plausible analytics
• No Plausible analytics profiles tied to your account identity
• No permanent analytics identifier for logged-out visitors; the public API caller code, when present, rotates monthly
• No precise location data; operational logs may retain a country code
• No browsing history across sites

Data retention

Team links remain available when visibility changes; making a team unlisted removes it from crob.at discovery and asks search engines not to index it. Search engines or third-party caches may take time to update. Automated data refreshes do not delete published team URLs. Operational request logs are retained for no more than 30 days under normal operation. Aggregated analytics and the account activity ledger may be retained longer to compare product usage over time. You can request deletion by contacting us.

Cookies

A functional session cookie is set only if you sign in, and it is strictly necessary for authentication. Our self-hosted Plausible analytics does not use cookies.

On pages where advertising is enabled, Google and its advertising partners may use cookies, local storage, IP-derived location, device information, or similar technologies to deliver, limit, personalize, and measure ads. Where required, advertising storage and personalized ads are disabled until you make a choice through the consent message.

Advertising

Some pages use Google AdSense to fund the site. Ads are kept separate from generator controls, navigation, and team actions. Google may process data as described in How Google uses information from sites or apps that use its services.

You can review or change advertising choices through the consent controls shown where required and through Google My Ad Center. Availability of personalized advertising depends on your region, consent choice, and age-related restrictions.

Third-party services

We use self-hosted Plausible Analytics for anonymous page view counting. Google AdSense is used on pages where ads appear. Google login, Cloudflare Email Service password reset emails, and optional Pokémon Showdown linking are used only when you choose those account features.

Contact

If you have questions about this policy or want to request data deletion, reach out at [email protected] or visit our contact page.

Changes

This policy may be updated occasionally. The latest version will always be published at this URL.

Last updated: July 2026