Privacy Policy

Your teams are yours. We keep things simple.

What we collect

Teams you create. When you create a team on crob.at, the team data (Pokémon, movesets, items, EVs) is stored on our server so the link works when someone opens it. Public teams may appear in the gallery and search; unlisted teams are accessible through their direct link but are excluded from discovery. Creators can change a team's visibility using their signed-in account or the private management capability stored in the browser that created it.

Usage and reliability data. We use self-hosted Plausible to understand aggregate page and feature usage without analytics cookies or account identifiers. We also use a separate first-party journey system to measure whether the same browser returns and which broad product steps it uses. This system stores a random site-specific browser code and a 30-minute session code. Journey events contain only an allowlisted event name, a broad surface such as Teams or Pokédex, a broad source class, a bounded page type, a recognized Pokémon Showdown format when applicable, the event time, and up to 30 minutes of active visible-page time when a page closes. They do not contain account IDs, team IDs or slugs, team contents, search text, URLs, IP addresses, user agents, or free-form properties. The random code is never sent to Plausible and is never joined to account, billing, or marketing records.

Operational data. We keep short-lived operational request logs for security, reliability, and abuse prevention. Those logs contain a route pattern, response status, timing, country code, browser family, full user-agent string, and coarse referral class. User-agent strings can describe the browser, operating system, and device used for a request. To estimate use of the public API without counting crob.at's own interface, eligible external API calls may include a keyed anonymous caller code that rotates each month. It is not added to first-party interface calls or bots and cannot be linked across monthly periods. The logs do not contain query values, raw IP addresses, full referrers, cookies, or authorization headers. The abuse controls keep short-lived request counts in memory and can ask a browser to complete a security check. This state expires after 30 minutes and is not used for analytics. The sole exception is an error report when random-team generation fails: it may retain the selected Pokémon name and format so we can diagnose that failure. It is not used for analytics or added to request logs.

Account activity (optional). For signed-in accounts, we record a small first-party activity ledger for signup, visits, team creation, reopening, saving, copying, editing, and Pokémon Showdown clone outcomes so we can measure whether account features are useful across visits. It uses our internal numeric account and team IDs plus bounded product context such as the page surface, format, and outcome. It does not contain email addresses, handles, team contents, URLs, search text, IP addresses, browser fingerprints, or analytics session tokens. The account ledger and random browser journey code are kept separate and are never joined.

Account data (optional). If you create an account, we store your crob.at handle, email address, password hash, email-verification status, and session token. If you use Google login, we store the Google account identifier and email returned by Google. If you link Pokémon Showdown, we store your Showdown username and OAuth token so you can verify authorship and clone teams into your teambuilder. Your Showdown password is never handled by us.

What we don't collect

• No tracking cookies from our self-hosted Plausible analytics
• No Plausible analytics profiles tied to your account identity
• No permanent or cross-site journey identifier; the random browser code expires after 90 days
• No connection between the random browser code and account, billing, or marketing records
• No precise location data; operational logs may retain a country code
• No browsing history across sites

Data retention

Team links remain available when visibility changes; making a team unlisted removes it from crob.at discovery and asks search engines not to index it. Search engines or third-party caches may take time to update. Automated data refreshes do not delete published team URLs. Operational request logs are retained for no more than 30 days under normal operation. Raw browser journey events, daily browser records, and the random code stored in your browser expire after 90 days. Aggregated counts without the random code may be retained longer. The account activity ledger may be retained until the account is deleted or a shorter policy replaces this rule. You can request deletion by contacting us.

Cookies

A functional session cookie is set if you sign in. Short-lived security cookies can also be set to limit hostile automated traffic and remember a completed security check for up to 30 minutes. These cookies are strictly necessary and are not used for analytics. Our self-hosted Plausible analytics does not use cookies. The first-party journey system stores its random browser code and session code in local storage, not in cookies.

On pages where advertising is enabled, Google and its advertising partners may use cookies, local storage, IP-derived location, device information, or similar technologies to deliver, limit, personalize, and measure ads. Where required, advertising storage and personalized ads are disabled until you make a choice through the consent message.

Advertising

Some pages use Google AdSense to fund the site. Ads are kept separate from generator controls, navigation, and team actions. Google may process data as described in How Google uses information from sites or apps that use its services.

You can review or change advertising choices through the consent controls shown where required and through Google My Ad Center. Availability of personalized advertising depends on your region, consent choice, and age-related restrictions.

Journey analytics choice

Turning journey analytics off deletes the random code from this browser and stops future journey events. Events already stored on the server remain pseudonymous and are deleted by the 90-day retention process. Turning it on again creates a new unrelated random code.

Third-party services

We use self-hosted Plausible Analytics for aggregate page view counting. Our separate first-party SQLite journey database stores the bounded pseudonymous events described above. Google AdSense is used on pages where ads appear. Google login, Cloudflare Email Service password reset emails, and optional Pokémon Showdown linking are used only when you choose those account features.

Contact

If you have questions about this policy or want to request data deletion, reach out at [email protected] or visit our contact page.

Changes

This policy may be updated occasionally. The latest version will always be published at this URL.

Last updated: August 2026