Privacy policy

Last updated: 25 October 2026

pokee.si is made by a family, for families. This page explains in plain English what information the site uses and what it does not.

The short version, for kids and grown-ups

No cookies. No third-party analytics. We count page views ourselves, without identifying anyone.
You can use almost everything without an account. Your progress then stays on your own device.
A cloud-save trainer is just a nickname, a 4-digit number and a secret PIN. No email, no real name, no photo.
Never put your real name, school or address in a nickname or a message to other people.
If you are under 13, ask a grown-up before making a trainer or sending us a message.
You can delete your cloud account whenever you like, and it goes away.

Who runs this

pokee.si is a small hobby site run by a parent in England, UK, together with their son. The parent is the “controller” of the information described here under UK data protection law (UK GDPR and the Data Protection Act 2018). To ask a question about your data, use our contact page.

What we collect and why

On your own device (no account needed)

Settings, XP, belts, caught and seen Pokémon, game scores and Quest progress are saved in your browser’s local storage on your own device. We do not see this. It is not a cookie, it is not sent anywhere unless you make a cloud-save trainer, and you can clear it from your browser at any time. The Settings page can also reset your progress on this device.

If you install the site or choose to download it for offline use, files such as pictures and sounds are kept in your browser’s cache so the site works without internet. These are the same files anyone gets from the site. They hold nothing about you.

A cloud-save trainer (optional)

If you make a trainer so your progress follows you to other devices, we store:

your nickname, the 4-digit number we give it (like Ash#4821), and when the trainer was made and last used;
your PIN, but only as a salted, scrambled value (a “hash”). We cannot read your PIN, and there is no email, so we cannot reset it;
a sign-in token for each device, also stored scrambled, which expires after 180 days (we keep at most 10 per trainer);
a note of wrong PIN tries from the last 15 minutes, so we can block guessing after 5 wrong tries;
your saved progress (up to 64 KB), your XP earned each week, and your best game scores.

If you choose “Who’s playing?” or a reading level, that choice (one small number, never an age or a birthday) is kept with your save so it follows you to other devices.

We use this to give you cloud save and to run the optional crews. A crew is a private group joined with a 6-character code. Other trainers in the same crew can see your nickname and number and your leaderboard scores. There is no chat and nothing is public outside the crew.

The microphone in Say it back (optional)

If you use the optional microphone in Say it back, your voice is recorded only while you press the button and played back on your own device. It is never uploaded, stored or shared: the recording lives in the page’s memory and is deleted when you record again or leave the page.

The contact form

If you use the form on the contact page, we receive your name, your email address, the topic, your message, the page you were on and the time. This is emailed to the site owner so we can reply. It is not saved in the site’s database, but it sits in the owner’s email inbox like any email, until deleted. Email sent to us directly is the same.

pokee.si Plus (optional, paid by a grown-up)

When a grown-up subscribes, they pay on Stripe’s own secure page. Stripe takes the payment details (card number and so on) and may ask for an email address. pokee.si never sees or stores card details. What we keep against the trainer is a Stripe customer reference, a Stripe subscription reference, the subscription status and the date it is paid up to. Plus given by an owner access code is stored as a record of which code was used and until when. The codes themselves are stored scrambled (hashed), not readable. We also keep Stripe’s event reference numbers for up to 30 days, so the same payment message is not applied twice.

Gifts. When a grown-up buys a gift, we keep the Stripe Checkout session reference, the trainer who bought it, the number of months, and a scrambled copy of the code. The readable code is kept encrypted only until it has been shown, and is deleted after the 30-minute viewing window.

Family codes. For a family code we keep which subscriber made it and which trainer used it.

Classroom licences. For a licence we keep the trainer that holds it, the type, the number of pupil places and the start and end dates, and for each payment the Stripe Checkout session reference, the amount and the currency. For each class code we keep the name the teacher gave it (such as “Year 4 club”), how many places it has and how many are used, a scrambled copy of the code, and an encrypted readable copy that only the holder can open. When a pupil uses a class code we keep which trainer used which code, so their Plus can be checked. The teacher sees only how many places are used, never which trainers used them. Pupils make their own trainers, so please help them pick made-up nicknames.

Your country and the price. Cloudflare tells our code which country a visit comes from. We use it to pick the currency (pounds, euros or US dollars). We also include the country in the anonymous daily page-view totals described below.

Our own page-view counts

We count page views ourselves to understand which parts of the site people use and how they find us. Each page sends a small message to pokee.si with only the page, the website that linked here (just its hostname, never the full link), and a broad device type: phone, tablet or computer. Cloudflare adds a country code. Links from our own site leave the referring-website field blank. We keep names from a short list of well-known public websites, such as search engines and social networks. Other linking websites are grouped as “other”.

We add these to daily totals. The totals contain no IP addresses, user agents, cookies, account or device IDs, or anything that identifies a person. The saved totals do not include individual visit records or link one page view to another. Page names leave out anything after a question mark or hash sign, and any part of the address that changes from page to page (such as a Pokémon’s name). Automated browser tests are skipped when the browser identifies itself as a test.

To stop this counter being flooded, the server briefly uses your IP address in memory to limit how often it accepts a count. This temporary limit and the IP address are never written to our database or logs.

These are page-view totals, not a count of unique people: reloading or returning to a page can add another view, and some bots may still be counted. Only the site owner can read the totals through a private administrative tool.

Technical information

Like every website, our host (Cloudflare) sees your IP address and basic request details when you visit, to deliver the site and keep it secure. We do not turn on Cloudflare’s request logging for the site’s code. To limit abuse we keep short-lived counters (for example, how many trainers or messages came from one place in an hour). The “place” is your IP address run through a one-way scramble and shortened, so it is not stored as an IP address. These counters are tidied away automatically, usually within a couple of days. Cloudflare also gives us overall traffic counts (how many visits each page had, and from which country), worked out on its servers without cookies or scripts in your browser. We use them only as totals. Fan votes on the Who Is the Best? pages are anonymous counts: we keep only the totals, and to rate-limit voting and allow one vote per matchup a day we keep the scrambled network address with the matchups it voted on (not which side it picked) for 2 days.

What we do not do

We use no third-party advertising or analytics scripts (no Google Analytics, no Meta pixel, no similar tools). Our own small page-view counter and Cloudflare’s server totals are described above.
The site sets no cookies and loads no third-party scripts, fonts or images. All pictures, sounds and fonts come from pokee.si itself.
We do not build profiles of you, track you across other sites, or use your information to decide things about you.
We do not sell or rent information, and we do not use it for marketing. We have no mailing list because we do not collect emails for one.
We do not ask for your precise location or use your camera. The microphone is used only if you choose it in Say it back, and the recording never leaves your device (see above).

The pokee.si Support page has an optional link to Buy Me a Coffee. If a grown-up follows it they leave pokee.si, and Buy Me a Coffee’s own privacy policy applies there.

Our legal reasons

UK GDPR says we need a lawful reason for using information. Ours are:

Providing what you asked for (contract): running your cloud-save trainer, crews, and Plus.
Our legitimate interests: keeping the site secure and stopping abuse (the PIN guess limit, the scrambled counters), and replying to people who write to us. We have weighed these against your rights, and keep the information small for that reason.
Legal duty: keeping the payment and tax records that the law asks for, which are held with Stripe and the owner’s accounts.

Saving settings and progress on your own device is something you asked the site to do, so it does not need a separate consent banner. We do not rely on consent for anything else, which is why there are no cookie or consent pop-ups.

Children

pokee.si is made for children and families, so we follow the ICO’s Age Appropriate Design Code (the Children’s Code). In practice:

The settings that protect you are the default. Nothing is switched on that shares your information.
Cloud save is optional. It needs no email, no real name and no date of birth.
There is no profiling and there are no nudges to stay longer or spend money.
Other people see only a nickname and number, and only if you join a crew. Names are checked against a list of unsuitable words. There is no chat and no free-text sharing.
Buying Plus always goes through a grown-up check and then Stripe’s secure page. Children should never buy anything without a grown-up.
If you are under 13, ask a grown-up before making a trainer or sending us a message. Please do not put your real name, school, address or photo in a nickname or message.

If you think a child has told us more than they should, please contact us and we will remove it.

How long we keep it

Cloud-save trainer and its save, scores and crew places: until you delete the trainer. We do not currently remove idle trainers automatically.
Sign-in tokens: up to 180 days, or until you sign out.
Wrong-PIN notes: cleared after 15 minutes, or when you next sign in.
Abuse-limit counters: a day or two, then tidied away automatically.
Our page-view counts: anonymous daily totals are kept so we can compare how pages are used over time. We keep these totals for up to two years. There are no individual visit records to keep.
Classroom licence records: the licence and its payment records stay until the licence has ended and they are no longer needed for tax (up to six years). A pupil’s link to a class code goes when the pupil’s trainer is deleted.
Plus records on our side: until you delete the trainer. Stripe and the owner keep payment records for as long as UK tax law requires (currently up to six years).
Contact messages: kept only while needed to reply and to keep a record of what was asked, then deleted, normally within a year.

Your rights

Under UK data protection law you can ask to see the information we hold about you, have mistakes fixed, have it deleted, limit or object to how we use it, and take a copy. Grown-ups can use these rights for their child.

Delete it yourself. Open Trainer profile, find “Delete my cloud account” under your account, and enter your PIN. This removes your nickname, PIN hash, cloud save, scores, weekly XP, crew places, sign-in tokens, Plus records and the link to your Stripe customer reference from our database. If you have a live Plus subscription, cancel it first (on the Plus page, “Manage subscription”), then delete. Progress saved on your own device stays until you clear it.

Stripe keeps its own payment records for legal reasons, and a message you sent us stays in the owner’s inbox until deleted. To have a message deleted, or to ask for anything else here, contact us.

Because trainers have no email, we cannot prove who owns a nickname if the PIN is lost. We may need to ask you to show that the trainer is yours before sharing or deleting anything, and if we cannot do that safely we may have to say no.

If you are unhappy with how we use information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

The site uses HTTPS. PINs and sign-in tokens are stored only as one-way scrambled values. Wrong PIN guesses are limited to 5 per 15 minutes. Our payment pages are run by Stripe. Please choose a PIN that is not easy to guess and keep it to yourself. No system is perfect, and if something goes wrong that affects your information we will tell you and the ICO as the law requires.

Changes

If what we do changes, we will update this page and the date at the top. If a change matters to you in a big way, for example if we ever added third-party analytics or ads, we will make that clear on the site first. Our Terms explain the rules for using pokee.si and Plus.