Skip to content
VGC TeamReport

Privacy Policy

Last updated: April 2026

What is this Privacy Policy?

This Privacy Policy explains how VGC Team Report, operated by Manraj Sidhu ("we", "us", "our"), collects, uses, stores, and protects your personal data when you use our website at pokemonvgcteamreport.com.

VGC Team Report is a free community tool for competitive Pokémon players. We are the data controller for the personal data we process and are committed to complying with the UK and EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

If you have any questions about this policy or your data, contact us at privacy@pokemonvgcteamreport.com.

What data do we collect?

We collect only the data necessary to provide and improve VGC Team Report. Below is each category of data, what it includes, and the legal basis under GDPR Article 6 for processing it.

  • Account data(email address, OAuth identity via Clerk) — Collected when you sign in. Used to link reports to your account and provide authentication.
    Legal basis: Art 6(1)(b) — necessary for contract performance (providing the service you signed up for).
  • Team report data(team pastes, notes, matchup plans) — Stored when you create or share a report so others can view it via its unique URL.
    Legal basis: Art 6(1)(b) — necessary for contract performance (delivering the core functionality you requested).
  • Analytics data(page views, feature usage, referrer, country via Vercel Analytics and PostHog) — Usage data collected to understand traffic patterns, feature adoption, and improve the app. PostHog analytics are linked to your account when signed in (identified profiles only) to provide a better experience; anonymous visitors are not tracked individually.
    Legal basis: Art 6(1)(f) — legitimate interest (understanding usage to improve the service); Art 6(1)(a) — consent when cookie consent is granted for non-essential analytics cookies.
  • Redis cache data(session tokens, rate-limit counters via Upstash) — Temporary data used to manage sessions and prevent abuse.
    Legal basis: Art 6(1)(b) — necessary for contract performance (maintaining your session and protecting the service).
  • Feedback submissions(bug reports, feature requests, ideas) — Collected when you voluntarily submit feedback through the app.
    Legal basis: Art 6(1)(f) — legitimate interest (improving the product based on user feedback).
  • Local storage data(drafts, preferences, edit tokens) — Stored in your browser's local storage. This data never leaves your device unless you choose to share a report. We do not process this data on our servers.

How long do we keep your data?

We retain your data only as long as necessary for the purposes described above. Here are the specific retention periods:

  • Shared reports— Stored indefinitely while your account exists. Purged immediately when you delete your account.
  • Account data— Held for the life of your account. Deleted within 30 days of an account deletion request.
  • Analytics data— Retained for 12 months by Vercel and PostHog. We do not store analytics data independently outside these services.
  • Redis cache data— TTL-based, typically purged within 24 hours.
  • Feedback submissions— Retained indefinitely for product improvement. Submitter identity is anonymised on account deletion (email and name nulled; feedback content preserved).
  • Clerk authentication data— Deleted within 30 days of account deletion.

Who do we share your data with?

We use the following third-party service providers (processors) to operate VGC Team Report. Each processor has signed a Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) for EU-US data transfers.

  • Clerk — Authentication and identity management. View Clerk DPA
  • Vercel — Hosting, deployment, and web analytics. View Vercel DPA
  • Neon — PostgreSQL database for storing shared reports and account data. View Neon DPA
  • Upstash — Redis cache for session management and rate limiting. View Upstash DPA
  • PostHog — Product analytics and feature usage tracking (EU-hosted). View PostHog DPA
  • Pokemon Showdown— Sprite images are loaded client-side from play.pokemonshowdown.com. No personal data is transferred to this service.

We do not share your personal data with any other third parties, advertisers, or data brokers.

What are your rights?

Under GDPR, you have the following rights regarding your personal data. We will respond to all requests within 30 days.

  • Right to access (Art 15)— Request a copy of the personal data we hold about you. Email privacy@pokemonvgcteamreport.com.
  • Right to data portability (Art 20)— Export your data using the data export feature in your account dashboard.
  • Right to erasure (Art 17)— Delete your account and all associated data using the account deletion feature in your account dashboard.
  • Right to rectification (Art 16)— Update your information via your Clerk account settings, or email us to request corrections.
  • Right to restrict processing (Art 18)— Contact us to request that we limit how we process your data.
  • Right to object (Art 21)— Contact us to object to processing based on legitimate interest.
  • Right to lodge a complaint— You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. EU residents may contact their local data protection authority.

Do we sell your personal information? (CCPA)

VGC Team Report does not sell, rent, or trade your personal information to third parties. If you are a California resident, we affirm that we do not sell personal information as defined under the California Consumer Privacy Act (CCPA). The processors listed above act as service providers under CCPA — they process data on our behalf under written agreements and are prohibited from using your data for their own commercial purposes.

Pokémon Trademark Notice

VGC Team Report is an independent fan project and is not affiliated with, endorsed by, or sponsored by The Pokémon Company, Nintendo, Game Freak, or Creatures Inc. Pokémon and all related names, characters, and imagery are trademarks and © of their respective owners. This site is a free community tool for competitive Pokémon players and does not generate revenue from Pokémon intellectual property.

Cookies

VGC Team Report uses a cookie consent system to manage your preferences. We use the following types of cookies:

  • Strictly necessary cookies— Authentication session cookies managed by Clerk. These are essential for the service to function and are exempt from consent requirements.
  • Analytics cookies— Vercel Analytics and PostHog cookies are only set when you grant consent through our cookie banner. PostHog uses cookies to link page views into sessions and identify returning users. You can change your preferences at any time using the "Cookie Settings" link in the footer.

Changes to this policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated "Last updated" date. We encourage you to review this page periodically. Continued use of VGC Team Report after changes constitutes acceptance of the updated policy.

Contact

For any questions, concerns, or data rights requests related to this Privacy Policy, please contact us at privacy@pokemonvgcteamreport.com.