Privacy

The data controller is HEM (Norwegian sole proprietorship, org. no. 924 807 342, Folke Bernadottes vei 6, 0862 Oslo, Norway). Contact: [email protected]. Questions, access requests and deletion requests go to that address.

• Teams and builder goals are saved in your browser's localStorage (eve:teams, eve:builder:goals). They never leave your device unless you sign in and sync.
• Share links of the form /#team=… carry the team inside the link itself. The part after # is not sent to our server.
• Replay review: when you paste a replay link, our server fetches that replay from replay.pokemonshowdown.com to analyse it. It is kept only in server memory, for up to 24 hours as a cache, and never written to the database.
• Eve sets no cookies unless you sign in. (Cloudflare may set a strictly necessary security cookie if it has to challenge a suspicious request.)

Signing in is optional and only needed for sync, server share links, game history and pairing the extension. We store:

• Your email address and the time of your last sign-in. Sign-in uses one-time codes sent by email; we store only a hash of each code. Codes and their email address are deleted by a daily cleanup about a day after they expire.
• A session cookie (httpOnly, strictly necessary for being signed in). The server stores only a hash of it, plus a shortened browser User-Agent so you can recognise your sessions. Sessions expire after 30 days without use.
• Your synced teams. Deleted teams leave a marker for up to 90 days so your other devices learn about the deletion.
• Server share links (/s/…) you create. Anyone with the link can see that team. Deleting the link revokes it.
• Showdown names you verified, with the Showdown account type and verification time.
• Paired extensions: a hash of the access token, its name and User-Agent, and when it was last used. Tokens expire after 180 days without use.
• Game history (only if you use the extension's game tracking, below).

To stop abuse (for example, sign-in code spam), we count requests per IP address, email address or account in short windows (one minute to 24 hours). The counter key stores a SHA-256 hash instead of the raw IP or email. That is pseudonymisation, not anonymisation: a hash of an IP address can be reversed by trying every address, so we treat these keys as personal data. Expired counters are deleted by the daily cleanup, so none is kept longer than about two days. Your IP address is not stored anywhere else by the app.

• What it reads. It runs only on play.pokemonshowdown.com. There it reads the battle messages Showdown sends to your browser, and only for Pokémon Champions VGC battles. Its page script passes on only battle protocol lines (moves, switches, damage, teams, results); battle chat, joins, leaves and renames of spectators, HTML messages, other rooms and private messages are dropped in the page and never reach the rest of the extension. It also reads which Showdown name you are logged in as.
• Without pairing, all calculations run locally in your browser. The only request it makes is to download public meta data (common sets and spreads) from eve.hemlig.no, without your account or token (like any web request, the server sees your IP address).
• Pairing links the extension to your Eve account (you approve it on eve.hemlig.no). Verifying your Showdown name asks Showdown's login server, from your Showdown tab, for a one-time signed proof of your name and sends it to Eve. The extension never reads your Showdown password or cookies, and never sends them to Eve.
• Game tracking runs only when the extension is paired, your Showdown name is verified, and tracking is on (it can be paused in the popup or in /account/games). Then, for each Champions VGC game you play (not games you spectate), it sends to eve.hemlig.no: the battle id and format, your side and Showdown name, the battle log (moves, damage, switches, both players' Showdown names and teams, your own team data from Showdown, rating changes), whether the game finished, the replay link if you save one, the capture time, the extension version and which Showdown client you use (classic or new). The log is filtered again before sending, so it holds battle protocol only. Your opponent's Showdown name, team and rating are part of every recorded game (see the legal basis below).
• Where it sends data. Only to eve.hemlig.no (and play.pokemonshowdown.com's own login server for name verification). Nothing else.
• What it stores locally (chrome.storage, on your computer): your settings, the access token and your verified Showdown names after pairing, games waiting to upload (dropped after 14 days), the last uploaded games for up to 6 hours (to attach a replay link), and cached meta data. Unpairing deletes the token and the upload queue here (revoke the token in /account to invalidate it on the server too); removing the extension deletes everything it stored.

• Hetzner Online GmbH hosts the app and the database on a server in Germany.
• Cloudflare, Inc. sits in front of the site (DNS, TLS, protection against attacks). It sees your IP address and the requests you make while they pass through.
• Purelymail (Add Rabbit LLC) sends the sign-in emails, so it receives your email address and the code.

Cloudflare and Purelymail are based in the United States, so this data may be processed outside the EEA. For Cloudflare the transfer is covered by the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses as fallback, under Cloudflare's data processing agreement. We use no other services: no analytics, no advertising, no error-tracking service, no fonts or scripts loaded from third parties.

• Account, sync, share links, pairing and game history: to provide the service you asked for (GDPR Art. 6(1)(b)).
• Rate limiting, session security and Cloudflare protection: our legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Opponents' Showdown names, teams and ratings in your recorded games, as Showdown shows them to both players: your and our legitimate interest in reviewing your own games (Art. 6(1)(f)).
• Public tournament and team data (below): our legitimate interest in an index of public competitive teams (Art. 6(1)(f)).

We never sell data, never use it for advertising, and never share it except with the processors above.

Eve's team library and meta pages are built from public sources: tournament team lists on Limitless (limitlesstcg.com and limitlessvgc.com), and pokepast.es pastes linked from YouTube video descriptions. Each team keeps its source link and, where the source gives one, the player's or author's public name. Smogon usage statistics contain no names. If you want your name or team removed, write to [email protected].

Account data, synced teams, share links, Showdown names and recorded games are kept until you delete them or your account; there is no automatic expiry. The shorter periods (sign-in codes, sessions, extension tokens, deleted-team markers, rate-limit counters, the replay cache) are given above.

• Export: /account has a JSON export of everything tied to your account.
• Delete: delete single games or all games in /account/games; revoke sessions and extensions in /account; or delete your account there, which permanently deletes the account and everything tied to it (teams, share links, Showdown names, extension tokens, games, pending sign-in codes) at once. Nothing is soft-deleted.
• You can also ask us at [email protected] for access, correction, deletion or a copy of your data, or object to processing. You may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

When this policy changes, the date at the top changes.