Privacy

Short version: the site works without an account, stores as little as possible when you have one, and you can export or delete everything at any time.

If you never sign in

Your collection, your saved teams and the markers you tick off as found on the map live in your browser's local storage and nowhere else. They are not sent anywhere, and we cannot see them. Clearing your site data deletes them — so export a copy if it matters to you.

One more thing lives there, and it is not about you: which theme you picked with the toggle in the header. It is the word light or dark, it never leaves your browser, and nothing reads it but the page you are on.

The team builder's share link is not an exception. The whole team is packed into the part of the URL after the #, which browsers never send to a server. We do not see those links, cannot count them, and could not take one down if we wanted to.

If you sign in

Signing in with Discord or Google is optional and exists only to sync across devices.

What is stored

• An account id issued by our database
• Your email address and display name, as supplied by Discord or Google
• Your collection: which forms you have marked, and when
• Your collection profile names and any server region you set
• Your found markers on the map: which markers you have ticked off (or unticked), for which collection, and when you ticked them — a marker's id, never your location
• Your saved teams, so they stay in step across your devices
• Any team you publish — see below

What is not

• No password. Sign-in is delegated, so there is nothing to leak.
• No Discord or Google contacts, servers, friends or activity.
• No advertising identifiers, and your collection is never used for advertising.
• Nothing is sold or shared with third parties.

If you publish a team

Publishing is a separate, deliberate act: nothing you build is public until you press Publish. What goes on the page is the team's name, its four slots and their notes, your notes, and the credit you type in — nothing else. Your email, your account id and your collection are not part of it and are not readable by anyone visiting the page.

What is published is a snapshot. Editing the team afterwards — or syncing it between your devices — does not change the page; it stays on the version you published until you press Update the page. So a team you are still experimenting with is not quietly going public a change at a time.

A published page is genuinely public: anyone with the link can read it, it is listed on Published teams, and search engines may index it. Treat the credit field as a public name, not a private one.

Taking it down. “Take it offline” on the team builder makes the page 404 again and delists it. Deleting the team removes the stored row entirely. Neither can reach copies other people have already made or pages that have already been cached elsewhere — that is true of anything published anywhere, and is the reason publishing asks first.

If you report a page

Published teams carry a Report this page link. A report records the page, the reason you picked and anything you typed — and nothing about you. No account id, even if you are signed in, and nothing that identifies you to the person who published the team. Knowing who reported them is a retaliation risk, and the report works without it.

Reports are read by a person. Nothing is hidden or taken down automatically, however many reports it gets.

Getting your data out

The collection page exports everything as JSON, signed in or not — your collection and your found markers on the map. It imports the same file, so you can move between browsers without an account.

Deleting it

• Local copy: “Clear collection” on the collection page, or clear site data. Clearing site data also removes your found markers on the map.
• Account and cloud copy: “Delete account” on the collection page. It removes the account and everything attached to it — including any published team pages — immediately and irreversibly. Your browser copy is left alone.
• Signing out is not deletion — the cloud copy stays. Once everything in this browser has synced, signing out clears the browser copy so the next person to sign in here cannot see it; anything not yet synced is kept rather than lost.

Who processes it

Hosting is Vercel; accounts and the database are Supabase. Sign-in is handled by Discord or Google, whose own privacy policies apply to the account you sign in with. Data is stored in the region the database was created in.

Access is enforced at the database with row-level security: every row is readable and writable only by the account that owns it.

Analytics

This site uses Google Analytics to count page views and see which pages are useful. It records the page you are on, the page that referred you, and coarse device and country information — never the contents of a page, and never anything from your collection, your teams or your account.

The cookies, and when they are set

Google Analytics can store a pair of cookies named _ga and _ga_<id>, kept in your browser for up to two years, which let it recognise a second visit as the same browser as the first. They are the only cookies this site is capable of setting.

• In the EU, the EEA and the UK, neither is set unless you press Accept on the bar at the foot of the page. Decline it, or ignore it, and Analytics runs without storage: it still counts the visit, and it writes nothing to your browser.
• Everywhere else, they are set by default, and the button below turns them off.
• Advertising signals are refused for everyone, always. There are no ads here and nothing on this site is used to target any. That is not a setting you have to find; it is sent as a refusal on every page, in both cases above.

Which of those you get is worked out from the timezone your browser reports — not from your IP address, which we never look up, and not from an account. That is a device setting rather than a location, so it is deliberately generous: a timezone anywhere in Europe, or one the browser hides, is asked rather than assumed.

Your IP address does reach Google the way it reaches any server you make a request to; Google uses it to work out a rough location and states that it does not store it in Analytics. Google is an advertising company, and what it collects here is covered by its own privacy policy as well as this page.

That clears the answer stored in this browser and puts the bar back, wherever you are.

A content blocker stops the whole thing regardless, as does Google's own opt-out add-on. Nothing on this site needs any of it to work, and no feature behaves differently without it.

Two other measurements run alongside it, and neither sets a cookie or stores a cross-site identifier. Vercel Web Analytics counts page views, and Vercel Speed Insights reports how quickly pages actually loaded for you — the timings your browser already measures for itself, like how long the largest image took to appear — so that a slow page can be found and fixed rather than guessed at.

None of the three is joined to a signed-in account, and none of them can see your collection, your teams or your found markers. Google Analytics builds a per-browser profile only where the cookies above are actually set — decline them and there is nothing holding one visit against the next. The two Vercel measurements are aggregate either way, and have no per-visitor profile to ask for.

Children

Accounts are not intended for children under 13, or under 16 in regions where that is the threshold for consent. The site is fully usable without an account at any age.

Contact and changes

This is an unofficial fan project, not affiliated with Pawprint Studio. For anything privacy-related, or to request deletion if the in-app button is not working for you, open an issue on the project repository.

Last updated 2026-09-17. Material changes will be noted here; the page history is public in the repository.