Privacy Policy
Last updated: October 9, 2026
The short version
- PlayPKM is a free battle game. There are no ads, no payments, no analytics, and no tracking. We don't sell or share your information.
- To make an account you pick a username and a password, and tell us your birth month and year so we can check you are 13 or older. We don't save your birth date, and we never ask for your email, your real name, or your phone number.
- Your username is public. Other players, the ladder, and battle replays show it. Don't use your real name as your username.
- Replays of finished battles can be watched by anyone who has the link.
- We use two cookies, only to keep you signed in and to remember you as a guest. Neither one tracks you around the internet.
- You need to be 13 or older to make an account. Anyone can play the computer as a guest without one.
- You can delete your account yourself, any time, from your account page. Questions? Email admin@playpkm.com.
The rest of this page gives the full detail.
Who we are
PlayPKM ("PlayPKM," "we," "us") runs playpkm.com. We are responsible for the information described here. You can reach us at admin@playpkm.com. We have not appointed a data protection officer or a representative in the European Union or the United Kingdom.
PlayPKM is an unofficial fan project. It is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, Creatures Inc., or The Pokémon Company, and none of them receive any information from this site.
What we collect and why
| Information | When we get it | What we use it for |
|---|---|---|
| Username | When you create an account | Your public name on the site: shown to opponents, on the ladder, in replays, and in battle records. |
| Password | When you create an account or change your password | Signing you in. We store only a scrambled form of it (an scrypt hash), never the password itself. |
| Recovery code | Shown to you once when you create an account (or make a new one) | Letting you reset a forgotten password. We store only a SHA-256 hash of it, so we cannot show it to you again. |
| Birth month and year | When you create an account | Checking that you are 13 or older. We use it only at that moment and do not save it. If you are under 13, no account is made and a cookie stops the sign-up form for a day. |
| Account creation time, the IP address the account was created from, and the time you were last seen | Automatically, when you sign up and when you use the site | Keeping the site safe: spotting spam sign-ups, ban evasion, and abuse, and knowing which accounts are active. The sign-up IP address is deleted automatically after 90 days. |
| Guest id and guest name | When you play without an account | A random id and a random name like "Guest 1234," kept in a cookie so your guest battles stay together. If you later sign up, those battles move to your new account. |
| Saved teams | When you save a team | Letting you use your teams again. |
| Battle records and replays | When a battle finishes | Both players' names and ids, the format, the result, the number of turns, the times, and the full battle log. Used for replays, your battle history, ratings, and the ladder. |
| Ladder standing | From your rated battles | Your username, rating, wins, and losses, shown on the public ladder. |
| Feedback | Only if you send feedback (accounts only) | Your message and username, plus page details that help us fix problems: the format, battle id, turn, screen size, your browser's user-agent string (the browser and device type it reports), and recent script errors. If you choose, also your own log of the battle. We use this only to answer you and fix the game. |
| Sign-in and sign-up attempts | When you try to sign in or sign up | Stopping password-guessing and spam. These records are tied to your IP address and the username tried, are kept only in the server's memory, and disappear within about an hour (or sooner if the server restarts). |
| Error logs | When something goes wrong on the server | Fixing bugs. An error entry may include a username or account id. These logs are deleted automatically after 30 days at most. |
| Emails you send us | If you email admin@playpkm.com | Answering you. We keep them only as long as we need to deal with your message. |
We do not collect your email address, real name, full date of birth, address, phone number, payment details, precise location, contacts, photos, voice, or any biometric information (such as face or fingerprint data). Our web server does not keep access logs of the pages you visit.
What your browser stores
We use these cookies. All are strictly necessary for the site to work, so there is no cookie banner to click:
| Cookie | What it does | How long it lasts |
|---|---|---|
| battle_session | Keeps you signed in. Your browser's scripts cannot read it (it is HttpOnly). | 30 days |
| battle_guest | Holds your random guest id and guest name, signed so it can't be faked. | 30 days |
| battle_age | Only set if someone under 13 tries to create an account: keeps the sign-up form closed. It holds no personal information. | 1 day |
The site also saves a few preferences in your browser's local storage: your chosen format, the computer's difficulty, your win streaks against the computer, and a count of your saved teams so pages load faster. These stay on your device; you can clear them any time in your browser settings.
We do not use advertising cookies, analytics cookies, tracking pixels, or any third-party scripts.
What is public
- Your username, everywhere it appears on the site.
- The ladder: username, rating, wins, and losses.
- Battle replays: anyone with a replay's link can watch it, including the names of both players and every move made.
- Anything you choose to post to Discord (see below).
Please don't put personal information, like your real name, age, school, or where you live, in your username or team names.
Who we share it with
We do not sell your information, and we do not share it for advertising. The only outside companies involved are:
- Vultr, which hosts our server in Elk Grove Village, Illinois, USA. Everything we store lives on that server.
- Discord, only if you press "Post to Discord." That posts your username and an invite link to your battle in a public Discord channel. Once it is there, Discord's own privacy policy applies to that post.
We may also disclose information if the law requires it (for example, a valid court order), or if we need to in order to protect players, the site, or others from fraud, abuse, or harm.
The site links to our partner sites genpkm.com and pkmredux.com. Those are separate sites with their own privacy policies.
How long we keep it
- Account details, saved teams, badges, and feedback: until your account is deleted. The sign-up IP address: 90 days.
- Battle records, replays, and ladder results: for as long as the site runs, because they are part of other players' histories too. If your account is deleted, your name in them is replaced so they no longer point to you.
- Guest battles: kept like other battle records, under the random guest name only.
- Sign-in attempt records: about an hour, in memory only.
- Server error logs: 30 days at most.
- Cookies: up to 30 days, or until you sign out or clear them. Local storage: until you clear it.
Deleting your account and your other choices
You can delete your account yourself on your account page: sign in, open your account, enter your password, and confirm. Because we don't have your email address, that is also how we know the request really comes from you. If you can't sign in (you lost both your password and your recovery code), we have no way to confirm the account is yours, so we can't act on emailed requests to delete or change it.
Deleting an account removes the account itself (username, password hash, recovery code hash, sign-up IP address, and dates), your saved teams, badges, ratings, and feedback. Battle records and replays stay for the other players, but your name in them, including in the replay logs, is replaced with "Deleted player."
You can also ask us for a copy of the information we hold about your account, or ask us to correct it. You can change your password and make a new recovery code yourself on your account page. We won't treat you differently for asking.
Children
You must be 13 or older to create an account. Players under 13 are welcome to play against the computer as guests, which does not ask for any personal information.
We do not knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we will delete the account and its personal information, as described above. If you are a parent or guardian and think your child under 13 has made an account, email admin@playpkm.com with the username and we will delete it. We will not ask you for more information about your child than we need to find the account. Children under 13 who try to sign up are turned away before anything is saved, and pointed to guest play instead.
Security
We protect your information with HTTPS encryption, hashed passwords and recovery codes, cookies your browser's scripts can't read, and limits on sign-in attempts. No site is perfectly secure, so please use a password you don't use anywhere else. If a security incident ever affects your information, we will tell you as the law requires, by a notice on the site, since we don't have your email address.
"Do Not Track" and Global Privacy Control
Some browsers send a "Do Not Track" or Global Privacy Control signal. We don't track you across other websites, and we don't allow anyone else to collect information about your activity across websites through PlayPKM, so these signals don't change anything here: the site already behaves the way they ask.
For visitors from outside the United States
PlayPKM is run from the United States, and your information is stored on our server in Illinois, USA. If you use the site from another country, including the European Union or the United Kingdom, your information goes to and is kept in the United States, where privacy laws may differ from yours.
If European or UK data protection law (the GDPR) applies to you, here is how it maps onto what we do:
| What we do | Legal basis |
|---|---|
| Running your account, saving teams, battles, replays, ratings, and the ladder | Providing the service you asked for (Article 6(1)(b)) |
| Recording the sign-up IP address, limiting sign-in attempts, error logs, and moderation | Our legitimate interest in keeping the site secure and fair and fixing bugs (Article 6(1)(f)) |
| Feedback and the optional battle log you attach | Our legitimate interest in answering you and improving the game (Article 6(1)(f)) |
| Posting to Discord | Your choice to press the button, which you can simply not do (Article 6(1)(a)) |
| Keeping anonymized battle records after an account is deleted | Our legitimate interest in keeping other players' histories and replays accurate (Article 6(1)(f)) |
| Responding to valid legal requests | Legal obligation (Article 6(1)(c)) |
A username and password are needed to make an account; without them you can still play the computer as a guest. We don't make any decisions about you by automated means that have legal or similarly significant effects. (The rating system and the sign-in attempt limits are automatic, but they only affect your ladder position and how quickly you can retry a sign-in.)
You have the right to ask for access to your information, to correct it, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable form. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, contact us as described above. You also have the right to complain to the data protection authority in your country.
For California residents
We don't sell or share personal information as California law defines those terms, and we don't use it for targeted advertising. The categories we collect, what we use them for, and who receives them are listed above. You can ask to see, correct, or delete your information as described in "Deleting your account and your other choices." PlayPKM is a free, non-commercial fan project and does not meet the thresholds that make the California Consumer Privacy Act apply, but we honor these requests from everyone anyway.
Changes to this policy
If we change this policy, we will update the date at the top. If a change matters, such as collecting something new or using information in a new way, we will also post a notice on the site before it takes effect. We won't use information we already have in a materially different way without telling you first.
Contact
PlayPKM, admin@playpkm.com