Privacy policy

Metalodon is a free statistics site for Pokémon TCG Pocket. Every public page can be used without an account, and no advertising or tracking cookies are set. This page sets out what is stored, why, for how long, and how it can be downloaded or deleted. “We” means the person who runs the site, named at the end.

Effective: October 20, 2026

Server logs.

For each request, the server notes the IP address, the page or data asked for (including anything typed into a search) and the answer's status. The logs are used to keep the site running and to stop abuse. Sign-in and unsubscribe codes in addresses are blanked out before anything is written. Server logs are kept for 30 days, then deleted.

Visitor counts.

Visits are counted with Cloudflare Web Analytics. No cookie is set, nothing is stored in your browser, and no fingerprinting is done. For each page view, Cloudflare receives the page's address (without anything after the “?”), the page you came from, your browser, system and device type, and page-speed measures. Your IP address is used only to tell your country and is not stored. Card art and fonts are loaded from the site's own server, so the sites they come from never see your visit.

Hosting.

The site runs on a server rented from Oracle Cloud in its US West region (Phoenix, Arizona). Every request reaches it through Cloudflare, which protects and speeds up the site; like any network provider, Cloudflare sees your IP address and the request.

Advertising.

No ads are shown on the site today, and no advertising cookies are set. If we add advertising later, we will update this policy before it starts and, where the law requires it, ask for your consent before any advertising cookie is set.

Cookies.

The cookies below are set only to keep the site working, and some exist only after you sign in or change a setting. None is used for advertising or to follow you to other sites.

pm_session: Keeps you signed in. It holds a random code; we keep only a scrambled (hashed) copy of it. Kept 30 days, renewed while you use the site, one year at most; set after you sign in.
pm_oauth: Ties a sign-in to the browser that started it, so a sign-in link or a Google / Discord answer only works there; also limits repeated attempts. Kept 15 minutes; set when you start signing in.
pm_nl: Limits repeated sign-ups to the weekly email from one browser. Kept 15 minutes; set when you sign up for the weekly email (not available at launch).
pm_art: Remembers which printing's art you prefer, so pages load with it. Kept 400 days; removed when you go back to the default; set when you change the art settings.
pm_decks: Remembers that this browser has saved decks, so the builder opens My decks first. Kept 1 year; removed when there are none; set when you save a deck.

A short-lived security cookie (cf_clearance or __cf_bm) may also be set by Cloudflare if it needs to check that a visitor is not a bot; these are used only for security (see Cloudflare's cookie list).

Stored in your browser.

Some settings are kept only in your browser's local storage. They never leave it, except your settings and browser-saved decks, which are added to your account when you sign in. Clearing your browser's site data removes them.

theme: light or dark theme
pocketmeta.builder.v1: the deck you are building, so it survives a reload
pocketmeta.builder.split: how the builder's two columns are split
pocketmeta.builder.liftOverlay: whether the builder's Lift marks are on
pocketmeta.builder.deckImage: the deck image's last border and whether it showed a name (never the name itself)
pocketmeta.mydecks.v1: decks saved in this browser while signed out (added to your account when you sign in)
pocketmeta.prefs.v1: your site settings (art, Lift marks, table views), synced to your account when signed in
pocketmeta.prefs.clock: the difference between your clock and ours, so settings sync in the right order
pocketmeta.prefs.cookieAt: when the art cookie was last renewed
pocketmeta.customMeta.signin: a Custom Meta link too long to carry through sign-in, for up to an hour, so it opens again once you are signed in

Accounts.

An account is optional; it is needed only to save decks, to follow decks, cards and players, and to keep settings on every device. Sign-in is through Google or Discord; there are no passwords.

From Google (scopes “openid email profile”), your Google account id, email address, whether Google verified it, your name and your profile photo's address are received. From Discord (scopes “identify email”), your Discord id, user name, avatar, email address and whether it is verified are received. They are used to recognize you and to show your name and picture; we never post anything for you.

What you create is stored with your account: your display name and picture choice, saved decks (name, notes, cards and up to 50 versions each), settings, the decks, cards and players you follow, when “Since your last visit” was last opened, and the premium features you asked to hear about (“Tell me when it's ready”). For each signed-in browser, when its session started and was last used and its user-agent text are stored, so your sessions can be recognized in your data download. For each sign-in attempt, the IP address that started it is stored to limit repeated attempts, and deleted once the attempt has expired.

Your account is private: your decks, follows and settings are not shown to anyone else. If your Google or Discord photo is chosen as your picture, it is loaded by your browser from Google or Discord.

We use information from Google only to sign you in and to show your name and picture, and we never share it, sell it or use it for ads. Our use follows the Google API Services User Data Policy.

Email.

Email features (sign-in by email link, a daily summary of changes to what you follow, and a weekly meta email) are not available yet. When they are, only the address you give or your verified sign-in address will be used, only with your consent, and every email will carry a one-click unsubscribe link.

Tournament players.

The statistics are built from public tournament results on Limitless TCG: player ids, display names, countries, placements, records and decklists. From these results a skill rating and win rate are computed for each player, and player pages (which search engines are asked not to index), a leaderboard and player search are shown. The ratings appear only on this site and have no effect anywhere else. This is done in the legitimate interest of publishing statistics about public competitive play.

You can object, and ask for your player page to be removed, at [email protected]. Within a few days of a request you are taken off the leaderboard and search, your page is removed, you can no longer be followed, and your name is replaced by “Player” in deck lists and game lists. Your games still count in the statistics, without your name or a link to you.

The Discord bot.

When a Metalodon command is used in Discord, Discord sends it along with your Discord id and name and the server and channel it came from. These are used only to answer and are not stored; only the command name and timings are logged. When a server turns on the weekly post, that server's id and the channel's id are stored until the post is turned off or the bot can no longer post there. If a weekly post to a server fails or is refused, that server's id also appears in our server logs (kept 30 days) and in a private alert to the site's owner. When a server's managers choose whether command replies are public or private, that server's id, the channel ids and the choice are stored until they change it.

Why your data may be used (visitors from the EU and UK).

Your data is used on three grounds: to run the account you asked for (sign-in, sessions, saved decks, follows, settings, “Since your last visit” and “Tell me when it's ready”); in the legitimate interest of running a safe, working site (server logs, limits on sign-in attempts, Cloudflare's protection and visitor counts without cookies) and of publishing statistics from public tournament results, including player pages and ratings; and with your consent, for emails once they exist.

You can object to the uses based on legitimate interest (see “Your choices”). Consent can be withdrawn at any time; that does not undo what was done before. No decisions with legal or similarly significant effects are made about you by automated means.

Where your data is.

The site is run from the US, and its server and backups are in the US. If it is used from another country, your data is handled in the US, where privacy law differs. Data handled for the site by its providers is protected under their own terms: Cloudflare, for example, is certified under the EU-U.S. Data Privacy Framework.

Security.

Data is protected with encrypted connections, sign-in codes and session keys are stored only as scrambled (hashed) copies, access to the account database on the server is limited, and backups are kept in private storage. No system is perfectly secure: if a breach affects your data, we will tell you, and the authorities where the law requires.

How long it is kept.

Each kind of data is kept as follows.

Your account, sign-in methods, saved decks, settings, follows, feed state and “Tell me when it’s ready” requests: Until you delete them or your account
Signed-in sessions: Until you sign out, 30 days without use, or one year
Sign-in attempts (with the IP address that started them): Expire after 10 minutes (email links: 15 minutes, kept a day longer); then deleted within the hour
Decks you delete: 30 days (you can undo), then erased
Server logs (with IP addresses): 30 days, then deleted
Backups (copies of the account database): About 10 weeks on our server (14 nightly and 8 weekly copies); the off-site copy 91 days, then deleted automatically
Public tournament data from Limitless: Indefinitely: every statistic is rebuilt from it

Your choices.

Your data can be downloaded on the Account page (“Download my data”: one file with everything stored about your account), and your account deleted there (“Delete account”). A deleted account is erased at once; backup copies age out within 91 days. Decks and settings saved in this browser stay in it until the site's data is cleared in your browser. Sessions, sign-in methods, follows and decks can be managed on the Account, My decks and Following pages.

Wherever you live, you can ask to see, correct, delete or download your data, to stop or limit a use of it, or to object to it, at [email protected]. We answer within one month.

We don't track you across other sites, and no one else can through this site, so there is nothing for a browser's Do Not Track or Global Privacy Control signal to switch off: every visitor is treated the same way.

If you are in the EU or UK and believe your data is handled unlawfully, you can complain to your data protection authority (in the UK, the ICO).

Age.

Accounts are for people aged 13 or older, or older where your country sets a higher age for agreeing to online services on your own (in the EU, 13 to 16 depending on the country). An account found to belong to someone younger is deleted, and parents can write to [email protected]. Everything else works without an account.

Changes.

When this policy changes, this page and its effective date at the top are updated. See also the terms of use.

Who runs the site.

Metalodon is run by Isaac Thomas, an individual in California, USA. Questions and requests about your data, including removing a player page, can be sent to [email protected]; anything else to [email protected]. Metalodon is an unofficial fan project, not affiliated with The Pokémon Company, Nintendo, Creatures, GAME FREAK or DeNA.