Privacy Policy
Last updated September 15, 2026
TouchGrass Pokemon (“the site”) lets you browse Pokémon TCG sets and track a card collection. This page explains exactly what is collected, why, and how to get rid of it. The short version: you can use the whole site without an account, and if you do make one, all it stores is who you are and which cards you have ticked off.
Using the site without an account
No account is required. If you track a collection while signed out, it is saved in your own browser (localStorage) and never sent to us. Clearing your browser data deletes it, and it does not follow you to other devices.
If you create an account
Signing in with GitHub gives the site:
- your name or username
- your email address
- your profile picture URL
- an identifier linking your account to that provider
That is all. The site never sees or stores your password, and it cannot post anything or read your repositories.
What else is stored
- Your collection — the card IDs you mark as owned, and when you added them.
- Session cookies — a signed cookie that keeps you logged in. It is strictly necessary for sign-in and is not used for tracking.
What is not done
- No advertising, ad networks, or third-party trackers.
- No selling or sharing of personal data.
- No marketing email. Your address is only an account identifier.
- No profiling or automated decision-making.
Who the data touches
The site runs on a small number of providers, each of which processes data only to keep it online:
- Vercel — hosting and server logs (including IP addresses, kept briefly for security and debugging).
- Neon — the PostgreSQL database holding accounts and collections.
- GitHub — sign-in, when you choose it.
- TCGdex — card data and images. Loading an image means your browser contacts their servers.
Data is stored in the United States. If you are in the UK, EU or EEA, your information is transferred there to provide the service.
How long it is kept
Account and collection data are kept until you delete your account, at which point they are removed immediately and permanently. Sessions expire on their own. Server logs are short-lived and controlled by the hosting provider.
Deleting your account
Go to My Collection and use Delete account at the bottom of the page. You will be asked to type your email address to confirm. This erases your account, your sign-in link and every card in your collection in one step. It happens straight away and cannot be undone — there is no grace period and no backup copy kept for you.
Your rights
Depending on where you live (for example under GDPR or the CCPA), you may have the right to access, correct, export or delete your data, and to object to its processing. Deleting your account covers erasure outright. For anything else, get in touch and it will be handled.
Children
The site is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has made an account, contact us and it will be removed.
Security
Traffic is encrypted over HTTPS, database connections use TLS, and sign-in is delegated to GitHub so no password ever reaches this site. The collection endpoints are rate limited and always check your session server-side, so one account cannot read or change another’s data. No system is perfectly secure, but the data held here is deliberately minimal.
Changes
If this policy changes materially, the date at the top will change with it. Continuing to use the site after that means accepting the updated policy.
Contact
Questions about privacy, or a request about your data, can be sent through the project’s issue tracker.
TouchGrass Pokemon is an independent project and is not affiliated with, endorsed by, or sponsored by Pokémon, Nintendo, Game Freak or Creatures Inc. Card images, set logos and card names are the property of their respective owners and appear here for informational purposes. Market prices are periodic snapshots and may be out of date — always confirm on the seller’s own site before buying or selling.