Privacy Notice

Updated 7 November 2026

Who is responsible?

Alan James Leggett operates Legga001 Shiny Counter and is the contact for privacy questions: legga001@hotmail.com.

Hunts and Shiny Dex

When you allow “Save hunts on this device”, this browser stores hunt names, selected games/Pokémon/forms/methods, bonus settings, encounter histories, counts, timer values, completion status, Shiny Dex catch records and Living Dex collection marks and any catch details you enter. Guest mode does not upload hunts. If you choose to sign in, account hunts and both Dex collections are uploaded to Supabase for cross-device synchronisation. Avoid putting sensitive personal information in hunt names.

Saving is optional and uses your consent. Without it, the counter runs in memory and you can export a backup. Turning saving off stops the app reading and writing saved hunt data; it does not automatically erase previously saved data. “Delete saved hunts & collections” in Privacy settings removes this tool’s saved hunt records from this browser.

Optional accounts and cloud saves

Google sign-in and cloud saving are optional. Supabase handles authentication and stores a unique account ID, your email address and the basic identity information supplied by Google. The counter does not receive or store your Google password and does not request access to Gmail, contacts or Drive. Our hunt-save table stores only your account ID, hunt/Dex data, save revision and update time; it does not duplicate your email or profile.

Signing in contacts Supabase and Google. While signed in, changes are sent to your private cloud save. If both this device and the cloud contain hunts, you choose which copy to use. Export backups before replacing a save. Guest and account data are kept separate.

We process account identity and saves to provide the cloud service you request, on the basis of performing that service under the Terms of Use. Service-security information is processed for our legitimate interest in protecting accounts. Cloud saving is not dependent on accepting optional sprites or guest-device storage.

The primary Supabase database is in London (AWS eu-west-2). Supabase and its subprocessors may process authentication, operational or support information in other countries, subject to the provider’s applicable safeguards. See Supabase privacy information, its Supabase Data Processing Addendum and Supabase residency and transfers information. Google processes sign-in information under Google’s privacy policy.

Cloud saves remain until replaced or the account is deleted. Use your account button to delete the counter account and live cloud saves. This does not delete your Google account or downloaded exports. Provider security logs and residual backup copies follow the provider’s retention processes. For data requests or difficulties deleting an account, contact the operator.

Privacy preferences

A required preference record stores your saving and sprite choices, policy version, choice date and expiry. It is used only to apply and remember those choices, not for advertising or profiling. The site honours the choice for 180 days, then requests it again. Because localStorage has no automatic expiry, the old preference record may remain on the device until replaced or removed through browser controls. This limited preference storage is treated as necessary to honour your choices; where personal data is involved, the purpose is our legitimate interest in operating privacy controls.

Optional external sprites

Only after you enable external sprites does the browser request Pokémon images from GitHub’s raw.githubusercontent.com service. Those requests disclose your IP address, the requested image URL, request time and normal connection/browser information to GitHub. They do not include hunt names, counters, timers or exported files. Image requests suppress the page referrer and omit cross-origin credentials.

Enabling sprites is an optional consent choice. You can withdraw it in Privacy settings; future sprite requests then stop. Withdrawal cannot undo requests already made or remove copies retained by the provider. See GitHub’s privacy statement for its recipients, retention and international-transfer information.

Website delivery and server logs

The hosting provider necessarily receives connection information such as IP addresses and requested page paths to deliver and protect the website. The purpose is delivery, security and abuse prevention, based on legitimate interests, rather than tracking your hunts.

The website is hosted by Vercel using its distributed infrastructure. Vercel processes delivery and security information under its Vercel Privacy Notice and Vercel Data Processing Addendum. Provider logs are governed by the provider’s service configuration and retention policies; they are separate from the hunt records stored by this app.

The app code contains no analytics, advertising, fingerprinting or social-media embeds. A hosting provider can add its own services or cookies; those must be reviewed before launch and this notice updated if needed.

Downloads, imports and contact

Export creates a JSON file on your device. Import reads a file locally. In guest mode it is not uploaded; while signed in, importing a backup replaces your account state and is synced to Supabase. Keep backups secure. Deleting browser saves does not delete downloaded backup files. If you email the operator, your address, message and any information you choose to send are handled to answer your request, based on legitimate interests. Do not send a full backup unless it is necessary. Relevant correspondence is normally deleted within 12 months after the request is resolved, unless a legal need requires longer.

Retention and control

Saved hunts persist until you delete them, clear browser site data or the browser removes them. There is no automatic hunt expiry. Declined-saving sessions remain in page memory until closed or reset. Manage choices using Privacy settings; this also provides a saved-data deletion control.

Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, object to processing or receive personal data in a portable format, and to withdraw consent without affecting earlier lawful processing. Export and edit controls cover the current hunt data. The operator cannot remotely retrieve browser-only guest saves; signed-in cloud records can be managed through your account or an identity-verified request. For other requests, email legga001@hotmail.com. You can complain to a relevant supervisory authority; in the UK, this is the Information Commissioner’s Office.

Children and updates

The tool has optional accounts, no chat or advertising, and does not ask for a date of birth. Children should ask a parent or guardian before signing in, sending personal information or enabling third-party images. Google’s account eligibility rules also apply. If the site’s data use changes, this notice and any required consent request will be updated.