Your privacy.

The short version

• We collect what we need to run your account and the game — your email, a password (stored as a one-way hash), your game data, and the location your phone sends while you play.
• We don't sell your data, show ads, or use third-party analytics or tracking cookies.
• Your email is never shown publicly. You can delete your account yourself at any time.

Who is responsible

Project Windstock, a volunteer-run fan project (“we”), operates windstock.org, the Windstock launchers, the online game server and the Windstock Discord bot. We are the controller of the personal data described here. Contact us using the details at the end of this policy.

What we collect

Account details. Your email address, your game username, and your password — stored only as a salted scrypt hash, never in readable form. We also store your sign-up date, account settings (such as whether you appear on the leaderboard), and a referral code and who referred you, if anyone.

Game data. Your trainer save: Pokémon, items, PokéCoins, level, medals, stats (caught, spun, distance walked), research, gyms you hold, trades, and similar progress.

Location while you play. Like any location-based game, the game sends your phone's GPS position to the server so it can show nearby Pokémon, PokéStops and gyms. The server keeps recent positions briefly in memory (about the last minute) to work out travel speed for the anti-cheat speed lock, and may store a last-known position with your save. We don't build a history of where you have been.

Device and network data. An anonymous device identifier generated by the launcher (used to keep you signed in, link your phone to your trainer and protect beta accounts), your IP address, and the app version and phone model. IP addresses are used for security, rate limiting and preventing referral abuse; where we store one with your account it is kept as a short one-way hash. Our web server keeps standard access logs (IP address, time, page requested, browser).

Cookies. One essential sign-in cookie on windstock.org, which lasts up to 30 days. No advertising or analytics cookies. The site's offline cache (service worker) stores page files on your device only.

Discord. If you link your Discord account, we store your Discord user ID and name so the Windstock bot can show your profile and handle trades.

Things you send us. PokéStop nominations (title, description, map location and 1–3 photos), problem reports from the launcher (your description, optional contact info, app and device info, and app logs — passwords removed and locations rounded to about 10 km on your phone before sending), and messages on Discord.

What we use it for

• Running your account and the game, including sign-in, saving progress, trades, gyms, events and rewards.
• Showing the leaderboard and public profiles (trainer name and stats only — never your email).
• Keeping the game fair and safe: anti-cheat, rate limits, spotting multiple-account or referral abuse, bans and moderation.
• Fixing bugs and answering problem reports.
• Reviewing PokéStop nominations.

Our legal bases (for people in the EU/UK) are performing our agreement with you (the Terms) and our legitimate interest in running a safe, working, fair game. Where we rely on consent (for example linking Discord), you can withdraw it at any time.

What other people can see

• Public: your trainer name, level, team and stats on the leaderboard and profile cards (unless hidden), approved PokéStop nominations (title, description, location and the default picture — never your photos), and things other players see in game, like gyms you defend.
• Admins: a small number of trusted Windstock admins can see account details (including email), game saves, nominations and problem reports to run and moderate the Service. Admin actions are logged.

Who we share it with

We don't sell or rent personal data and we don't share it with advertisers. Data is shared only with:

• Our hosting provider, which runs the server the website and game live on, in the European Union.
• Discord, when you use our Discord server or bot, or when the bot posts a notice (for example that a new problem report arrived).
• OpenStreetMap, whose map tiles your browser loads directly on the Map and account pages; they see your IP address like any website you visit. Some pages also load code libraries from cdnjs (Cloudflare).
• Authorities, if the law requires it or to protect people from serious harm.

How long we keep it

• Account and game save: until you delete your account (or we delete it after a ban or server wipe).
• Sign-in sessions: up to 30 days on the website.
• Nomination photos: deleted once the nomination is approved or rejected.
• Problem reports: until the problem is dealt with, then deleted.
• Web server logs and backups: kept for a limited time and then removed. Deleted data can stay in backups for a short while until they are replaced.
• Moderation records (such as a ban and its reason) may be kept after deletion to stop the same person coming back.

Your rights and choices

On your account page you can change your password and game username, reset your progress, or delete your account. You can also ask us to give you a copy of your data, correct it, delete it, or stop or limit some processing. If you are in the EU/UK you may complain to your local data protection authority, but please talk to us first so we can try to fix it.

Children

Windstock is not meant for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, contact us and we will delete it.

Security

Passwords are hashed, sign-in cookies are HTTP-only, connections to the website and game use encryption, and admin tools are limited and logged. No system is perfect, though, so please use a password you don't use anywhere else.

Changes to this policy

If we change how we handle data, we'll update this page and the date at the top, and announce meaningful changes on the website or Discord.

Contact

For privacy questions or requests, reach the team on the Windstock Discord, or use Report a problem in the launcher. See also our Terms of Service.