規Legal information

Privacy policy

Last updated: October 6, 2026 · Translation of the Spanish original, which prevails

Here we tell you, with no small print, what data Fudakan stores when you create an account, what it's used for and how you can view, change or delete it.

1. Data controller

2. What data we process

• When you create your account with an email: your name or nickname, your email address and your password. The password is stored encrypted: not even we can see it.
• If you sign in with Google: the basic details Google sends us about your account (name, email and profile picture). We don't use the picture. We don't receive your Google password or access to anything else.
• Your profile: your username, your avatar's color and icon and, only if you choose to write them, your bio, your Pokémon GO, Pokémon HOME and Pokémon TCG Pocket friend codes and a line about how to contact you, as well as whether the profile is public or private.
• Your collection: the cards you mark as yours, which ones you offer for trade, the ones you list as wanted, the four you pick for your showcase and the binders you build (with their name, their look and the cards you put in them, whether you own them or not) and, if you choose to note it, each card's language, condition and grade and what you think it's worth.
• The images you upload for your binders, with the title you give them. They are stored already shrunk and without the original file's hidden data (such as the place or device a photo was taken with). We also store the reports you make about other people's images, with the reason.
• Who you follow: the profiles of other collectors you mark with “Follow”. You see who you follow and who follows you; each person you follow can see that you follow them, and everyone else only sees how many followers each profile has and how many it follows.
• Your notifications: when someone starts following you, likes or comments on one of your binders, marks “For trade” on a card you want or wants one you trade, a notification is stored for you saying who it was. Only you can see them, and they are deleted automatically after 90 days.
• Your comments on binders: what you write, when and on which binder. Anyone who can see that binder can see them, next to your name (if your profile is private, it appears as “Private profile”). You can delete them whenever you like; so can the binder's owner. If someone reports one, we store who reported it, in order to review it; with three reports from different people it's hidden automatically.
• Your private messages: what you write to your friends (the people you follow who follow you back), when and whether it has been read. Only you and the other person can see them. Fudakan's moderators don't read them; they can only see a specific message if the person who received it reports it (and then we also store who reported it). You can delete the ones you sent.
• Your likes: which of other people's binders you've liked. Only you can see which ones; everyone else only sees how many each binder has.
• Your saved binders: which of other people's binders you've saved to come back to. Only you can see them: neither their owner nor anyone else knows you've saved them. You can remove them whenever you like.
• Your stamps and rewards: which missions you've completed and when (each one gives a stamp), the avatar frame and title you choose to wear and, if your account is one of the first hundred, your founder number. The website itself awards the stamps by checking what's already stored in your account; no new data is collected for this.
• Technical data: the IP address and date of each access, which are kept in our providers' security logs.

We don't ask for or store payment details, your phone number or your postal address.

Without an account you can browse the website and build a trial binder. That binder is saved only in your browser (it doesn't reach our servers) until you delete it or, if you create an account, move it there.

3. What we use it for and on what legal basis

We don't send advertising by email, we don't sell your data and we don't make automated decisions or build commercial profiles.

4. What others can see

• With a public profile: anyone, with or without an account, can see your name, your username, whatever you chose to write (bio, friend codes and contact), your showcase, your binders, your collection (with what you've noted about each card, including the value you give it), the cards you trade or want and the Pokémon you collect. The total value of your collection is shown only to you. Your profile appears on the profiles page, your binders on the community binders page (with your name and what it would cost to buy their cards at Cardmarket prices), and your name comes up when someone searches for a card you have or want.
• With a private profile: only you see all of that, and you don't appear in any list or search.
• Your email address is never shown to other people.
• The images you upload are public: they are visible in your binders and, if you share them, in the print gallery with your username; anyone who has an image's address can open it. Don't upload anything you don't want to show. Reports aren't public: only moderators can see them.
• Your comments can be seen by anyone who can see the binder where you write them (anyone, if its owner's profile is public). Your private messages can only be seen by you and the person you're talking to.
• Your stamps, your frame, your title and your founder stamp are visible on your profile: anyone who can see it can see them (anyone, if it's public; only you, if it's private).

5. How long we keep it

We keep your data for as long as you have the account. If you delete it (from your profile, under “Your account”), your profile, your collection, your showcase, your binders, your images, your comments, your likes, your saved binders, your stamps, the private messages you've sent or received and your login are erased at that moment (the other person in each conversation stops seeing it too). Notifications are deleted automatically after 90 days. We also make a weekly backup of the website's data (not of passwords) so we can recover it if something fails; we keep at most the last four weeks' backups, so your data disappears from them too within a month at most. Our providers' technical logs and backups are deleted according to their own schedules.

6. Who else is involved

To make Fudakan work we rely on these providers, which process data on our behalf:

• Supabase, Inc.: stores the accounts, profiles, collections, binders, comments, private messages and uploaded images. This project's servers are in the European Union.
• Cloudflare, Inc.: hosts the website and produces the cookie-free visit statistics.
• Resend: sends the website's emails (the code to confirm your account or to set a new password).
• GitHub, Inc.: stores, in a private space, the weekly backup of the website's data (profiles, collections, binders, comments, private messages and uploaded images; not passwords).
• Google Ireland Limited: provides the “Continue with Google” button on the log in page (your browser loads it from accounts.google.com, only on that page) and, if you use it, verifies that it's you.

Some of these providers may process data outside the European Economic Area. When that happens, they do so with the safeguards the GDPR requires (the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework).

In addition, when you use the website your browser downloads the card images from TCGdex's servers (assets.tcgdex.net) and, for the few it doesn't have, from the Pokémon TCG API's (images.pokemontcg.io and images.scrydex.com), and a code library (and, if new sets have come out, their data) from cdn.jsdelivr.net. When you open a card's page, your browser also asks TCGdex (api.tcgdex.net) for its price of the day, and if you click on one of the shops (Cardmarket or eBay) you leave Fudakan for that website, which has its own rules and cookies. Those services receive your IP address, like any server that delivers a file, but we don't send them any data from your account.

We will also disclose data to public authorities or courts when the law requires us to.

7. Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability:

• From your profile you can view and change your data (“Edit profile”) and delete the whole account (“Delete my account”).
• For any other request, write to [email protected] from your account's email, stating which right you want to exercise.

If you think we haven't handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), which is the authority of the country Fudakan is run from. If you live in another European Union country, you can also do so with your country's data protection authority.

8. Minors

To create a Fudakan account you must be 14 or older. If you are younger, you need your mother, father or legal guardian to do it with you. If we find an account belonging to someone under 14 without that permission, we will delete it.

9. Security

The website always runs over an encrypted connection (HTTPS), passwords are stored encrypted and the database applies rules so that each person can only modify what's theirs. Even so, no system is infallible: use a password you don't reuse elsewhere.

10. Changes to this policy

If we change anything important in this policy, we'll announce it on the website before the change takes effect.