Privacy Policy

Last updated: 9 July 2026

shinies.io ("shinies", "we", "us") is an independent, community-run Pokémon TCG website. This policy explains what personal data we collect when you create an account, why we collect it, and the rights you have over it. We deliberately collect as little as possible.

What we collect

You can browse the entire site without an account. If you connect a Discord account, we store:

• Your Discord user ID, username, and avatar reference (used to identify you and show your profile).
• A masked version of your Discord email (e.g. l****@gmail.com) for display, and a one-way cryptographic hash of your email for duplicate-account detection. We never store your real email address, and the hash cannot be reversed back into it.
• A username you choose for your public profile.
• Account timestamps (when you joined and last updated your account).
• Content you create once those features launch — for example the cards in your binders and any listings you add.

We do not store passwords, Discord access tokens, or any payment or financial information.

Cookies

We use a single essential session cookie (shinies_sid) to keep you signed in. It is strictly necessary for the site to work and is not used for advertising or cross-site tracking. We do not use third-party analytics or advertising cookies.

How we use your data

• To authenticate you and keep you signed in.
• To display your public profile, binders, and achievements.
• To operate community features and prevent abuse.

Your profile and binders are public and viewable by anyone with your profile link.

Legal basis (UK GDPR)

We process your data on the basis of your consent (given when you connect Discord and create a profile) and our legitimate interest in operating a secure community platform. You can withdraw consent at any time by deleting your account.

Third parties

• Discord — provides login (OAuth) and identity. See Discord's own privacy policy.
• Hosting & CDN — our host and content-delivery network process requests to serve the site.
• eBay — where a user adds a listing, we link out to eBay; visiting eBay is subject to eBay's own policies.

We do not sell your personal data to anyone.

Retention & deletion

We keep your account data until you delete your account. You can permanently delete your account at any time from the account menu ("Disconnect & delete") — this removes your record from our database. Deleting your account here does not affect your Discord account.

Your rights

Under UK/EU data-protection law you have the right to access, correct, or erase your personal data, to restrict or object to processing, and to data portability. Account deletion covers most of these directly; for anything else, contact us.

Children

shinies.io is not directed at children under 13, and Discord's own terms require users to be at least 13 (or the minimum age in your country). Do not create an account if you are younger.

Changes

We may update this policy; material changes will be reflected in the "last updated" date above.

Contact

Questions about this policy or your data can be raised through our Discord community.