Privacy Policy

XatuVision is an independent, non-commercial project operated by Thomas Michelini (Italy), the data controller for the purposes of the EU General Data Protection Regulation (GDPR). For any privacy question or to exercise your rights, contact

.

Your Discord account. XatuVision is a private beta behind "Sign in with Discord". When you sign in we store your Discord user ID, username, email address and avatar, together with the OAuth tokens Discord issues us. We use them only to sign you in and to verify that you hold the beta role that grants access; we never post anything on your behalf. Legal basis: performance of a contract (providing the beta you asked to join), Art. 6(1)(b) GDPR.

A login cookie. To keep you signed in we set one essential, encrypted session cookie (valid up to 30 days). It is strictly necessary for the gated site to work, so it needs no consent banner. Legal basis: our legitimate interest in operating a secure login, Art. 6(1)(f) GDPR. We set no advertising cookies at all. The only non-essential cookies and browser storage are the measurement ones PostHog writes, and only after you accept — see "Product analytics" below, where you can also withdraw your consent at any time.

Server logs. Our hosting keeps standard HTTP access logs (IP address, timestamp, requested URL, user agent) for a short period for security and debugging. They are not used to profile you. Legal basis: legitimate interest in the security and stability of the service, Art. 6(1)(f) GDPR.

Local preferences. Your light/dark theme and recent command-palette searches live only in your browser (localStorage), never on our servers.

Product analytics. While the beta is running we use PostHog (EU Cloud) to understand how the site is used — which pages and features are visited, anonymous click and navigation events, and aggregate session replays — so we can fix what is confusing and decide what to build next. Nothing is captured until you accept: analytics start switched off and stay off unless you opt in. Replays mask everything you type (search queries and the feedback box are never recorded); analytics profiles are created only for signed-in users and keyed to your Discord ID, with no extra personal data; and the data is ingested and stored in the EU. We use it only in aggregate for product decisions — never for advertising. Legal basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with the button below — withdrawal stops any further collection and does not affect what was collected before.

We keep your Discord account data and OAuth tokens for as long as your beta access is active, or until you ask us to delete them. The access and refresh tokens are replaced as they rotate during normal use. Server access logs are retained only short-term by our host. Published tournament and player data (below) is retained for as long as it is relevant to the historical meta dataset.

XatuVision aggregates tournament results and decklists that players and organisers have already published publicly on

. This can include a player's chosen display name, country, match records, placements and decklist. We did not collect this from you directly (GDPR Art. 14).

Legal basis: legitimate interest (Art. 6(1)(f)) in providing competitive-meta statistics from results that are already in the public domain. If you are a player and want your name or results removed or anonymised, email

and we will action it — you can object to this processing at any time.

We rely on a small number of providers (processors / recipients):

• Hetzner (Germany, EU) — hosting of the application and database.

• Backblaze B2 — encrypted database backups. Depending on the bucket region this may involve a transfer outside the EEA, covered by the provider's standard contractual clauses.

• Discord — the identity provider that authenticates your sign-in, and the place where the feedback you send from the app arrives (see "External requests" below).

• PostHog (EU Cloud) — privacy-focused product analytics (page and feature usage), with everything you type masked and all data processed in the EU. See "Product analytics" above.

• Image and sprite hosts (pokemontcg.io, scrydex.com, play.pokemonshowdown.com) — see "External requests" below.

We do not sell, rent or share your account data, and we run no advertising. The only behavioural data we collect is the privacy-focused, EU-hosted product analytics described above (PostHog) — never used for advertising or sold to anyone.

Card images. Thumbnails next to card names are served directly by

and

. Loading them sends a request from your browser to those services, which may log your IP address and user agent under their own policies. XatuVision does not see those requests.

Pokémon sprites. The small Pokémon icons next to archetype names — present on almost every page — are served directly by

. As with card images, your browser talks to that service directly, which may log your IP address and user agent under its own policy.

In-app feedback. When you send feedback from the in-app widget, our server forwards it to a private Discord channel through a webhook: your message, the page you sent it from, and your Discord username and user ID, so we can understand the report and follow up with you.

Under the GDPR you can request access to, correction or erasure of your data, restriction of or objection to processing, and data portability. To exercise any of these, email

. You also have the right to lodge a complaint with your supervisory authority — in Italy, the

.

Questions about how XatuVision handles data, or want to exercise a right? Email

.

Last updated: 29 July 2026.