| What this site collects | |
|---|---|
| Cookies set by pkmnlab | None |
| Analytics | Cloudflare Web Analytics, cookieless |
| Accounts, sign-ups, mailing lists | None |
| Requests to third-party servers | One: the analytics script |
| Your team in the address bar | Never sent — the query string is dropped |
| Kept in your browser | Three keys: theme, saved teams, the daily puzzle |
| Kept on the server | Access log, 14 days |
| Sold, shared or brokered | Never |
pkmnlab is a set of static pages. There is no account to create and no cookie banner to dismiss. The fonts, the sprites, the type data and the damage engine are all served from pkmnlab.com, so no advertising network, no font host and no tag manager learns that you were here.
There is one exception and it is named here rather than left for you to find. Every page loads
Cloudflare Web Analytics from static.cloudflareinsights.com. It is
the cookieless product: it sets no cookie, writes nothing into your browser, and posts what it
measures back to pkmnlab.com rather than to anyone else.
What it sends is the page path, the referrer, the browser engine and version, the operating system version, and how long the page took to load, along with an identifier that is generated fresh on every page load and cannot be joined to the one before it. It does not send the query string — and the query string is where your team lives, so the six Pokémon you seated are never part of it. Cloudflare states that it does not fingerprint visitors, does not track them from one site to another, and discards IP addresses at its edge instead of storing them.
All of that is checkable rather than a promise: open your browser's network panel on any page of this site, and the only request that leaves this domain is that one script.
Three localStorage keys, all written by you and none sent anywhere.
pkmnlab-theme holds either light or dark, written when
you press the theme toggle so the next page does not flash the wrong colour at you.
pkmnlab-teams holds the teams you press Save on in the builder: the Pokémon, and
in competitive mode the items, abilities, natures, effort values and moves you set. Up to twelve
of them, oldest dropped first. It is written only when you press Save and removed when you press
the cross beside a team. There is no account attached to it and no copy of it anywhere else — it
is in this browser on this device and nowhere on the server, which also means it does not follow
you to your phone.
pkmnlab-daily holds the date of the daily puzzle you last played and which of the
six candidates you picked, so returning to the page shows you your own result instead of asking
you to play the same day twice. It is one date and one Pokémon name.
No key leaves your browser, none is readable by another site, and clearing site data removes all three.
The tools also write their state into the address bar — ?team= on the builder,
?types= on the type calculator, ?roll= on the random generator, and so
on — so that a page can be reloaded, bookmarked or shared and come back exactly as you left it.
That state lives in the URL itself. Nothing about you is stored anywhere, and the only thing
stored for you is what you press Save on, in your own browser.
An ordinary web server access log: IP address, timestamp, the URL requested, the referring page, and the browser's user-agent string. It rotates daily and is deleted after 14 days. It exists so that a page returning errors or a burst of abusive traffic can be diagnosed. It is not aggregated into reports, not joined to anything else, not used to build a profile, and it never leaves the machine.
One consequence is worth stating plainly. Because the tools put their state in the query string, opening a shared link means that link's contents — the team code, the types you picked — appear in that log the way every other requested URL does. A team code is a list of Pokémon, so this matters very little, but treat anything you put in a URL here as public.
pkmnlab.com is served through Cloudflare, which sits between you and the server as a cache and
a shield. Cloudflare therefore sees what any proxy sees — your IP address, the request, your
user-agent — and handles it under its own privacy terms rather than these. It may set a cookie of
its own, __cf_bm, to tell browsers apart from bots. pkmnlab does not set it, does not
read it, and gets nothing from it.
A large share of the people who use a Pokémon team builder are children, which is the reason this site was built the way it was. No personal information is collected from anyone of any age, because there is no mechanism here capable of collecting it: no form, no login, no upload and no comment box. The one script from outside is the cookieless analytics described above, which receives no identifier that outlives a single page load and never receives the address bar's query string. There is nothing held about a visitor that could be requested or deleted, because nothing is held. Saved teams are held in the child's own browser, never sent here, and erased by clearing site data.
There is no account to export, no profile to erase and no list to unsubscribe from. If you believe any statement on this page is inaccurate, or you want your IP address removed from the server log before it expires on its own, write to abuse@pkmnlab.com and it will be handled.
The date at the top of this page is the date it last changed, and it changes whenever the substance does. There is no mailing list to announce it on, which is rather the point.