Privacy Policy
Last updated: 2026-06-29
1. Data Controller
The data controller is Valerio Di Zio, reachable at [email protected]. The service is operated at https://championshub.pro .
2. Data We Collect
We collect only the data strictly necessary to provide the service:
- Email address and password — required to create and authenticate your account. Passwords are stored as secure hashes managed by Supabase Auth; we never see your plain-text password.
- Username — chosen by you at registration, used as your public display name.
- Bio (optional) — a short text you may add to your profile.
- Teams and Pokémon configurations — the data you create and save through the Team Builder. Public teams are visible to other users.
- Language preference — stored in a browser cookie to remember your language choice.
- Aggregated navigation statistics — page views and Core Web Vitals collected by Vercel Analytics and Vercel Speed Insights. These tools are privacy-friendly by design: they do not use tracking cookies, do not collect IP addresses, and do not create personal profiles.
3. Legal Basis for Processing
- Performance of a contract (Art. 6(1)(b) GDPR) — processing your email, password, and username is necessary to provide the account-based features you requested.
- Legitimate interest (Art. 6(1)(f) GDPR) — aggregated, anonymous analytics help us understand how the site is used and improve performance. No personal data is involved.
4. Cookies
All cookies used on this site are strictly necessary for the service to function. No tracking, advertising, or profiling cookies are used. No cookie consent banner is required under the ePrivacy Directive for strictly necessary cookies.
| Cookie | Set by | Purpose |
|---|---|---|
| sb-[project]-auth-token.* | Supabase | Authentication session (keeps you logged in). HttpOnly, Secure. |
| champions-lang | Champions Hub | Stores your language preference (IT/EN). |
| champions-consented | Champions Hub | Records that you have accepted this Privacy Policy. HttpOnly, Secure. |
| __cf_bm, __cflb, cf_clearance | Cloudflare | Set by Cloudflare (our CDN/security provider) for bot protection and load balancing. These cookies are strictly necessary for security and are exempt from consent requirements. They may or may not be present depending on active security features. |
Fonts: this site uses the Outfit and Rajdhani fonts via Next.js (next/font/google). These fonts are self-hosted and bundled at build time — no requests are ever sent to Google servers from your browser.
Analytics: Vercel Analytics and Vercel Speed Insights collect anonymous, aggregated metrics (page views, Core Web Vitals). They use no cookies, collect no IP addresses, and create no personal profiles.
5. Data Retention
Your data is retained for as long as your account is active. If you delete your account, all associated personal data (email, username, bio, and teams) is permanently removed from our systems within a few seconds.
6. Sub-processors (Data Sharing)
We do not sell, rent, or share your personal data with third parties for commercial purposes. Data is processed by the following sub-processors:
- Supabase (authentication and database hosting) — EU region (Frankfurt, Germany). Processes email, hashed password, username, bio, and teams.
- Vercel (application hosting and anonymous analytics) — EU edge nodes. Processes HTTP requests; analytics data is anonymous and aggregated.
- Cloudflare (CDN and network security) — acts as a reverse proxy for all traffic to this site. Processes IP addresses and HTTP headers for security purposes. Cloudflare is GDPR-compliant and certified under the EU-U.S. Data Privacy Framework.
- Resend (transactional email) — used only for account confirmation and password reset emails.
- Pokémon Showdown / Smogon (game sprites) — Pokémon sprite images are loaded directly from
play.pokemonshowdown.com. Your browser makes direct HTTP requests to this server to display sprites; as with any external image, the server receives your IP address. Pokémon Showdown does not set tracking cookies and is an open-source project operated by Smogon University.
7. Your Rights
Under the GDPR you have the right to:
- Access your personal data.
- Rectify inaccurate data (you can update your username and bio from your dashboard).
- Erasure ("right to be forgotten") — you can permanently delete your account and all associated data from the Account section of your dashboard.
- Data portability — you can export all your data as a JSON file from your dashboard.
- Object to processing based on legitimate interest.
To exercise any right, or for any privacy-related enquiry, contact us at [email protected].
You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Registered users will be notified of material changes by email. The date at the top of this page reflects the most recent revision.