Privacy

What the waitlist form collects

If you submit the waitlist form on the home page, we store the email address you typed and a salted hash of your IP address. The hashed IP is used only to rate-limit the form against repeated submissions from the same network — we never reverse it, share it, or use it for any downstream purpose.

We do not collect your name, address, phone number, payment information, or any other personal information from this site. The waitlist form is the only place on this site that asks for information about you.

Why we collect it

To send you a confirmation email (so we can verify the email address belongs to you), and to email you a small number of launch updates. Two emails total, maximum: one when the closed beta opens, one at public launch. No other marketing email is sent from this address.

How long we keep it

Waitlist records are kept for up to eighteen months from the date you signed up, then permanently deleted. If you confirm your email or unsubscribe, that activity extends the retention clock so we don't prune a still-relevant record out from under you. Once deleted, the record is gone — there is no soft-delete or undo window.

You can remove yourself at any time before the eighteen-month window closes by clicking the unsubscribe link in any email we send you. No login is required.

Who we share it with

No one. We do not sell your email, share it with partners, hand it to advertisers, or feed it to data brokers. The only systems your email passes through are the ones we use to operate the site itself: our database hosting provider and the transactional email service that delivers the confirmation and launch emails.

Hosting and infrastructure

• DNS is hosted by Namecheap.
• The site is hosted on Vercel.
• Waitlist records are stored in Supabase (Postgres) with row-level security enabled — only the server-side waitlist endpoint can read or write them.
• Transactional emails (confirmation, launch updates) are delivered by Resend.
• Aggregate request analytics use Vercel Web Analytics, which is cookieless and does not fingerprint visitors.

What we do not use

• No Google Analytics.
• No Meta Pixel or Facebook tracking.
• No third-party fingerprinting or session-replay JavaScript.
• No advertising trackers of any kind.

How to request deletion

The fastest path is the unsubscribe link in any email we send you — it removes your record without requiring a login. If you submitted an address you no longer control, or want a full hard delete on demand, email hello@pokedrop.club from the address in question and we'll remove it within a few business days.