Legal & privacy

Operator & contact details

Document version: 4 November 2026. These drafts describe the intended UK beta. No contract text can remove rights that the law protects.

1. Terms of service Draft

Service scope

PokéDrop is an independent collector-information platform. The beta provides product information, saved watchlists, buying preferences, reviewed announcements and loyalty rewards. Live stock monitoring, notification delivery, paid plans and automated purchasing are unavailable unless the app explicitly confirms that they are connected.

Retailers control their stock, prices, order acceptance, delivery and returns. Information may change between a post and checkout. Check the retailer's current product page. PokéDrop does not reserve stock, guarantee an allocation, act as the retailer, or promise a successful purchase.

Accounts and eligibility

The intended beta is for adults aged 18 or older. Account holders must provide accurate information, use a unique password, protect their sign-in credentials, and report suspected compromise. Accounts and permissions are personal. An approved announcer must not transfer their publishing access.

You may close your account through Profile. Session controls include logout and revocation of all sessions. We may proportionately restrict an account for credible security threats, fraud, unlawful activity or material policy breaches. Where appropriate we will explain the reason and provide a route to challenge the decision once support is operational.

Acceptable use

Do not attack the service, bypass access controls, impersonate another person, publish malicious or misleading links, post unlawful content, infringe others' rights, automate reward abuse, create sham referrals or manipulate balances. Do not use PokéDrop to evade a retailer's purchase restrictions or anti-bot controls.

Buying preferences and retailer links

Smart Buy currently saves preferences only. It does not grant PokéDrop authority to spend money, store payment credentials, prepare checkout or submit orders. Any future purchasing integration would need separate permissions, explicit limits, retailer approval and additional terms.

Availability and responsibility

We aim to provide accurate information and reliable access, but may need maintenance or corrections. Nothing in these terms excludes liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded. Consumer statutory rights remain unaffected. A final liability framework must be reviewed for the actual operator and service before paid sales.

Changes, complaints and law

We will identify material changes and explain when they take effect. Changes will not retrospectively remove accrued statutory rights. Contact the operator using the details above once published. The proposed governing law is England and Wales, subject to mandatory consumer protections and any right to bring proceedings in a court available to you under applicable law.

2. Privacy notice Draft

This inventory reflects the deployed backend, but lawful-basis decisions, operator identity, hosting region, transfer safeguards and provider contracts must be confirmed before account enrolment opens.

Information the service handles

• Public browsing: the server receives network/request information needed to deliver and protect the website. Application access logging is disabled. Short-lived rate-limit keys use a server-keyed hash of the connecting IP address.
• Accounts, when enabled: email, trainer name, bio, badge, password hash or verified Google identifier, terms acceptance version and time, sessions, and account role. We never store a readable password.
• Collector data: watchlists, preferences, Smart Buy rules, post submissions and moderation outcomes, reward ledger and unlocked cosmetics.
• Security and administration: minimal account/action identifiers, event type and time. Invite and recovery tokens store as hashes and expire.

Purposes and proposed lawful bases

Account and requested collector features would rely on performance of the user agreement where appropriate. Proportionate fraud prevention and service security would rely on documented legitimate interests. Legal obligations may apply to business records. Optional marketing would require a separate appropriate consent or other verified lawful route. No marketing programme is active. The operator must document the actual bases before activation.

Recipients and international transfers

The VPS is hosted by OVHcloud. If enabled, Google handles sign-in and the configured email provider handles verification and recovery messages. The service does not send payment information or Telegram messages because those integrations are not connected. We do not sell personal information. The hosting region and any applicable UK international-transfer mechanism must be checked and disclosed before onboarding.

Retention

Session records expire within 24 hours, with a 2-hour idle timeout. OAuth state expires after 10 minutes. Verification and recovery links expire after 30 minutes, and invitations after 48 hours. Expired records are purged during routine application maintenance. Rate-limit records expire after their short operational window, up to one hour. Security audit events retain for up to 90 days, subject to earlier account-deletion handling and any documented legal exception.

Account data stays while the account remains active unless the user deletes it. Account deletion removes the profile, saved records, posts, reward records and sessions from the active database. Encrypted local backups rotate after 7 days. A deleted account may remain in these encrypted backups until expiry. Off-site disaster-recovery storage is not configured. Financial retention rules will be disclosed before payment processing begins.

Your rights and controls

Profile provides account-data export and deletion. You may also have rights to access, correct, erase, restrict or object to processing and to data portability, depending on the circumstances and lawful basis. Contact the published privacy address when available. You can complain to the Information Commissioner's Office. You do not have to contact us first.

The beta is intended for adults. Do not create an account if you are under 18. We do not currently use advertising trackers or profiling for credit, employment, insurance or similar decisions.

3. Cookies & storage

The new app uses essential sign-in cookies and a local display preference. It does not load advertising or analytics trackers. Optional tracking must remain off unless an appropriate consent mechanism and notice are in place.

Previous browser-demo data, if you used the earlier version, stays on that device until cleared. It is not imported into real accounts or coin balances. Use your browser's site-data controls to remove it. Clearing site cookies signs you out. The local theme setting can be changed from the app header.

4. Community & announcer agreement Draft

Only administrators may grant or revoke the announcer role. Approval confirms permission to contribute to PokéDrop, not endorsement by a retailer or The Pokémon Company. Contributors cannot verify themselves or purchase verification with coins.

Announcers must verify source links, describe availability accurately, distinguish confirmed details from uncertainty, disclose affiliations or incentives, and promptly report errors. Do not post counterfeit offers, phishing links, personal information, affiliate links without disclosure, fabricated scarcity or content you have no right to share.

Submissions enter moderation before publication. An administrator other than the author must review a submission. Moderators may reject, remove or correct content for accuracy, rights, safety or policy reasons. Publication carries an Exclusive label describing the post category, not a guarantee of exclusive stock or privileged retailer access. Support and appeal details will be supplied before community onboarding.

Contributors retain ownership of their original content. By submitting, they would grant a non-exclusive, royalty-free licence limited to storing, reviewing, formatting and displaying the submission within the service and its enabled alert channels. Any wider promotional use needs a separate permission. Contributors must hold the rights necessary for the content they submit. Account deletion currently removes that contributor's posts from the active platform.

5. PokéDrop Coins rewards terms Draft

PokéDrop Coins are non-transferable loyalty points recorded on the service's server ledger. They have no cash value, cannot be purchased, withdrawn or transferred, and are not cryptocurrency, investments, deposits or a promise of a future blockchain token. Earlier browser-demo balances have no entitlement to migration.

The current mechanics are 100 coins once on eligible account creation and 10 coins for a user-initiated check-in once per rolling 24 hours. The server determines eligibility and time. There is no passive accrual or background mining. Server-side transactions prevent duplicate claims and negative balances.

Available cosmetic rewards cost 50 coins for a star badge and 150 coins for a golden trainer name. Confirm the coin cost before redeeming. Pro passes, partner perks, referral rewards and rewards for posts are unavailable. Displayed future concepts do not create an entitlement.

We may investigate fraud and correct documented errors or duplicate awards. Any forfeiture must follow a proportionate, explainable process with a support route once the programme opens. Material programme changes or closure should give reasonable notice where practicable. Coins disappear when the user deletes their account. They cannot buy announcer status, stock allocation or guaranteed purchasing access.

6. Subscriptions, cancellation & refunds Not active

No paid subscription, checkout or billing is currently available. Free / £5.99 Pro / £12.99 Elite are proposed monthly plans. Before any sale, the site must disclose the actual operator, included features, total tax-inclusive price, billing frequency, minimum term, renewal, cancellation process, support route and applicable consumer rights.

Final subscription terms must explain applicable cooling-off rights and a simple cancellation route. Any request to begin a service during a cancellation period must be separate, informed and recorded, with any lawful proportionate charge explained. Do not rely on a blanket waiver or a universal “no refunds” statement. Statutory remedies remain unaffected.

Retailer orders are separate contracts with the retailer. Its delivery, returns and purchase terms apply to goods bought there. PokéDrop must not imply responsibility for refunding a retailer transaction it did not take.

7. Intellectual property & affiliation

© 2026 PokéDrop UK. Created by WhyG & PokeStev. All rights reserved in original PokéDrop software, copy and design, subject to ownership arrangements, third-party licences and applicable law.

Pokémon names, characters, logos, product artwork and related trademarks remain with their respective owners. PokéDrop is independent and is not affiliated with, endorsed by or sponsored by The Pokémon Company, Nintendo, Game Freak, Creatures, Pokémon Center or any featured retailer.

Attribution does not grant commercial-use rights. Permission or another valid legal basis for the character artwork, branding and product imagery must be reviewed before commercial promotion. The current Pikachu artwork comes from the PokéAPI sprite collection. Any ownership or takedown request should use the operator's contact route once published.

8. Security & responsible disclosures

Protect your password and invitation or recovery links. PokéDrop will never ask you to send a password, payment card number, seed phrase or wallet private key in a drop announcement. There is no token sale or wallet connection.

Report suspected security problems privately through the security/support contact once available. Do not publish personal data or credentials, modify another user's data, disrupt service, attempt denial-of-service, or test the separately hosted trading application. This notice does not authorise access to other services or infrastructure.

We cannot promise that a service is completely secure. The operator should maintain incident response, backups, recovery testing, dependency updates and appropriate independent review. No company-wide security certification or independent penetration-test claim is made.