Privacy & cookies
Last updated 16 July 2026
Chase Season lets you track the Pokémon cards you're hunting. This page explains exactly what we collect, why, how long we keep it, and how to get a copy or have it deleted. We keep it short and specific — no filler.
Who we are
Chase Season is a personal project run from the Netherlands — there's no company or Chamber of Commerce registration behind it. For anything privacy-related, email info@chaseseason.comand you'll reach the person who runs the site.
What we collect and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your chase list (card + when you added, removed or caught it), tied to a random device ID (cs_anon) | To remember what you're chasing without an account, and to count how many people chase a card | Necessary to provide the feature you asked for when you tap “Chase it” | 12 months |
| Account: email address, and name/avatar if you sign in with Google | To save your chase list and sync it across your devices | Necessary to provide the account you signed up for | Until you delete your account; active chase signals may remain as anonymous aggregate community data unless you choose to delete them too |
| Sign-in session | To keep you signed in | Necessary for the sign-in you requested | Until it expires or you sign out |
| Aggregate counts per card (how many chases, how many views) | They power the Chase Index | These are anonymous statistics — they identify no one | Indefinitely |
Cookies and local storage
We use no advertising or tracking cookies, and our analytics (Plausible) works without cookies. Everything we store on your device is needed for something you actively asked for — which is why you don't see a cookie banner here.
cs_anon— a random ID, set only when you tap “Chase it”, so we can remember your list. 12 months.better-auth.session_token— set only when you sign in, to keep you signed in.- Your chase list and the “dismiss” state of the sign-in prompt are stored in your browser's local storage, on your device. Clearing your browser data removes them.
Who else processes your data
We only share what these providers need to run the site, never for their own marketing:
- Vercel — hosting
- Prisma Postgres — the database
- Resend — sends your sign-in email (servers in the United States)
- Google — only if you choose “Continue with Google”
- Cloudflare Images — card images
- Plausible — cookieless, aggregate visitor statistics
Sending your sign-in link means your email address is processed in the United States by Resend. That transfer is covered by our data processing agreement with Resend, which includes the European Commission's Standard Contractual Clauses.
Your rights
You can do the two most important ones yourself, right now, on your account page:
- Get a copy — download everything we hold about you as a JSON file.
- Delete account — removes your personal account data and sign-in links. Active chase signals may remain as anonymous aggregate community data unless you tick the checkbox to delete them too.
You also have the right to have data corrected, to object to processing based on legitimate interest, and to restrict processing. Email info@chaseseason.comand we'll sort it out. If you're not happy with how we handle it, you can complain to the Dutch DPA (Autoriteit Persoonsgegevens).
Security
We don't use passwords at all — you sign in with a one-time email link or with Google, so there's no password for us to lose. Sessions live in cookies your browser won't hand to scripts (httpOnly) and can be revoked server-side.
Changes
If we change what we collect, we'll update this page and the date at the top.
Questions? Email info@chaseseason.com.