Pocamori
Support

Privacy policy

Last updated ·

What Pocamori stores, how sharing works, and the choices you have.

On this page

Who runs Pocamori

Pocamori is an independent card-binder and collection website operated by Thu Kha Kyaw in Vietnam. The operator is responsible for decisions about the personal information used to run Pocamori. Contact pocamori.support@gmail.com for privacy questions or requests.

This notice covers Pocamori’s website, accounts and support correspondence. External services such as Google, Ko-fi and PayPal also have their own privacy notices. This notice is effective .

Information we handle

  • Account details: Google account identifier, email address and profile information supplied through sign-in, which can include your name and profile picture. We do not ask for your Google password, access your Gmail inbox or require access to your contacts.
  • Saved content: binders, card selections, owned/wanted quantities, set checklists, notes, appearance settings and uploaded artwork. You choose what to enter; do not include sensitive personal information or another person’s private information.
  • Terms acknowledgment: account identifier, accepted Terms version, a fingerprint identifying its text and a server-recorded acceptance time. This is separate from the age record or any optional privacy consent.
  • Age confirmation: account identifier, confirmation time and confirmation version. This is an 18+ self-declaration, not identity or age verification. We do not request a birthday or ID for this check.
  • Account security: session identifiers, sign-in times and IP/browser/device details handled by the sign-in provider. Hosting and image providers also receive technical request information when your browser connects to them.
  • Preferences and local work: theme, search/view preferences, sign-in information and browser-local content. Some of this stays on your device rather than becoming a saved cloud record.
  • Unsaved binder drafts: while you edit, the binder editor keeps a copy of unsaved changes in this browser so they can be restored after a closed tab or sign-in. Drafts are not sent to Pocamori, are removed when you save or discard them or when the editor next opens signed out or under another account, and expire after 14 days.
  • Support: sender address, message, attachments and other information you choose to email. Signed-in feedback sends the report text, page category and any optional reply address/browser details you provide when you press Send feedback. Preparing, copying or downloading a report does not send it. The form does not attach screenshots, saved binder contents or sign-in credentials to the email.
  • Error reports: if a script error happens on Workspace, the editor, Discover, the binder viewer or Help, your browser sends a short report: the error message, a fixed page name, the script file and line, the site version and your browser family (for example Chrome or Safari). Email-like text, long codes and long numbers are removed from the message before it is sent and again before it is stored. The report does not include the page address, share links, your account, binder or collection contents, or cookies. At most five reports are sent per page visit, only on the hosted site. Reports pass through the same request gateway and per-visitor allowance described under Retention.
  • Optional support payments: Ko-fi or PayPal may provide your display/legal name, email, message, amount, currency, transaction reference and payment/refund status. What is supplied depends on their settings and the transaction. We do not receive your PayPal password or full payment-card credentials through the Pocamori website.

Why we use information

  • Recognize your account, save/reopen your work and provide the features you request.
  • Display a binder and its artwork to other people only when you enable link sharing.
  • Protect accounts, limit abuse, diagnose failures and maintain recovery backups.
  • Answer support/privacy requests, investigate reported content and handle voluntary support payments or refund requests.
  • Comply with applicable legal obligations and address legitimate disputes.

Where applicable law requires consent, we must obtain the relevant consent separately; reading this notice, merely visiting the site, or ticking the age box is not blanket consent to unrelated processing. Optional actions such as sharing, feedback diagnostics and payments are separate choices. Where processing without consent is permitted by law, it is limited to the applicable purpose and conditions. This notice does not itself create a legal exception.

Account details and saved work are needed for cloud features; without them, those features cannot operate. You can browse public Discover and the sample without an account. We do not sell or rent your personal information, use it for targeted advertising, or run a marketing analytics integration in this build. There is no automated decision-making that produces legal or similarly significant effects on users in this build.

Private content and shared links

Binders and collections are private by default. An enabled sharing link lets anyone who has it view the binder’s latest saved pages and referenced artwork without an account. Unsaved edits, Overflow and account details are excluded from that shared view.

Links can be forwarded, and viewers can save screenshots or copies. Disable or reset a link to stop subsequent access through it; this cannot recall existing copies or guarantee immediate disappearance from a viewer’s browser cache. Do not put confidential or sensitive information in shared content.

Private does not mean inaccessible to the operator or infrastructure providers: access may be necessary for service administration, security, recovery, support or legal requirements. Access should be limited to what is needed for that purpose. We may disclose information where legally required or necessary to protect people or address abuse, subject to applicable law.

Service providers and where information is handled

We use the following services to run Pocamori. Each receives the information needed for its role; opening a public card image does not send that provider your saved binder or account credentials.

  • Supabase — accounts and saved work. Handles your sign-in identity, email/profile information supplied by Google, sessions, saved binders, collection, notes, uploaded artwork and account-operation records. Our production and separate staging projects are configured in Singapore. Project placement does not guarantee that every provider support or security operation happens only there.
  • Google — sign-in and support email. Handles Google sign-in and messages, sender details and attachments you send to our Gmail support address. Pocamori does not request access to your Gmail inbox or contacts. These services operate internationally; we do not specify a single storage country for them.
  • Resend — feedback email delivery. Receives reports you explicitly send through the feedback form, including the report reference, message, page category and any optional reply email/browser details. It delivers them to our Gmail support inbox. Our sending domain is configured for Tokyo, Japan; this does not guarantee that every provider log, storage or support operation remains there. Resend may retain message and delivery records under its own policies and our account settings. The form sends no marketing email or automatic reply.
  • Cloudflare — website delivery, security and recovery storage. Handles website requests and connection details such as IP addresses and requested pages. Private R2 storage holds encrypted operator recovery archives; its reported location is Asia-Pacific, not a confirmed individual country. Website delivery operates across Cloudflare's international network. Restricted staging also uses an email/PIN access gate, separate from public-site Google sign-in.
  • TCGplayer, Impact and PTC Collectibles — affiliate links (only if you click). Opening a “Find on TCGplayer” or “Shop on TCGplayer” link takes you to TCGplayer through Impact’s referral service. Opening “Shop PTC Collectibles”, or using the code POCAMORIAPP at PTC Collectibles’ checkout, credits Pocamori as the referrer. Their own privacy policies apply on their sites.
  • Cloudflare Web Analytics — anonymous page counts. On the landing page, Discover, Workspace, Help, Privacy and Terms, a small Cloudflare script counts page views and records the page address, referring site, country, browser, device type and page-load timing. It sets no cookies, does not identify or follow individual visitors across sites, and is not used for advertising. It is not loaded in the binder editor or the binder viewer, so share links and editor content are not sent. Results are kept by Cloudflare for a limited period and viewed only as totals.
  • GitHub — source hosting and backup jobs. Hosts the private source repository. A GitHub-hosted backup job temporarily processes account identifiers, email addresses, saved binders, collection data and uploaded artwork, then encrypts the recovery archive before uploading it to private R2 storage. These archives are not published as repository files or downloadable workflow artifacts. The job is not configured to run in a particular country.
  • Healthchecks.io — backup monitoring. Receives backup start/success/failure signals and normal connection details from the backup job. We do not send saved binder content, account records or backup files in these notifications. We do not specify a single processing country for this service.
  • ImageKit, TCGdex, images.pokemontcg.io and cdn.pooka.app — public card pictures. Your browser sends the image address and normal connection details, such as its IP address and browser information, to the image host. We do not attach your Pocamori account token, email or saved binder document. Your uploaded artwork uses private Supabase storage instead. Image delivery may use servers in different countries.
  • Ko-fi and PayPal — optional external support payments. Opening Support takes you to Ko-fi; its payment provider handles any payment you choose to make. They may provide the operator with supporter name/email, message, amount and transaction or refund status. Pocamori does not collect full payment-card credentials. No checkout widget or payment-tracking script is embedded in this build. These providers process information internationally under their own notices.

International processing: your information may be stored or handled outside Vietnam, including in the known locations above and through providers' infrastructure, personnel and subprocessors in other countries. We do not promise that all information stays in one country. We use protected connections, account access controls, private artwork storage and encrypted operator recovery archives to help protect these flows. Encryption does not prevent all authorized access by the operator or providers.

Providers may also keep technical or security records and process information for their own account, payment or legal purposes under their notices. Their retention periods can differ from Pocamori's saved-content and backup periods below; we do not promise an exact deletion date for every provider-internal record.

Browser storage and cookies

Browser storage supports sign-in, theme/view preferences, unfinished work and browser-local binders. Some view state is limited to the current tab; other preferences/content can remain until changed, signed out where applicable, or cleared. Clearing site storage can sign you out and remove browser-only work. Export anything you need first.

Sign-in/security providers can use cookies or similar technologies for their functions. External sites opened from Pocamori have their own practices. We do not set advertising cookies or embed affiliate or payment tracking scripts. Anonymous page counting through Cloudflare Web Analytics uses no cookies. Card details may show a labelled TCGplayer affiliate link, and the landing page shows labelled TCGplayer and PTC Collectibles affiliate links and a PTC Collectibles code. Nothing is sent to these retailers or to Impact unless you click a link or use the code. When you click a TCGplayer link, your browser opens TCGplayer through an Impact referral address that identifies Pocamori as the referrer and includes the card search or TCGplayer’s homepage. The PTC Collectibles link opens their shop through a referral address that identifies Pocamori. These retailers and Impact may then use cookies or similar technologies to credit the referral and process any purchase, under their own privacy policies. Pocamori does not send them your account, binders or collection, and does not receive your purchase details. Affiliate reports may show us totals such as clicks, orders and commission, not who you are. The Impact ownership-verification meta tag is a public ownership marker, not an executable tracking script. Any future optional tracking needs a separate review and, where required, a genuine consent choice before it starts.

Retention and deletion

  • Feedback abuse and retry protection: limited account IDs, report references, content hashes and attempt times are kept separately from the message body. They are scheduled for hourly removal after seven days; daily totals expire by UTC day. Message contents are kept in the support inbox and email provider, not in these counters. Account deletion removes its linked feedback references, while anonymous daily sending totals remain until expiry.
  • Saved account content, age and Terms records: kept while your account remains active or until you remove the relevant content/account. There is no automatic inactivity-deletion schedule in this build. Unreferenced uploaded artwork can remain until you use Remove unused images in the account menu; the current tool checks items older than 24 hours, rather than deleting them automatically every day.
  • Account deletion: the deletion process removes saved cloud binders, collection data, uploaded artwork, age/Terms records and the sign-in account; sharing stops when its binder is removed. If an operation fails or only partly completes, contact support rather than assuming it succeeded. Deletion does not remove your separate Google, Ko-fi or PayPal account, local originals, downloaded backups or viewers’ copies.
  • Recovery archives: scheduled production R2 archives have a seven-day expiry rule, subject to provider processing delays. Separately created operator copies require manual cleanup. Recent deleted data can remain in a restricted recovery archive until expiry; it must not be reused as active account data merely because an archive is restored.
  • Request protection: to stop one visitor from slowing the site for everyone, requests made without signing in are counted against a short per-visitor allowance. The request gateway turns your network address into a keyed one-way code; the address itself is not stored. The code and its counter are deleted after about ten minutes without requests.
  • Error reports: identical reports are grouped by hour with a count, and the hosting database deletes them daily once they are older than 30 days. They are read only by the operator, through a once-daily summary posted to a private GitHub repository issue, which GitHub keeps until the issue is deleted.
  • Diagnostic counters: small daily account-operation/error totals are checked hourly; dates older than seven calendar days are eligible for removal. These are not full error messages or card notes, and should not be assumed anonymous. Outages, locks or backlog can delay cleanup.
  • Sessions and logs: sign-in sessions can renew and have no configured maximum age/inactivity timeout in the reviewed configuration. One-hour access-token expiry is not one-hour record deletion. The reviewed Supabase Free plan exposes one day of API/database dashboard logs; this is not a limit on every provider-internal record. GitHub workflow logs/artifacts are configured for 90 days. Hosting, security and other providers can retain additional records under their own terms, settings and legal obligations.
  • Support correspondence: manually reviewed each month for deletion once 90 days have passed since resolution. Open issues remain until resolved; reopening restarts the period on the next resolution. A justified dispute/legal hold may require longer retention and periodic review. Gmail normally keeps trashed messages for another 30 days; provider backups or legal retention can last longer.
  • Payment records: limited supporter/transaction records are retained as needed to reconcile payments, handle refunds/disputes and meet applicable accounting/tax duties. This can outlast account deletion or a support-email cleanup period. Provider-held payment records follow the provider’s own obligations. We do not promise that account deletion erases a financial transaction.

Security, fraud, legal claims or a binding retention requirement may justify keeping limited records longer. Such records should be restricted to that purpose, rather than kept indefinitely for convenience. Contact us about the reason and period applicable to a specific request.

Your rights and requests

You may have rights to know about processing, access or obtain your data, correct it, request deletion, withdraw consent, restrict or object to processing, and complain to a competent authority or seek other legal remedies. The rights, conditions and deadlines depend on the law applicable to your situation; this policy does not remove them.

Use Workspace → Your account → Data & backups to download saved application data or request account deletion. The download is an application backup, not necessarily every item of personal information held by us/providers. It contains private content and is not encrypted by the download feature. Restoring it replaces saved account content after confirmation.

For other requests, email pocamori.support@gmail.com with the request type and the account email if relevant. We will acknowledge and assess it promptly, verify identity using proportionate information, and respond within applicable legal time limits. We will explain any lawful refusal, restriction or permitted extension. Do not email passwords, sign-in links/tokens, full payment credentials or identity documents unsolicited.

You can disable sharing, decline optional feedback diagnostics, stop voluntary payments, or withdraw consent where consent is the basis of processing. Withdrawal does not retrospectively undo lawful processing, and stopping processing needed for an account feature may prevent that feature from operating. We will explain available choices rather than treat an unrelated optional choice as required.

Adults and account safety

The account beta is intended for people aged 18 or older. The checkbox is a self-declaration and does not prove age. If you are under 18, do not create or continue using an account; contact pocamori.support@gmail.com for help exporting or deleting existing content. An adult rule does not excuse ignoring a credible underage report.

To report a suspected underage account, exposed private information or a security incident, send the minimum details needed to locate the problem. We will review the report, restrict access where appropriate, and take deletion, notification or other measures required by applicable law. We do not need an ID document merely to receive a report.

Security and policy changes

We use access controls, private storage, protected connections and recovery measures. These reduce risk; no website can guarantee perfect security or uninterrupted availability. Keep your Google account and downloaded backups secure, and sign out on shared devices. Report suspected exposure to pocamori.support@gmail.com without copying other users’ private data into the message.

We will assess incidents and make legally required notifications to affected people and authorities within the applicable deadlines. Material policy changes will be identified by a revised date and brought to users’ attention by appropriate means. A new optional purpose that requires consent will not be authorized merely by changing this page.