Privacy Policy - Dexaroo

1. Who we are

Dexaroo is operated by Beweso ("we", "us", or "our"). We are the data controller for personal data processed through the service.

Operator: Beweso
Website: https://beweso.nl
Chamber of Commerce (KVK): 42167574
VAT number: NL005551579B77
Country: Netherlands
Privacy contact: info@dexaroo.com

2. What Dexaroo is

Dexaroo is an unofficial fan project for tracking a Pokémon TCG collection. Pokémon and all related names, characters, and images are trademarks of their respective owners. Dexaroo is not affiliated with, endorsed by, or sponsored by Nintendo, Game Freak, or The Pokémon Company.

3. Data we collect

Depending on how you use Dexaroo, we may process the following categories of personal data:

Account and profile data

Username, email address, and hashed password
Email verification status
Optional profile photo, avatar color, profile header color, and initials count
Profile visibility setting (public or private, premium only)

Security and authentication data

Two-factor authentication secrets and recovery codes (encrypted)
Session data, including IP address and browser user agent
Remember-me token when you choose to stay logged in

Usage and collection data

Which Pokémon you have marked as collected in your Pokédex, including timestamps
Leaderboard achievement badge selection displayed next to your name on the leaderboard
Appearance preference (light, dark, or system theme) stored in your browser

Anonymous usage statistics

Pages you visit, stored with a hashed session identifier (not your full IP address)
Approximate country of origin derived from your IP address or CDN headers at visit time; the IP address itself is not stored in visit statistics
The host name of the referring website, if your browser sends it
Raw visit logs are kept for 90 days; aggregated daily totals (pageview counts only) are kept permanently
We do not use third-party analytics cookies such as Google Analytics

Contact form data

Name (or username if logged in), email address, category, and message content
Contact messages are sent by email and are not stored in our application database

Billing data

Stripe customer ID, subscription status, billing interval, and payment method type and last four digits
Records of complimentary premium grants granted by administrators, if applicable

4. How we use your data

We use personal data to:

Create and manage your account and provide Dexaroo functionality
Track your Pokédex, achievements, leaderboard position, and trainer profile
Provide free and premium features, including profile customization and collection tracking
Process premium subscriptions and manage billing through Stripe
Operate Dexaroo, publish changelog updates, and respond to contact requests
Send transactional emails such as verification, password reset, and contact confirmations
Protect the service through rate limiting, fraud prevention, and security monitoring
Measure anonymous traffic and improve Dexaroo using self-hosted visit statistics

5. Legal bases for processing (GDPR)

We process personal data on the following legal bases:

Performance of a contract: to provide your account, Pokédex tracking, and requested features
Legitimate interests: to secure the platform, prevent abuse, moderate content, and improve the service
Consent: where required for optional processing, such as initiating a paid subscription through Stripe
Legal obligation: where we must comply with applicable law

6. Who we share data with

We do not sell your personal data. We share data only with service providers necessary to operate Dexaroo:

Stripe — payment processing and subscription management. Stripe Privacy Policy
Email delivery providers — to send verification, password reset, contact, and other transactional messages
Hosting and infrastructure providers — to run the application and database
Optional cloud file storage (such as AWS S3) — if configured for profile photo storage; otherwise photos are stored on our server

7. Public visibility

Certain information is visible to other users by design:

Trainer profiles may show your username, avatar, collection stats, caught Pokémon, and customization choices
The leaderboard shows your username, avatar, collection size, and completion percentage to authenticated users
Premium users may display additional profile elements such as generation progress, and may choose a leaderboard achievement badge

If you enable a private trainer profile (premium feature), guests who are not logged in cannot view your profile page. However, your username, avatar, and collection statistics may still appear on the leaderboard to logged-in users.

8. Cookies and similar technologies

Dexaroo uses the following cookies and similar technologies:

Session cookie — required to keep you logged in and protect forms
CSRF and Livewire cookies — required for secure interactive functionality
Remember-me cookie — only if you choose to stay logged in
Appearance preference — stored in your browser to remember light, dark, or system theme

We do not currently use third-party analytics or advertising cookies.

9. Data retention

Account and usage data is kept while your account is active
Unconfirmed accounts are deleted after 7 days; we send a reminder email after 1 day
Session data is retained according to our session lifetime settings and deleted when expired
Contact form emails are retained in our mailbox according to our internal retention practices
Stripe may retain billing records according to its own policies and legal obligations

10. Your rights

Under the GDPR, you may have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict or object to certain processing
Data portability, where applicable
Withdraw consent where processing is based on consent
Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise these rights, contact us at info@dexaroo.com or via our contact page. Contact

11. Account deletion

You can delete your account from your settings. This removes your account data, Pokédex progress, leaderboard achievement badge selection, profile photo, and related records from our application database.

If you have an active Stripe premium subscription, please cancel it through the billing portal before deleting your account. Account deletion does not automatically cancel an active Stripe subscription.

12. Children

Dexaroo is not intended for children under 16 without parental consent. If you believe we have collected data from a child without appropriate consent, please contact us.

13. International transfers

Some service providers, including Stripe and email providers, may process data outside the European Economic Area. Where this occurs, appropriate safeguards such as Standard Contractual Clauses may be used.

14. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last updated. Continued use of Dexaroo after changes means you accept the updated policy.

15. Contact

For privacy questions or requests, contact us at info@dexaroo.com or visit our contact page. Contact