Last updated: 07 September 2026
Account information
The site stores your username, email address, securely hashed password, account status, permissions, and creation date in Cloudflare D1. Passwords are never stored as readable text.
Sessions and security
Essential session cookies keep you signed in. Active sessions store creation and expiry times plus limited browser/device information from the user-agent string. Password-reset tokens and session tokens are stored only as cryptographic hashes. Rate limiting uses a one-way hash derived from the connection address; the raw address is not stored by this application.
AI chat
If AI access is enabled, your messages are sent to Cloudflare Workers AI to produce replies. Daily message totals are stored per account to enforce usage limits. Chat history itself is saved locally in your browser rather than in the account database.
Wallpapers and local storage
Custom wallpaper files, display preferences, and AI chat history are stored locally in your browser. They do not automatically transfer to another device. Clearing browser data removes this local information.
Travel beta
If you use the Travel module, your selected experience, completed countries, visited cities, and Visit Journal entries are stored with your account in Cloudflare D1 so progress follows you between devices. Private journal photos are optimised before upload and stored in a non-public Cloudflare R2 bucket. Authenticated server checks protect every photo request. Extracted capture dates and GPS metadata are kept privately with the photo record. Photo place suggestions run only when the owner presses Scan photos: GPS coordinates are reverse-geocoded first, while photos without coordinates may be processed by Cloudflare Workers AI for low-confidence landmark suggestions that require confirmation. The city catalogue is sourced from GeoNames under CC BY 4.0. Country and state geometry comes from Natural Earth. Municipal boundary shapes for journalled cities are sourced from OpenStreetMap contributors through Nominatim and cached for the private beta. Geographic reference data is stored separately from private account data. The current beta is restricted to the owner.
Access and retention
- The owner can change permissions, revoke sessions, disable accounts, reset passwords, and permanently delete non-owner accounts.
- Account records remain until the owner deletes the account.
- Sessions normally expire after 30 days and reset links after one hour.
- Cloudflare processes and hosts application data needed to provide Pages, D1, and Workers AI.
Your choices
You can sign out at any time. To request account deletion, access changes, or a password-reset link, contact the site owner.
Cookies
The site sets a single strictly necessary session cookie (reshiram_session) so you can stay signed in; no advertising, analytics, or other non-essential cookies are used. Local-storage features (saved teams, preferences, chat history, wallpapers) stay in your browser. See the Cookie Policy for the full breakdown.
Third-party content displayed on the site
Pokémon sprites, card artwork, and game logos are loaded from third-party sources (including the PokeAPI sprite repository and pokemontcg.io) and are displayed for personal reference only; they remain the property of Nintendo, Creatures Inc., GAME FREAK Inc., and The Pokémon Company. Those sources may log standard request information (such as your IP address) under their own policies. Cloudflare, our hosting provider, processes traffic to deliver Pages, D1, Workers AI, and R2 as described above.
Operator and contact
The site is operated by the owner of the Reshiram platform for personal and invited-user use. Privacy questions, access requests, and deletion requests can be raised with the owner through the account tools on the site.