Privacy

Last updated 27 August 2026. This describes what hailsDotGO actually does with your data, on the website and in the Android app. It is written to match the code rather than to cover every eventuality, and it is deliberately short.

The IV scanner captures your screen

This is the part worth reading. When you tap the scanner in the Android app, it captures one frame of your entire screen and reads it twice: once on your device, and once by sending that frame to this server, where a recogniser reads the level arc, recovers a nicknamed Pokemon from its candy label, and corrects a partly hidden CP.

The frame is the whole screen, not a crop of the Pokemon. Anything else visible at that moment, such as a notification banner or a message preview, is part of the image.

The image is held in memory and processed. It is not written to disk on the server, and not stored anywhere afterwards. Release builds of the app do not write it to your phone either.

You can turn this off. In the app, under App settings, switch off Server-assisted scan and the frame never leaves your device. The on-device reader is less accurate, and often cannot resolve IVs on its own, which is why the server pass exists.

The values read from a scan, such as the species, CP, level and stardust cost, are written to the server log. The image is not.

Your account

An account stores a username, an email address, and a password kept only as a bcrypt hash. Optionally it stores a trainer name, friend code, trainer level, pronouns, avatar, favourite Pokemon, and a city, region and country if you choose to enter them.

You control how much of that is public. The location display setting can hide your location entirely, show only your country, or show your city and region. A private profile hides your trainer name and friend code from other trainers.

Anything you save yourself, such as your Pokemon box, shiny collection and raid history, is stored against your account.

The app

If you allow notifications, the app registers a Firebase Cloud Messaging token with this server so it can tell you when a raid you joined is ready. The token is stored with the device model name, and is removed when you sign out.

Signing in stores a session token on your device in encrypted storage.

Other trainers

Raid lobbies, trainer feedback, player reports and bug report threads are visible to the people involved, and to site staff who review them. Reports are read by a human.

Third parties

There is no advertising, no analytics, and nothing is sold or shared for marketing. Payments for supporter items are handled by PayPal, which receives what it needs to take the payment; this site never sees your card details.

Pokemon sprites and event artwork are loaded from public sources including PokeAPI and LeekDuck, and trainer avatars from Pokemon Showdown. Requesting an image tells that host your IP address, as any image on any website does.

Deleting your data

Ask, and the account and everything attached to it is deleted: shinies, raid history, reports, messages, the lot. There is no automated button for this yet; contact a staff member through the reports page and it will be done.

A deleted account leaves the site immediately. It stops appearing anywhere, it can no longer be signed into, and its sessions end there and then. The record underneath is held for 90 days after that, so an account deleted by mistake can be put back, and is then erased for good.

If you would rather it were erased outright with no holding period, say so when you ask and it is done that way instead. Nothing is kept back either way: the 90 days exist to make a mistake fixable, not to keep your data.

The site is not affiliated with Niantic, The Pokémon Company, or Nintendo.