What Agent Rotom stores, what stays in your browser, what a sign-in adds, and what the site deliberately does not collect.
Effective 2026-10-07
The calculator runs entirely in your browser. Your teams are saved on your device and are sent nowhere unless you choose to sign in.
No advertising is served on this site today, and the build contains no advertising code. If that changes, this page changes first — see Advertising.
Google Analytics sets two cookies to count return visits, and only if you allow it: in the EEA, the UK and Switzerland it asks first, and everywhere else one tap turns it off — see Cookies. The visit count is cookieless, and nothing else sets a cookie unless you sign in. When the app itself breaks, an error report goes out — Error reports says what is in one.
Agent Rotom runs this site as a personal project, and is the one person responsible for everything described on this page. For anything here, including a request to see or delete what is held about you, write to support@agentrotom.com.
Signed out, the app keeps seven things in your browser's local storage, and reads none of them from a server:
agentrotom.profile.v1 — the trainer name you typed and the language you chose.agentrotom.teams.v1 — the teams you have built.agentrotom.builder.v1 — the team you are drafting in the builder and the opponents you set it against, so closing the tab does not lose the work.agentrotom.deleted.v1 — the ids of teams you deleted, so a delete on one device is not undone by another.agentrotom.onboarding.v1 — which first-run tours you have already seen.ar_install — the day you first opened the site, on how many different days you came back, and whether the offer to install the app was shown or dismissed, so it is made once, and only to a returning reader.ar_push — whether you were already asked about notifications, so you are asked once. The notification switches themselves are on the server; see Notifications.Clearing site data for agentrotom.com in your browser removes all seven, along with your answer to the cookie banner (ar_consent, see Cookies). Nothing about them is recoverable afterwards, by us or by you.
The site also installs a service worker so it keeps working offline. It caches the pages and files you have visited, on your device, and sends nothing. If you turn notifications on, it is also what receives them and shows them.
Signing in is optional. It uses Google or Discord; there is no password, so there is no password to store or lose. What signing in writes to the database, in full:
Google and Discord each receive the fact that you signed in to Agent Rotom, because that is what an OAuth sign-in is. What they do with that is governed by their own privacy policies.
Two further rows exist only if you use the supporter tools, and are described under the supporter tools below.
Notifications are off unless you turn them on, and they belong to a device, not to an account. Turning them on in one browser does nothing for your other devices. When you turn them on — on Profile, at the end of an issue, or when the installed app first asks — your browser asks for your permission, and then one row is kept for that device:
Asia/Seoul), so notifications arrive between 10:00 and 20:00 your time.None of it is tied to an account, a name or an email address, whether or not you are signed in, and none of it is sent to Google Analytics.
A notification travels through your browser's push service — Apple's for Safari, Google's for Chrome, Edge and the other Chromium browsers, Mozilla's for Firefox — which delivers it to your device. The message is encrypted for your device, so the push service carries it without being able to read it.
For each notification sent, one delivery record is kept per device: which notification, which device row, your local day, and whether the push service accepted it. It is what keeps notifications to one a day. Delivery records are deleted after 90 days.
Turn notifications off on Profile, or in your browser's or phone's settings for this site. Turning the last topic off deletes the device's row at once. If you revoke the permission or remove the app instead, the push service tells us the address is gone the next time we send, and the row is deleted then; an address that keeps failing is deleted too.
Two cookies belong to Google Analytics, and you decide whether they are set. Both are set on agentrotom.com itself, and each lasts up to 13 months from your last visit:
_ga — a random id, so a returning browser can be told from a new one and the link that first brought it is remembered._ga_KZQ29MJTSY — this property's session count and the time of your last visit.In the EEA, the UK and Switzerland they are not set until you press Accept. Everywhere else they are set unless you turn them off. Ad storage, ad personalisation and Google signals are off everywhere, and no user id is sent, so nothing joins your visits across devices.
Your answer is kept in local storage as ar_consent: granted or denied, and when. It records your own choice, so it is kept without asking. To change it, use Cookie settings at the foot of every page, and in the app on Profile and in the menu; turning the cookies off deletes both at once.
Signing in sets a session cookie. It is httpOnly, so no script can read it; sameSite: lax, so it is not sent from another site; and secure everywhere except a local development server. It is scoped to this site with no subdomains, it expires after thirty days, and it is refreshed at most once a day. It exists to keep you signed in and is not a tracking surface.
The sign-in also sets one more cookie, for about five minutes. It holds a signed random value that is checked against the one Google or Discord hands back, which is what stops somebody else's sign-in being finished in your browser. It is gone before you are signed in, and with the analytics pair above, these are the only cookies this site sets.
Signing out clears the session cookie.
Google Analytics 4 is on, with the two cookies above when you allow them. The property is G-KZQ29MJTSY. With the cookies it can tell a returning browser from a new one, which is how return visits and the channel that first brought a reader are counted; without them it sends cookieless pings and counts every page load on its own. What reaches Google is the page being viewed, the address you arrived from, the reports below, the page's language (site_lang), whether the page is open as the installed app or in a browser tab (display_mode), and what any server can read off the request itself, including the approximate location of your IP address and your browser and device. No report carries a user id or anything you typed, and none is used for advertising.
The app reports how it is used, and nothing about what you build. There are thirteen of these reports: which tab you moved to inside the calculator; that a share link was asked for and how that turned out; that a shared link was opened at the other end; which group of results home's search sent you into, that you went through to the meta board instead, or — when it matched nothing — which of the three doors you left by, the board, the breakdowns or the Pokédex; that the featured shelf was opened, by a card or by its see-all link; that a published team breakdown was analysed or saved, that its video was followed, that more of the list was asked for, or that you went on from it to another team by the same creator or to a similar team; whether a pasted team was imported or the sheet was closed instead; which of the nine languages you switched to; which of the two formats you chose, and on which screen; that a guided tour was started, finished or skipped; that a sign-in was begun, and whether with Google or Discord; that the meta board was filtered, moved to another regulation, or opened into a composition; and, on the home page, which of the three Pokémon lists — most used, rising or falling — you switched to, and that a Pokémon, a team, or the link beside either section was opened from there. Four more come with the installed app and notifications: that the app was installed to a home screen; that our own ask for notifications was shown, and where — the installed app's first open, after signing in, Profile or the end of an issue; that notifications were turned on from it, and for which of the two topics; and that they were turned off on Profile. A visit opened from a notification arrives with utm_source=push and the kind of notification in its address, and is counted as coming from one. Every value those seventeen send is one fixed word chosen from a list written into the source — never a team, a Pokémon, a spread, a search, or anything else you typed. The weekly digest pages send two more, and they carry addresses rather than fixed words: when a link inside an issue is followed, which issue it was in, the address it led to and what kind of page that is; and when one of the page's own links — to the previous or next issue, to the full list, to another language, or from the list into an issue — is followed, the page it was on and the page it led to. Every one of those addresses is a page we published — on this site, or a YouTube video an issue links to — and never anything you typed. Tab changes are reported because they never appear in the address bar, and so are invisible to Google otherwise. The analysis of your own team is not on that list: pressing ANALYZE TEAM on a breakdown we published says something about that page, and what the calculator then works out about your six never leaves your browser.
The site is hosted on Cloudflare Pages. Cloudflare handles every request as the host and keeps the request logs any host keeps.
Cloudflare Web Analytics is enabled. It counts page views, referrers and country. It sets no cookie, stores no identifier, and does not fingerprint or follow visitors between sites.
The app reports its own crashes. This site is static documents on a CDN with no server of its own behind them, so a page that breaks in your browser leaves no trace anywhere and nobody would ever hear of it. The reporter is Sentry, run by Functional Software, Inc. in the United States, and that is where a report goes.
A report carries the error and the place in the code it came from, the address of the page you were on, your browser and its language, and a short trail of the clicks and page changes just before it. No name, no account and no email address is attached, and request bodies are switched off, so a team on its way to being saved is never inside one. Sentry's servers see the IP address a report is sent from, as any host must in order to receive it; it is not stored on the report.
Nothing is sent on an ordinary visit. The part of a tool like this that pings on every page view — session tracking — is switched off, so your browser reaches Sentry only when something has actually gone wrong. A report is deleted 30 days after it arrives.
Three, and none of them is there to follow you between sites. The fonts, the artwork, the sprites and the data files all come from agentrotom.com. What does not: the visit-counting beacon described above and Google Analytics, both of which load on every page — the Analytics tag from googletagmanager.com, sending what it measures to google-analytics.com — and the error reporter, which your browser contacts only when something has broken. All of them see the IP address the connection comes from, the way any host does.
Everything else is something you start: signing in sends you to Google or to Discord, and connecting the supporter tools to an AI assistant opens the sign-in flow described below.
No advertising is served on this site today. No ad network's code is in the build, no ad cookie is set, and no reader's browser contacts an ad server because of this site.
Advertising is being considered. If it is introduced, this page will be updated before the first ad is served, and the update will name the network, say what cookies or identifiers it sets, and link to the way out. Readers in the EEA and the UK will be asked for consent through a certified consent platform before any personalised ad is served.
The paragraph below is a draft for the day ads ship, and it must not be published before they do. It is shown here so the wording is settled in advance; it is not a description of the site as it stands.
Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or to other sites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You can opt out of personalised advertising in Google's Ads Settings, and you can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info.
The meta board is built by reading public Pokémon Showdown replays and folding the teams in them into a list of distinct builds. Two choices in how that is stored are worth stating, because they are the difference between a corpus about teams and a corpus about people — and one further thing is worth stating because the tables do record it:
No account identity is kept, hashed or otherwise. Not the player's Showdown name, not a hash of it, not a salted hash of it. There is nothing in the table a name could be recovered from or checked against, because nothing derived from one was ever written.
Times are kept to the day, on purpose. Each build and each team composition records the first and last day it was seen, and no clock time is stored against either. A precise timestamp on a rarely-seen team narrows it to a handful of public battles and from there to a person; a day does not.
For each day, the corpus also records how that day went. For a given build or team composition and a given day it was played, one row counts the sightings; how many of those came from a battle log complete enough to say anything further; and, of those, how many reached a result, how many were won, how many were rated, and how many were tournament rather than ladder games. It also counts how many of those logs recorded a final turn number, and adds those numbers together. On a day when a build was seen once, that row therefore describes one battle: whether it was rated, whether it was won, and how many turns it lasted. Nothing in it names or points to a player.
Separately: nothing you build in the calculator is sent anywhere. The analysis of your team happens in your browser, on your device, and there is no event, no ping and no telemetry behind it. Two things can leave, and neither of them is your team. One is an error report when the page itself breaks, which carries the fault — see Error reports. The other is a bug report, if you choose to send one: the button on the profile tab opens a draft in your own mail program, prefilled with which build and regulation the app is on, the language you are using, whether you are signed in but never who, how many teams you have (a count, not the teams), the size of your browser window and its pixel density, whether the app's offline cache is active, your browser's user agent, and the time the draft was opened. It is a draft: you read it, you edit it, you delete any line of it, and nothing is sent until you send it.
Agent Rotom offers an MCP server, so a supporter can query the same data from an AI assistant, and list, save and delete their own stored teams through it. It runs separately from the site and is reached only with a bearer token, and it keeps four things: whether your account may use it at all — your account id, the date that entitlement runs out if it has one, where it came from, and a per-account call limit where one has been set; the granted authorisation — your account id, your email address and the scopes you approved; a count of how many calls your account has made today, so one heavy reader cannot starve the rest; and a daily count of anonymous client registrations, which is a number with no identity attached to it.
If you do not use it, none of the above exists for you.
Where the law where you live gives you rights over your data — to see it, correct it, take it elsewhere, or have it erased — those rights apply, and the address above is how to use them.
This site is a competitive-play tool and is not directed at young children. No age is asked for anywhere on it, and none is stored: no account is required to use the site, and nothing about a reader is collected unless they sign in.
Signing in is possible only through a Google or a Discord account, and each of those services sets its own minimum age. If you are a parent or guardian and believe a child has signed in here, write to support@agentrotom.com and the account, and the teams saved against it, will be deleted.
When this notice changes materially, the date at the top of the page moves and the change is described here. A change that introduces a new recipient of your data — an advertising network above all — will be published before it takes effect, not after.
2026-10-07 — The app can be installed, and can send notifications. You can add Agent Rotom to your home screen and turn on notifications; Notifications says what is kept for a device that does, and Analytics lists the four reports that came with them.
2026-10-07 — Google Analytics now sets cookies, if you allow it. In the EEA, the UK and Switzerland they are set only after you accept; everywhere else they can be turned off from Cookie settings. Cookies names the two and says how long they last.
2026-09-17 — Google Analytics was switched on, set up to place no cookie and to store no identifier in your browser. It was described here before the tag shipped; Analytics says what it sends and what it cannot do.
2026-09-17 — A bug report button was added to the profile tab, which opens a draft in your own mail program and sends nothing on its own; What is deliberately not collected says exactly what the draft contains.
Questions: support@agentrotom.com.