Dokkan Team Sharing

Privacy Policy

Last updated: October 10, 2026

Dokkan Team Sharing (dokkants.emanuelemelini.dev) is a free, non-commercial fan site run by Emanuele Melini, an individual based in Italy, who is the data controller. You can reach me at privacy@emanuelemelini.dev.

You can browse every page without an account. Personal data is collected only when you sign in, and only what the site needs to work.

What is collected and why

  • Your account. Your email address and whether it is verified, the id of your account at the sign-in provider you chose (Discord, Google or Twitch), the name and profile picture link that provider shares (used only to suggest a handle, never shown), and the handle and game version you pick. This is needed to give you an account (performance of a contract, GDPR Art. 6(1)(b)).
  • Display preference. Whether card pages show the still or the animated artwork by default, stored with your account until you change it or delete the account. Same legal basis as above.
  • What you post. Clears (teams, builds, notes and proof links), comments, tips (short advice with an optional link) and votes. Clears, comments and tips are public together with your handle. Votes count toward public scores, including the Helpful count on tips, but who voted is not shown. Same legal basis as above.
  • Your public profile. Your handle has a public page at /users/your-handle. It shows your handle, the game version you play, the month you joined, how many clears you shared, how many upvotes they received and how many comments you wrote, and the list of your clears. It never shows your email, your sign-in provider, its name or picture, or your role. The profile of a suspended account is not shown. If you change your handle, your old handles stay reserved for your account so nobody else can take them, and links to them lead to your new one. Same legal basis as above.
  • Reports and moderation. When you report a clear, a comment or a tip, the site stores your account, the post, the reason you picked, the details you wrote, if any, and the time. Only moderators (accounts the site owner gives the admin role) see reports; the author of the post is not told who reported it. When a moderator hides or restores a post, closes reports or suspends an account, an entry goes into a moderation log: the moderator's account and handle, the action, the id of the post or account and of its author, how many reports it closed, a private note of the moderator and, for a suspension, its end and reason. The log never copies the text of the post. If your account is suspended, the end date and the reason are stored with your account and shown to you. This keeps the site safe and fair for its users (legitimate interest, GDPR Art. 6(1)(f)).
  • Notifications. When someone comments on one of your clears, or a moderator hides or restores one of your posts or suspends your account or lifts a suspension, the site stores a notification for you: its type, the post it is about, the account that caused it (for a comment, the commenter; for moderation, the moderator, whose handle is never shown to you), when it arrived and when you read it. Moderators also get one when a new report is waiting, without saying who sent it. A notification never copies the text of a post, and nobody is told who reported their post. Only you can see your notifications. Same legal basis as your account.
  • Site activity for moderators. A moderator can turn on, in Settings, a feed of what happens on the site. For each action another member takes (posting, editing or deleting a clear or a tip, commenting, voting, marking a tip Helpful, reporting, joining, changing their handle, deleting their account) and for the actions of other moderators, that moderator gets a notification which stores who acted (a link to the account, shown with its current handle), what they did and where: the post, or for a deleted post only the event and stage. For a report it stores only the post, never who sent it. It never stores the text of a post or the reason or details of a report, and it never goes by email. When an account is deleted, its handle no longer appears in any notification: the ones about that person or their posts are deleted, and in the others the person shows up only as "Someone". If a moderator stops being one, the feed is turned off and its notifications are deleted. These notifications are kept like the others, below. This helps moderators keep the site safe and fair (legitimate interest, GDPR Art. 6(1)(f)).
  • Browser notifications. Off unless you turn them on in Settings, on each device separately. If you do, the site stores what your browser gives it for that device: the address of its push service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge on Windows), the keys that encrypt the notification so that only your browser can read it, a rough name such as "Chrome on Android", when it was added and last confirmed, and whether recent deliveries worked. It also logs when a notification was sent, to whom and because of which account, to limit how many go out. A notification says who commented and on which event, that a moderator updated one of your posts or your account, or how many reports are open, and for a moderator with the site activity feed on, who did what and where; it never shows the text of a post or who sent a report. The push service sees when a notification reaches your device, but not what it says. Your consent is the legal basis (GDPR Art. 6(1)(a)). You can withdraw it at any time: turn notifications off or remove a device in Settings, or block notifications for this site in your browser. Signing out also removes the device you sign out from.
  • Email digest. Off unless you turn it on in Settings. If you do, the site stores when you agreed and when it last sent you a digest, and once a day at most, only when something is new, it emails your account's address a summary of your unread notifications and how many upvotes and Helpful votes your posts got, without saying who gave them. Moderation is only mentioned in general terms, and the digest never copies the text of a post. Your consent is the legal basis (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every digest or in Settings; this stops future digests and does not affect the ones already sent.
  • Email counts. To stay within the email provider's daily and monthly limits, the site counts how many sign-in emails and digests it sends each day. The counts are just numbers per day: no addresses and no accounts (legitimate interest, GDPR Art. 6(1)(f)).
  • Security. While you are signed in, your session is stored with the IP address and browser identifier it started from, and short-lived counters by IP address and email address limit sign-in attempts and sign-in emails. This protects the site and its users from abuse (legitimate interest, GDPR Art. 6(1)(f)).

There are no passwords, and the access tokens of sign-in providers are not kept. There are no ads, no analytics, no trackers, and your data is never sold.

Cookies

One cookie keeps you signed in, and a few short-lived ones protect the sign-in step from forgery while it happens. They are strictly necessary, so no consent banner is needed. Nothing is set when you only browse.

If you switch a card's artwork between still and animated on its page, your browser remembers that choice in its local storage, for the last 200 cards. It stays on your device and is never sent to the site; clearing your browser data removes it.

If you turn on browser notifications, your browser also keeps in its local storage your handle and when it last checked its notification setting with the site, so it does that at most once a day. Signing out removes it.

Who else handles the data

These services process data on the site's behalf, only to run it:

  • Vercel (hosting of the site)
  • Supabase (the database)
  • Cloudflare (domain and card images)
  • Resend (sending sign-in emails and, if you turn it on, the daily digest)
  • If you turn on browser notifications, the push service of your browser: Google, Apple, Mozilla or Microsoft. It only carries the encrypted notification to your device.

The provider you sign in with (Discord, Google or Twitch) handles that step under its own privacy policy. Some of these services may process data outside the European Union, with the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

How long it is kept

  • Your account and what you post: until you delete them.
  • Your old handles: as long as your account exists. Deleting the account frees them, and someone else can then pick them.
  • Sessions: 30 days after your last visit, then removed.
  • Sign-in links: 10 minutes. Sign-in counters: 1 hour. The sign-in email log: 1 day.
  • The daily email counts: 40 days. Your digest consent: until you turn the digest off. The time of the last digest: as long as your account exists.
  • Reports: until a moderator handles them, then 180 more days. They are deleted earlier if you delete your account, or when the reported post is deleted.
  • Notifications: 30 days after you read them, or 90 days after the last update if you never do. They are deleted earlier with your account or with the post they are about.
  • A device for browser notifications: until you turn it off, remove it or sign out on it, until its push service says it no longer exists, or 90 days after your browser last confirmed it. The log of sent notifications: 2 days.
  • A suspension's end date and reason: until a moderator lifts it, or until you delete your account.
  • The moderation log: kept without a time limit, so that every decision can be checked and undone. When an account is deleted its entries stay, but only with ids that no longer lead to any account; a moderator's entries also keep the handle they had.

Deleting your account from Settings removes it immediately, together with everything you posted: clears, comments, tips, votes, the reports you sent, your notifications and your devices for browser notifications. Copies inside database backups disappear when those backups expire, within 30 days.

Your rights

You can ask to access, correct, export or delete your data, to restrict its use, or object to it, by writing to privacy@emanuelemelini.dev. You can delete your account yourself at any time. You can also complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it) or to the authority of the country where you live.

Age

You must be at least 16 years old to create an account.

Changes

If this policy changes, this page and its date are updated, and important changes are announced on the site before they apply.