Privacy Policy
Pokist is a site for keeping and sharing lists of places. This page covers three things: what we store about you, what we do with it, and who to contact to get it back or have it deleted.
Pokist is operated by the Pokist team, which acts as the data controller for the information described here.
What we collect
When you sign in with Google, we receive and store:
- Your email address — this is your identity on Pokist. It is how we recognise you across devices and browsers.
- Your name and profile picture URL — shown on your profile and next to anything you write. You can change both in settings.
We never request or receive your Google password, contacts, Drive files, or email contents.
From your activity on the site, we store:
- Lists you create, places you add to them, and the notes you write about each place.
- Lists you save, creators you follow, and likes you give.
- Photos you upload.
- Error logs (what failed and on which page). These exist so we can fix problems and do not contain what you typed.
Legal basis
Where the GDPR or similar law applies to you, we rely on:
- Performance of a contract — to run your account and show you your own lists.
- Legitimate interests — to keep the service working and to diagnose errors.
- Consent — for the optional Instagram connection, which you can withdraw at any time.
What other people can see
If you make a list public, its title, its places, the notes you wrote, and your name and picture are public. Anyone can see them and search engines may index them.
Lists kept as drafts or limited to your followers do not appear on public pages and are not indexed.
Your email address is never public. It is used only to recognise you.
Where your data lives
- The site runs on Vercel. The database and uploaded photos are hosted by Supabase in Tokyo, Japan.
- A daily backup of the database is written to Cloudflare R2.
- Place names, addresses and coordinates come from Google Maps Platform. We send your search text and store Google's place identifier and basic facts — we do not store Google's photos, which are fetched fresh each time.
- If you connect an Instagram account, we store that connection's access token and use it only to read your own posts. You can disconnect at any time in settings.
If you are in the EEA or the UK, note that your data is processed outside your region, in Japan and the United States, by the providers named above.
How long we keep it
Your account and its contents are kept until you delete them. Error logs are kept for 30 days. Backups are retained for 12 months and then deleted.
What we never do
- We do not sell, rent, or trade your personal data.
- There are no third-party advertising trackers on this site.
- We do not profile your behaviour in order to serve ads.
Your rights
You can delete your own lists, places and notes at any time from within the site.
To delete your whole account, or to receive a copy of your data, write to hello@pokist.com. We complete these requests within 30 days.
Depending on where you live you may also have the right to correct your data, object to processing, or lodge a complaint with your local data protection authority.
When an account is deleted, everything you wrote goes with it, including lists other people had saved. This is deliberate — those were your words, and they should not stay up after you leave.
Changes to this page
Any change updates the date at the top. If a change affects how we use your data, we will tell you the next time you sign in rather than changing it quietly.