If you own a smartphone, there’s a decent chance you are one of the world’s nearly 18 million Pokémon Go players. Launched last Thursday, Pokémon Go is a GPS-synchronized augmented reality game that places the classic, colorful Nintendo creatures in the real world — or at least, against the live backdrop provided by your phone’s front-facing camera. Users are encouraged to “catch ‘em all.” But is there a chance the game is catching something of theirs as well?

Minnesota Senator Al Franken certainly seems to think so. Earlier this week he sent a public letter to Niantic, the company that developed Pokémon Go, requesting a full report on how they use players’ personal information. His letter stated that the app could threaten the right to privacy, as the game’s privacy policy states that user information “can be shared with The Pokémon Company and ‘third-party service providers.” Franken also described how Niantic treats this personal information as a “business asset,” that could be revealed or transferred to other companies that buy out or merge with Niantic. The Minnesota Senator asked for a response by August 12. Niantic has yet to answer.

Even before Senator Franken’s letter, however, some Pokémon Go users expressed concern about how Niantic required “full access” to their personal Google accounts in order to play the game: Theoretically, this means that Niantic had the ability to read and send emails from a personal Gmail account, but also to records calendar entries, directions, and notes. Earlier this week, Niantic issued an update and clarified that they only use the most basic account information to run the app.

On the other hand, even the most basic information is a valuable commodity for third-party companies. On iOS gaming news site Touch Arcade, an anonymous mobile game producer explained how apps so effectively dig up and sell user information — key facts like gender, age, location, and even interests.

“Every time you play a free to play game, you just build this giant online database of who you are, who your friends are and what you like and don’t like. This data is sold, bought and traded between large companies I have worked for,” the producer wrote. Even more alarming is that his experiences date back a few years, before huge mobile games like Angry Birds burst onto the mobile gaming scene. Data-mining techniques have only become more sophisticated since then.

Still, this doesn’t doesn’t necessarily mean Niantic is selling your personal information. Despite being free to play, Pokémon Go has a number of in-game purchases — small payments that can be made to quickly upgrade Pokémon and acquire rare items. This “freemium” model has proven to be quite lucrative, but Pokémon Go has taken it to the next level. For example, Think Gaming estimated the daily revenue for hit game Candy Crush Saga at $442,296. Business Insider reported Pokémon Go’s revenue might be as high as $2.3 million per day. Remarkably, these figures aren’t even coming from a large consumer base. Most people avoid in-game purchases, meaning that the bulk of the funds are from a very small number of players. In fact, mobile marking company Swrve found that over 60 percent of mobile game revenue comes from just 0.13 percent of users.

Pokémon Go has become a highly lucrative property in the short week it’s been available to download. Nintendo’s stock has soared by over 25 percent since the game’s release. At the peak of this spike, market analysts valued the game at a whopping $7 billion. Niantic CEO John Hanke has announced that they plan to open up Pokémon Go to digital advertising.

Of course, these developments don’t guarantee Pokémon Go any long-term financial success — the game has all the markings of a brief, furious fad. But for now, it’s the juggernaut of the gaming world. It has so much going for it that it doesn’t seem to need to depend on selling user information — though it certainly is collecting quite a bit about each and every player, even after Niantic’s update. Where exactly all that data ends up, however, remains a mystery.

So go forth and catch as many (or few) pokémon as you like. Just be aware of how much you reveal to companies like Niantic — if the game is free, you’re the one being bought and sold.