Privacy Policy
Last updated: 6 November 2026
TCG Binder is a free, non-commercial fan project. You can use it without an account. Sign in only if you want your binders backed up and synced. We collect as little as possible and never sell it.
The short version
- No account? Your binders stay in your own browser. They aren't sent to us.
- With an account, we store your email address and your binders so they can sync between your devices.
- No ads, no analytics or tracking scripts, no tracking cookies. We don't sell or share your data for marketing.
- You can download everything (Settings → Download all my data) and delete your account (Settings → Delete account) at any time.
What we store, and why
| Data | Where | Why |
|---|---|---|
| Your binders (card lists, names, colours, page layout) and display settings | Your browser (IndexedDB / local storage). If you sign in, also in our database. | To show your binders and keep your devices in sync |
| Email address and password (stored only as a secure hash, never readable by us) | Our authentication provider (Supabase) | To let you sign in |
| If you use “Continue with Google”: your name, email and profile picture from Google | Supabase | To sign you in and show your avatar |
| Sign-in session token | Your browser's local storage | To keep you signed in. Removed when you sign out. |
| Technical request data (IP address, browser type, time, page requested) | Hosting and database logs (Vercel, Supabase) | Security, abuse prevention (e.g. rate limiting) and fixing errors. Kept briefly. |
We don't collect payment details, your location, contacts, or anything else. Please don't put personal information in binder names.
Cookies and local storage
We don't use advertising or analytics cookies. The app keeps data in your browser's storage only so it can work: your binders, settings such as “page-turn sounds”, and, if you sign in, your session. Because this storage is strictly necessary for the app and isn't used for tracking, there's no cookie banner.
| Stored item | Type | Purpose | Kept |
|---|---|---|---|
| Your binders | IndexedDB | The app's working copy of your collection | Until you delete it |
| Display and search preferences | Local storage | Remember settings like page-turn sounds and your last search | Until you clear it |
| Sign-in session (only if you sign in) | Local storage | Keep you signed in | Until you sign out |
| Sync bookkeeping (only if you sign in) | Local storage | Know which changes are already in your account | Until you clear it |
You can remove all of it at any time with Settings → Clear data on this device, or through your browser's site settings.
Who processes your data
We use a few services to run the site. They process data only on our behalf:
- Vercel: hosting and serving the website and its API.
- Supabase: accounts and the database for synced binders.
- Google: only if you choose “Continue with Google”.
Card details, prices and images come from public sources (such as TCGplayer via TCGCSV, and YGOPRODeck). Our server fetches them, so your browser doesn't contact those sites and they don't receive your data. Links to stores like TCGplayer or Cardmarket open those sites, and their own privacy policies apply there.
These providers may store data on servers outside your country (for example in the United States or the EU).
How long we keep it
- Account data and synced binders: until you delete them or your account.
- A binder you delete is wiped from the database. Only a small “deleted” marker is kept so your other devices remove it too.
- When you delete your account, your sign-in and every binder and setting stored with it are permanently removed right away. Backups held by our providers expire on their normal schedule.
- Server logs are kept only for a short time by our hosting providers.
Security
All traffic is encrypted (HTTPS). Database access is restricted so each account can only ever read and change its own rows. Passwords are hashed by our authentication provider, and secret keys never reach your browser. No system is perfect: if we ever discover a breach affecting your data, we'll tell affected users promptly.
Your rights
Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you can access, correct, export or delete your data, or object to how it's used. Most of this is built in:
- Access / export: Settings → Download all my data.
- Delete: Settings → Delete account (signed in).
- Correct: edit your binders directly in the app.
For anything else, email draskular@gmail.com. You can also complain to your local data-protection authority.
Legal bases (GDPR): providing the service you asked for (your account and sync), and our legitimate interest in keeping the service secure (logs and rate limiting).
Children
TCG Binder isn't directed at children under 13, and you need to be at least 13 (or the minimum age in your country) to create an account. If you believe a child has given us data, contact us and we'll delete it.
Changes
If this policy changes, we'll update the date at the top. Significant changes will be announced in the app.