TL;DR
Binder Boss is a local-first tracker. Your collection lives on your device in localStorage + IndexedDB, and once you sign in — on any plan, Free or Pro — your ownership rows also sync to Supabase under your user ID with row-level security, so only you can read them. Demo mode never leaves your browser. We never sell, share, or monetize your collection data.
What we collect
- Email address (any signed-in account) — required for magic-link or Google auth via Supabase. We use it to sign you in and for account email you can control from your notification settings.
- Ownership rows (any signed-in account — cloud sync is included on every plan) — variant IDs, owned flag, acquired-at timestamp, optional notes you type. Stored under your user ID with RLS so only you can read your own data.
- Subscription state (Pro only) — Stripe customer ID, subscription status, period end. Used to grant Pro features.
- Error reports — when something crashes, we send the error stack + minimal context to Sentry. PII fields (email, notes) are stripped before sending.
- Binder photos (only if you use photo identification) — uploaded to a private bucket only you can access, sent to our AI providers (Anthropic, Scrydex) once to identify the cards in frame, and auto-deleted within 7 days. Photos are never used to train models and never made public.
- Product usage events — first-party analytics (PostHog): which features get used (e.g. sign-up, checkout, sync), page performance, and anonymized usage patterns. Used only to improve the product — never sold, never shared with advertisers.
- Email for messages you opt into — waitlist + account lifecycle emails are sent via Resend to the address you signed up with. Every email has an unsubscribe path.
- Published binders — if you explicitly publish a binder, its contents (and your chosen username) become publicly viewable at your share link until you unpublish. Imagined cards are hidden or badged per your per-binder setting.
What we don't collect
- No advertising trackers or data brokers, ever — our analytics are first-party product metrics, not ad tech.
- No payment card details — Stripe handles payments end-to-end. We see only the subscription status, not card numbers.
- No location data, contacts, browsing history, or device identifiers.
Where data lives
- Your device —
localStorage(collection, binders, wishlist, theme preference, dismissed hints) + IndexedDB (cached card catalog). - Supabase (Pro tier) — US-East region. Postgres with row-level security; only your user ID can read your rows.
- Stripe(Pro tier) — subscription state + payment processing. Stripe's privacy policy applies for payment data.
- Sentry — error reports only. We can disable Sentry entirely by clearing the DSN env var.
- PostHog — product usage events (first-party analytics).
- Resend — outbound email delivery (waitlist + lifecycle messages).
- Anthropic + Scrydex (photo identification + AI suggestions only) — transient processing of the photo or card metadata you submit; nothing is retained for model training.
Your rights
- Export — go to /app/data and download your full ownership CSV anytime.
- Delete — delete your entire account yourself from /app/data (Danger zone → Delete account). It removes every cloud-synced row, binder, published page, and uploaded photo, and cancels any active subscription immediately. You can also clear local data only, without deleting your account, from the same page.
- Access / correction— export your data anytime; for anything else, email us and we'll respond within 14 days.
Children's privacy
Binder Boss is intended for people aged 13 and over (16 where required, such as parts of the EEA), as set out in the Terms. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete the account and its data promptly. If you believe a child has given us personal information, contact admin@deadcenterstudios.com and we will remove it.
Cookies & analytics
- Essential only, by default — the cookies required to keep you signed in (Supabase session) and to remember an explicit demo-mode choice. These cannot be turned off without breaking sign-in.
- Product analytics — we use PostHog to understand which features get used. It records usage events against a pseudonymous device identifier, not your name or collection contents.
- No advertising cookies. We do not run ads, and we do not sell or share personal information for cross-context behavioural advertising.
Every cookie and storage key we set is itemised in the Cookie Policy.
How long we keep things
- Account & collection data — for as long as your account exists. Deleting your account removes it.
- Binder photos — deleted automatically after 7 days by a scheduled cleanup, and immediately on account deletion.
- Billing records — Stripe retains transaction records for the period its own obligations require, independently of your Binder Boss account.
- Local device data — stays on your device until you clear it from /app/data or clear your browser storage.
Why we're allowed to process it
Where the GDPR applies, we rely on: contract — to provide the account and subscription you asked for; consent — for the optional AI features and for lifecycle email, each of which you can withdraw at any time; and legitimate interests — to keep the service secure, prevent abuse, and fix errors.
Who else touches your data
We use a small number of third-party services to run Binder Boss — hosting, database, payments, email, error monitoring and analytics. Each one, what it receives, and where it is located is listed on the subprocessors page.
Card data attribution
Pokémon card metadata (names, set lists, images, rarities) comes from the Scrydex API and the public pokemontcg.io API. Pokémon, the Pokémon TCG, and all related trademarks are property of The Pokémon Company International, Nintendo, Game Freak, and Creatures Inc. Binder Boss is a fan-made independent tool with no affiliation.
Who controls your data
Binder Boss is operated by Dead Center Studios LLC, a limited liability company formed in the State of New York, United States. Dead Center Studios LLC is the data controller for personal information handled by Binder Boss, and is registered with the New York Department of State (DOS ID 7894666).
Contact
Privacy questions: admin@deadcenterstudios.com. Security disclosures: admin@deadcenterstudios.com (see /.well-known/security.txt).
This policy reflects how the app handles data today. Questions: admin@deadcenterstudios.com.