Privacy Policy

1. Information We Collect

Account Information

When you register, we collect your display name, email address, and password (stored securely using one-way hashing). We never store plaintext passwords.

Collection Data

We store the card ownership records, wishlists, trade sessions, and other collection data you create within the Service.

Uploaded Images

If you use the card scanning or import features, uploaded images are transmitted to our AI identification providers (OpenAI and Anthropic) solely to identify the cards they contain, and are otherwise stored privately. Identified scan images are deleted from our servers within approximately 30 days of processing. Under OpenAI's and Anthropic's API terms, content sent through their APIs is not used to train their models, and we do not opt in to any arrangement that would allow it.

Usage Data

We collect basic server logs (IP address, browser type, pages visited) to maintain and improve the Service. We do not use third-party analytics or tracking services.

Sign-in Security Records

Each time you sign in we record your IP address, an approximate location derived from that IP where available (country, region and city — never precise GPS), network details (the network provider, and — where our location data source supports it — whether the address appears to belong to a VPN or hosting service), a device and browser label derived from your browser's user-agent string, and the sign-in time. We use these records solely to secure your account — so unusual sign-ins can be recognised — and to show you your own sign-in history. They are deleted automatically after 12 months.

2. How We Use Your Information

• To provide and operate the Service (collection tracking, sharing, exports).
• To authenticate your identity and secure your account.
• To send transactional notifications (e.g., trade session updates, password resets).
• To maintain and improve the Service.

We do not sell, rent, or trade your personal information to third parties.

3. Data Sharing

Your data is shared only in the following circumstances:

• Features you opt into: Shared collections and wishlists are visible to recipients via unique links you generate.
• Trade sessions: Participants in a trade session can see relevant collection overlap data as part of the matching process.
• Legal requirements: We may disclose information if required by law or to protect the rights and safety of the Service and its users.

4. Third-Party Services

PokeBinder relies on the following providers. Catalogue and pricing providers receive no personal data — only card data queries.

• Card catalogues & pricing: Pokémon TCG API, TCGdex, PriceCharting and PokemonPriceTracker.
• Payments: Stripe processes subscription payments. Your card details go directly to Stripe and never touch our servers; we receive only a payment reference and subscription status.
• Card identification: OpenAI and Anthropic receive images you upload for scanning or import, solely to identify cards.
• Email delivery: Amazon SES sends our transactional email and receives your email address for that purpose.

5. Cookies

PokeBinder uses essential cookies only:

• Session cookie: Required for authentication and CSRF protection.
• Remember-me cookie: Optional, set only if you choose "Stay logged in".

We do not use advertising, analytics, or third-party tracking cookies.

6. Data Retention

Your data is retained for as long as your account is active. If you delete your account via your profile settings, all personal data and collection records are permanently deleted from our systems.

Some records are also pruned automatically while your account remains active: sign-in security records are deleted after 12 months, and processed card-scan images are deleted within approximately 30 days.

7. Data Security

We take reasonable measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all traffic.
• Secure password hashing using industry-standard algorithms.
• Access controls limiting data access to authorised systems.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access and review the personal data associated with your account.
• Update or correct your account information via your profile settings.
• Delete your account and all associated data at any time.
• Request a copy of your data by contacting us.

9. Children's Privacy

PokeBinder is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at [email protected].