Privacy Policy
Template notice for the site owner: this text is a good-faith starting point, not legal advice. Fill in your details in js/config.js and have it reviewed before launch, especially if you have users in the EU/UK.
1. Who we are
MasterBinder is an unofficial fan-made tool for tracking trading-card collections. The operator is (“we”). Contact for privacy requests: .
2. What we collect
| Data | Why | When |
|---|---|---|
| Email address, sign-in provider and an account ID (from Google or email sign-up). We never see your Google password; for email accounts the password is stored only as a hash by our provider. | To create your account and let you sign in. | Only if you create an account. |
| Your preferences: favorite sets, your wanted-cards list and the trophies you have earned. If you join the PRO waitlist, your email address. | To personalise My Binder and to tell you when PRO opens. | Stored in your browser always; in the cloud only if you have an account. |
| Your collection: which cards and variants you mark as owned, per set. | To show your progress and sync it between devices. | Stored in your browser always; in the cloud only if you have an account. |
| Problem reports: your message, the optional email you type, the page, game/set/card you were viewing, browser type and language. | To fix missing cards, wrong data and bugs. | Only when you send a report. |
| Technical logs (IP address, browser) created by our hosting and cloud providers. | Security and operating the service. | Automatically. |
We do not use advertising, analytics or tracking cookies, and we do not sell your data.
3. Browser storage
We use your browser’s local storage for essential functions only: your collection (when not signed in), language, theme, view preferences, a record that you dismissed the notice, and the sign-in session kept by Firebase Authentication. Because it is strictly necessary, we do not ask for consent for it. You can clear it at any time in your browser settings.
4. Legal bases (GDPR)
- Contract: providing your account and syncing your collection.
- Legitimate interests: keeping the service secure, preventing abuse, handling problem reports.
- Consent: where you choose to give us your email in a report so we can reply.
5. Who we share data with
- Google (Firebase Authentication and Cloud Firestore) acts as our processor to host accounts and your synced collection. Data may be processed in the US and other countries under Google’s data-processing terms and standard contractual clauses.
- Third-party content: card images are loaded directly from TCGplayer’s image servers, Pokémon set logos from images.pokemontcg.io and assets.tcgdex.net, and fonts from Google Fonts. Your browser sends them your IP address and standard request data when loading these resources.
- We may disclose data if required by law.
6. Retention
Your account and collection are kept until you delete your account. Problem reports are kept for as long as needed to resolve them and then deleted. Provider logs are kept according to the provider’s own schedules.
7. Your rights
Depending on where you live (for example the EU/UK), you have the right to access, correct, export and erase your data, to restrict or object to processing, and to complain to your data-protection authority. In the app, open Account to download your data or delete your account; deletion removes your account and your whole stored collection. For anything else, email .
8. Children
The service is not directed at children under 16, and we do not knowingly create accounts for them. If you believe a child has an account, contact us and we will delete it.
9. Security
Data is transmitted over HTTPS and access to stored collections is restricted to the signed-in owner. No system is perfectly secure, so please use a strong, unique password.
10. Changes
We may update this policy and will change the effective date above. Material changes will be announced on the site.