Privacy Policy

Last updated: 24 May 2026

Bindercle ("we," "us") is a mobile app that lets you organize and showcase Pokemon Trading Card Game collections. This Privacy Policy explains what data we collect, what we do with it, and the choices you have. We try to be specific. If a section feels unclear, write to privacy@bindercle.app and we'll clarify or fix it.

1. What we collect

1.1 Account info

• Email + name — when you sign in with Apple or Google, the OAuth provider returns these to us. Apple lets you hide your real email; we accept the relay address.
• Handle, display name, bio, avatar, link — what you enter on your profile. Visible to other users.

1.2 Content you create

• Binders, pages, cards, photos, captions, tags — whatever you add to your collection.
• Comments on binders.
• Likes, saves, follows — your engagement with other users' content.
• Reports and blocks — when you flag content or block another user.

1.3 Operational data

• Notifications metadata — when someone likes, saves, comments on, or follows you, we generate a notification record (actor, target, timestamp).
• Crash + error reports — captured by Sentry. Includes stack traces, device model, OS version, anonymous installation ID. We use this to find and fix bugs.
• Product analytics — screen views and event names (e.g., binder_like_toggled) sent to PostHog on EU servers. We use this to understand what's working in the app. No card photos or content body text is included in these events.

2. What we don't collect

• We don't read your photos, files, contacts, or device storage beyond what you specifically pick to upload as a card image or avatar.
• We don't track you across other apps or websites. There's no IDFA usage, no advertising network SDK.
• We don't sell your data. We don't share it with marketers.
• We don't collect precise location.

3. How we use it

Everything we collect is used to operate the app:

• To authenticate you and keep you signed in.
• To render the binders, comments, follows, and notifications that make the app work.
• To enforce safety rules — blocked users can't see your content, reports are reviewed for moderation.
• To debug crashes (Sentry) and understand which features people use (PostHog).
• To respond when you write to support.

That's the entire list. There are no secondary purposes.

4. Who we share it with

We don't sell or rent your data. We use a small set of service providers to operate the app, listed below. Each handles only what's necessary, under a data-processing agreement, and processes data on our behalf — never for their own marketing.

• Supabase (database, auth, storage, edge functions) — hosts your account and content. Privacy
• Apple — Sign In with Apple. Privacy
• Google — Sign In with Google. Privacy
• Sentry — crash + error reporting. Privacy
• PostHog — product analytics (EU region). Privacy
• pokemontcg.io — when you link a card to its official TCG record, we fetch the public card metadata + image URL. We send the search query; we don't send any of your account info.

5. Visibility — public vs. private

Binders default to private when you create them. You can switch a binder to public at any time, and back. Anything in a public binder — the title, description, tags, cards, captions, photos — is visible to anyone signed in to Bindercle.

Profiles are public. Your handle, display name, bio, and avatar are visible to anyone using the app. Your follower / following counts are public.

Likes are private (we don't show who liked what to other users beyond the count). Saves are private. Comments are public — they appear on the binder they were posted to.

6. Your rights

6.1 Access and correction

You can view and edit your profile in the app. To request a copy of all data we hold on you, write to privacy@bindercle.app. We'll respond within 30 days.

6.2 Deletion

You can delete your account at any time, from inside the app: Settings → Delete account. This permanently removes your account, profile, binders, pages, cards, comments, likes, saves, follows, blocks, reports, and notifications. The deletion is immediate and cannot be reversed. Crash reports and analytics events that were already sent to Sentry / PostHog are retained per their own retention schedules.

6.3 Withdrawing consent

You consented to this Privacy Policy by signing in. You can withdraw that consent at any time by deleting your account. There's no other place we use your data once you've deleted.

7. Data retention

We keep your data for as long as your account is active. When you delete your account, we delete everything immediately through database cascade rules. Backups of the database are retained by Supabase for up to 30 days and then overwritten on rolling schedule.

8. Security

All traffic between the app and our backend is encrypted over TLS. Your session uses signed JWTs that expire and rotate. Row-Level Security policies in Postgres enforce that you can only read and write data you're authorized to. The service-role key that can bypass these checks is only used by our own backend (edge functions) and never sent to the app.

We do our best, but no system is perfectly secure. If you spot a security issue, please write to security@bindercle.app and we'll investigate within 48 hours.

9. Children

Bindercle is rated 12+ on the App Store and is not directed at children under 13. If you're a parent and believe your child under 13 has created an account, please write to privacy@bindercle.app and we'll delete the account.

10. International transfers

Bindercle is built and operated from Singapore. Our database is hosted in Singapore. Our analytics (PostHog) is hosted in the EU. Sentry crash data is hosted in the US. By using the app you consent to your data being processed in these jurisdictions.

11. Changes

We'll update this policy as the app evolves. Material changes will be announced in-app and the "Last updated" date at the top of this page will reflect the new version. Continued use of the app after changes means you accept the updated policy.

12. Contact

Privacy questions: privacy@bindercle.app
Security disclosures: security@bindercle.app
General support: pika@bindercle.app

This policy is provided as the best honest description we can give of how Bindercle handles data. It is not legal advice. If you're a user with legal questions specific to your jurisdiction, you should consult a lawyer.