Privacy Policy

Digital Binder · last updated 29 September 2026

Digital Binder (digitalbinder.me) is a free tool for cataloguing a trading-card collection in digital binders. This policy explains what personal data it holds, why, who helps us process it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible

Digital Binder is run by Luca Kiss and Lupica Andrei, who are joint controllers of your personal data. For anything in this policy, contact us at lupica.andrei@gmail.com.

What we collect

Account: your email address and a securely hashed password. If you sign in with Google, we receive your email address, name and profile picture from Google.
Your collection: binders, cards, conditions, prices you paid, notes, sticky notes and drawings, and images you upload (card photos, binder covers, stickers).
Technical data: when you use the site, our hosting providers process your IP address and basic request details (such as browser type and time) to deliver the site and keep it secure.
Data stored in your browser: see Cookies and browser storage below.

We do not use analytics, advertising, tracking pixels or profiling, we make no automated decisions about you, and we never sell your data.

Why we use it (legal basis)

To provide the service you signed up for: your account, signing in, storing and showing your collection, account emails such as confirming your address or resetting your password. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
To keep the service secure and working: server logs, preventing abuse, fixing errors. Legal basis: our legitimate interest in running a safe service (Art. 6(1)(f)).

Who processes it for us

We use these providers to run the site. They process data only on our instructions and under data processing agreements.

Provider	What for	Data
Supabase	Database, sign-in and file storage (servers in the European Union)	Account, collection, uploaded images, request logs
Vercel	Hosting and delivering the website	IP address, request logs
Cloudflare	Storing and delivering card images and the card catalogue	IP address when your browser loads images
Google	Only if you choose “Continue with Google”	Sign-in details exchanged with Google
Frankfurter	Currency exchange rates, requested by your browser	IP address only; no account data

Card market prices are fetched by our own server from public Cardmarket and TCGplayer price lists; no data about you is sent to them. Links to those stores open their websites only when you click them, and their own privacy policies then apply.

Transfers outside the EU

Vercel, Cloudflare and Google are based in the United States and may process data there. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

How long we keep it

Account and collection: for as long as you have an account. When you ask us to delete your account, we delete it and everything in it within 30 days. Copies in our providers' backups are overwritten on their normal backup cycle.
Server logs: kept by our providers for a short period (typically days to a few weeks) and then deleted.

Cookies and browser storage

We use no advertising or tracking cookies. The app stores only what it needs to work, in your browser's local storage and cache: your sign-in session, your settings (such as the active binder, theme and page), a copy of the card catalogue and your collection so the app loads quickly and works offline, and cached exchange rates. Because this storage is strictly necessary for the service you asked for, it needs no consent banner. You can delete it at any time by clearing your browser's site data; you will then need to sign in again.

Fonts and scripts are served from our own domain, so opening the site does not contact Google Fonts or other third-party content networks.

Your rights

You have the right to:

get a copy of your personal data (access), including in a machine-readable format (portability);
have it corrected (rectification) or deleted (erasure);
restrict or object to how we process it;
complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP); you can also contact the authority in the EU country where you live.

To use any of these rights, email us at the address above from your account's email address. We reply within one month. You can edit or delete your binders and cards yourself in the app at any time, and export a binder as a PDF.

Children

Digital Binder is intended for people aged 16 or over. If you are younger, a parent or guardian must agree to you using it. If you believe a child has given us data without this consent, contact us and we will delete it.

Security

All traffic is encrypted (HTTPS). Passwords are stored only as secure hashes. Every request to the database is checked by access rules that let each user read and change only their own data.

Changes

If we change this policy, we will update the date at the top. For significant changes we will tell you in the app or by email before they apply.