Privacy Policy

• Account — Your email address, and the sign-in method you used. Authentication is handled by Supabase Auth; if you sign in with Google we receive your email address, name and profile picture from Google. We never see or store your Google or eBay password.
• Profile — Display name, username, bio, favourite sport and Instagram handle — all optional, all editable, and all under your control in Settings.
• Your collection — The cards you add and everything you record about each copy: condition, grade, cert and serial numbers, quantity, what you paid, what you sold it for, the dates, and your notes.
• Photos — Images you upload for a card or set, which go into a review queue before they can appear in the public card database.
• Messages and social activity — Messages you send other collectors, who you follow, who you block, cards you have voted on, and any reports you submit.
• Catalog contributions — Corrections and additions you submit to the card database, recorded with your account so the change can be reviewed and credited.
• Contact form — Whatever you write, plus the email address you give us so we can reply.
• Connected eBay account — Only if you connect one. See the eBay section below.

Your collection is private by default. Nothing in it is visible to anyone else until you deliberately share it, and sharing is per-copy — you can showcase one card and keep the rest private.

When you do share a card, the public view of it is a deliberately narrow projection. What you paid, what you sold it for, and your private notes are never included, and cannot be exposed by sharing a card. That is enforced at the database level, not by the page that happens to render it.

Your profile is public only while you have it set to public, and can be made private at any time. Messages between collectors are visible to you and the person you sent them to.

Connecting eBay is entirely optional and Bindr works fully without it. If you do connect it, you sign in on eBay — never here — and eBay gives us a token that lets us act on your behalf. We never receive your eBay password.

• What we read — Cards you have bought, cards you have listed, and cards you have sold, so they can be brought into your collection. eBay limits this to roughly the last 60 days of activity.
• What we do with it — We match each listing against our card database and show you the result. Nothing is added to your collection until you review and confirm it.
• How the token is stored — Encrypted at rest with AES-256-GCM, in a table that is not readable by any browser or API client — only by our server.
• Turning it off — Disconnect at any time in Settings, which deletes the token from our database and asks eBay to revoke it. You can also revoke access from your eBay account directly. Cards already imported stay in your collection.

The permissions we request also cover creating and managing listings, so that features built later do not require you to reconnect. We do not create, change or end any listing without you asking us to.

Bindr sets cookies to keep you signed in, and a single short-lived cookie during the eBay connection flow to verify the request came from your browser. That is all.

There are no advertising trackers, no analytics SDKs and no third-party pixels on this site. We do not track you across other websites.

We do not sell your data, and we do not share it with advertisers. We rely on a small number of service providers to run the product:

• Supabase — Database, authentication and file storage.
• Vercel — Application hosting.
• Resend — Sending email, including replies to the contact form and eBay reminders for watched cards.
• Twilio — Sending text messages, only if you opt in to SMS eBay reminders.
• eBay — Only if you connect your account, and only as described above. Live listing alerts for watched cards also read public eBay search results.

We may also disclose data where we are legally required to, or where it is necessary to investigate abuse or protect people using the service.

We keep your data for as long as your account exists. Deleting your account deletes your profile, collection, photos, messages, watchlist, notification prefs (including any phone number you saved for texts) and any connected eBay token.

Two things deliberately outlive an account deletion: contributions you made to the shared card database (a corrected card number stays corrected for everyone), and records we are required to keep to prevent abuse. Neither identifies you publicly.

You can see and edit most of your data directly in the app. Beyond that, you can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it — get in touch and we will action it. Depending on where you live you may have additional rights under local law, and we will honour those.

Bindr is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

If this policy changes materially we will update the date at the top of this page, and where the change affects how your data is used we will tell you in the app.

Questions about privacy, or a request about your data — use the contact form and mark it as a privacy request.