Privacy Policy

Binder is a collection tracker for the Pokémon Trading Card Game, made by Farpine LLC. This page says what the app and this website keep about you, in plain words. It is short because there is not much.

The short version

An account is an email address and a password, or your Apple ID if you use Sign in with Apple. That is all we ask for.
Your collection, wishlist and trade list are stored on a server we run, so they follow you between phones.
Friends you add can open your binder — your collection, wishlist and trade list — and send you trade offers. They see a display name, never your email.
In Battle Lab, friends see your team. When you practise against theirs, they see how each run went and can replay any run where you crack it.
If you join the Battle Lab ladder, anyone signed in to Binder can see your place on it, the three cards on your ladder team and a ladder name Binder makes up for you. People who aren’t your friends never see your own name.
Binder+ is paid through Apple. We keep which plan your account has and when it renews, ends or was refunded, never your card or Apple Account.
The app sends us plain usage events — which screens you open, whether a scan matched. They are tied to your account, cut loose from it if you delete the account, and deleted after a year.
No ads, no trackers, no third-party SDKs. Your data is never sold or shared.
The scanner reads the card number on your phone. While it is pointed at a card it also sends a cropped photo of the card to our server, which recognises the card by its art in memory and keeps nothing.

Your account

Your email address. It is your sign-in and the only way we can contact you.
Your password, stored as a bcrypt hash. We cannot read it and do not know it.
A display name, only if you choose to set one. Friends see it; without one they see “Collector” and the last four characters of your friend code.
Sign in with Apple, if you use it: the identifier Apple gives Binder for your Apple ID, and a token Apple issues so we can tell Apple to forget the link when you delete your account.
Sessions. Each sign-in creates a session: a random token (stored hashed), the time it was created and last used, and the device it came from. A session stops working when you sign out or after 180 days without use, and its record is purged within 30 days after that.

What the app stores on our server

Your collection — which cards and printings you own, with a quantity and a condition if you set them.
Your wishlist and trade list, with any quantity and note you add.
Price alerts: the target prices you set on wishlist cards. Friends never see them. Binder also notes when an alert hits, so it tells you once.
Your friend code and your friends — who you are friends with and since when.
Trade offers you send or receive — the cards on each side, whether it was accepted, declined or withdrawn, and the message picked for it, one of five preset phrases. Both people on an offer can see all of it.
Battle Lab. Your team, if you save one (until then Binder picks it from your binder), and a record of each battle and one-on-one you start: the cards on each side, the arena, the result and, for a battle you play yourself, each call you make. Your daily runs are counted from it. Friends see your team. A friend sees that you practised against their team and how each run went, and can replay any run where you crack it, move by move. If they have friend activity alerts on, their daily digest can say so, with the name friends see for you: “Alex cracked your Battle Lab team.” The same goes for their runs against your team.
The ladder, if you join it with Binder+: your ladder name, your place, when you joined and, if Binder+ ends, when it ended. Ladder challenges are recorded like any battle: the cards on each side, your calls and the result. Anyone signed in to Binder can see each member’s ladder name, place and ladder team. If you take someone’s place, they are notified and can replay that battle move by move, under your ladder name, or under the name friends see if you are friends. Your friends see your own name beside your ladder name.
Cards you scan. When Binder’s scanner recognises a card, Binder records that you scanned it, so the card can battle in Battle Lab.
Binder+, if you subscribe: Apple’s subscription id, the plan, the period end and whether it will renew; whether your current period is a free week; whether Apple is retrying a payment, whether it was refunded, and whether it was a test purchase. The app gives Apple your account’s internal identifier so a renewal reaches the right account.
A notification token, only if you turn on notifications: the address Apple gives this install for push alerts, and which alerts you asked for (new sets, trade offers, friend activity, price alerts, the ladder). Signing out removes it.
Usage events. The app sends these, by name: app_open, screen_view, search, scan_result, card_owned_changed, list_changed, list_entry_edited, friend_added, friend_removed, friend_code_shared, friend_binder_opened, display_name_set, trade_compose_opened, trade_sent, trade_responded, push_opt_in, buy_link_opened, plus_paywall_shown, plus_purchase_started, plus_purchased, plus_purchase_failed, plus_restore, plus_manage_opened, plus_offer_seen, plus_card_hidden, lab_opened, lab_team_saved, lab_battle, lab_duel, lab_solution_shown, lab_counters, lab_share, lab_invite_shared, lab_record_opened, lab_scan_prompt, lab_runs_out, ladder_opened, ladder_joined, ladder_left, signup, login, logout and password_reset. Each carries what it is about — a screen name, a card and set, a variant, whether a scan matched and by which method, how many cards an offer had, how a battle ended, where the Binder+ sheet was opened from and whether it offered the free week — plus the platform, the app version and the time. A search event carries how long the search was and how many results it found, never what was typed. They tell us which parts of Binder get used and whether scanning works. The app version on your newest event also decides whether your daily digest can mention Battle Lab. No location, no photo, no free text.

On your phone

A CSV export is put together on your phone, and the file stays with you. The Home Screen widgets fetch your binder’s value, closest set and battle record from our server with your sign-in, keep a copy on the phone, and delete it when you sign out.

What is not collected

Your name, beyond a display name you choose to give.
Your location. The app never asks for it.
Your contacts and your photo library. Binder does not read either.
Photos. Scanning uses the camera live. Reading the set code and number happens on the phone, with Apple’s on-device text recognition. Alongside that, while the scanner is pointed at a card, a cropped photo of just the card is sent to our server about every half-second so it can recognise the card by its art. Each one is compared against the catalogue in memory and discarded: it is not written to disk, not logged, and not kept.
Payment details. Apple takes the payment; we never see your card, billing address or Apple Account.
Advertising identifiers or device fingerprints of any kind.

No one else

There is no advertising, no analytics service, no crash-reporting service and no third-party SDK inside the app. Card images and prices are mirrored on our own server, and the app loads them from us. The odd image that is not in the mirror yet is fetched from the catalogue’s own image host until it is, and that host sees the request the way any web server does. Apple’s own systems — the App Store, TestFlight, and the crash reports iOS offers to share — are covered by Apple’s privacy policy, not ours.

Binder+ is sold through the App Store. When you subscribe, our server checks the purchase with Apple, and Apple reports renewals, endings and refunds to our server.

“Buy on TCGplayer” opens TCGplayer’s website in Safari. When the caption under it says it is an affiliate link, it goes through TCGplayer’s affiliate network, Impact, which counts the click so Binder can earn a commission, and it says which screen it came from, nothing about you. TCGplayer’s site, like any website, sees the visit and may set cookies. This product uses TCGplayer data but is not endorsed or certified by TCGplayer.

We do not sell, rent or share your data with anyone. Apart from the account identifier the app gives Apple with a Binder+ purchase, the only circumstance in which it would leave our hands is a legal requirement to hand it over.

Server logs

In production the server does not keep a per-request access log. It writes a small operational log — start-up, errors with the path that failed, what the daily catalogue sync did, which subscription event Apple sent — that is capped at about 30 MB and overwritten as it fills. It exists to find out what broke and is not analysed for anything else.

Where your data lives

On a server we operate, rented from a hosting provider in the United States. Every connection between the app and the server is encrypted.

How long we keep it

Account, collection, lists and price alerts, friends, trade offers, Battle Lab team and runs, your place on the ladder, the cards you’ve scanned, Binder+ records and notification tokens — until you delete the account. A run against someone’s team also goes if they delete their account. Your place on the ladder goes when you leave it, or 30 days after Binder+ ends, and your ladder name is then free for someone else.
Usage events — 365 days, then deleted automatically; from the day you delete the account they carry no user id.
Sessions — until you sign out, or 180 days after their last use; the record is purged within 30 days after that.
Server logs — about 30 MB, the oldest lines overwritten as new ones arrive; there is no fixed number of days.

A copy of your data

Email support@farpine.com and we’ll send you a copy of your data, free.

Deleting your account

In the app: Settings ▸ Your data ▸ Delete account. The account, the collection, the lists, your friendships, the trade offers you sent and received, your Battle Lab team, your place on the ladder, your runs and other people’s runs against your team, the cards you’ve scanned, your Binder+ record, your notification tokens and the sessions are deleted at once — no waiting period, no copy kept. If you used Sign in with Apple, we also tell Apple to remove Binder from your Apple ID. Deleting your account does not cancel Binder+ billing: cancel it with Apple first, in Settings ▸ your name ▸ Subscriptions. The usage events are not deleted on the spot: at the same moment they are detached from the account, so nothing in them points at you any more, and they age out with everything else within a year. If you would rather not open the app, email support@farpine.com from the account’s address and we will do it.

Children

Binder is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, email us and we will delete it.

This website

No cookies, no analytics and no scripts that talk to anyone. The same server serves these pages, so the operational log described above is the only record there is, and nothing else.

Changes

If this policy changes, the date at the top changes with it. Material changes will be noted in the app’s release notes.

Contact

support@farpine.com
Farpine LLC, Rathdrum, Idaho, United States.