Privacy Policy
Effective 30 October 2026. Binder Bounty only locates you to your town, never sells your data, and has no adverts or tracking. This policy explains what we collect, why, who helps us run the app, and your rights.
Who is responsible for your data
SD IT Support Ltd is the data controller (company number 15846904, registered office 15 Ebnal Close, Leominster, Herefordshire, HR6 8SL). Contact us about privacy at support@binder-bounty.com.
What we collect
| Data | Why we need it | Lawful basis (UK GDPR) |
|---|---|---|
| Email address and password (stored only as a secure hash) | To create your account and sign you in | Contract |
| Display name | So other players know who they’re trading with | Contract |
| Profile photo, if you add one | So other players can recognise you | Contract |
| Date of birth | To check you’re 18 or older. Never shown to anyone | Legitimate interests (keeping under-18s off the app) |
| Your town and search radius | To find players and stores near you | Contract |
| Trade list and want list, including any named lists and their names (Premium) | To match you with other players | Contract |
| Message requests, chats, blocks | So you can arrange trades safely | Contract |
| Reports you make or receive | To keep users safe and act on rule-breaking | Legitimate interests and legal obligations |
| Push notification token | To send you notifications you’ve allowed | Consent (your phone’s notification permission) |
| Store details, events, announcements, and stock listings with prices and currency (store accounts only) | To show the store, its events, its news and its stock to players | Contract |
| Subscription status (if you subscribe): plan, store, renewal date, whether it’s active | To unlock the paid features you’ve bought | Contract |
Importing lists
When you import cards from a file, from pasted text, or by sharing a list to Binder Bounty from another app (such as ManaBox or Moxfield), the app reads it on your phone. It sends us only what’s needed to find each card: its name, set, collector number and Scryfall ID. The cards you choose to save go on your list. The file or text itself isn’t uploaded or kept.
Your location
We never store your precise location. You pick your town, or tap “Use my location”. Then your phone gives a rough position, the app rounds it to about 1 km, and we use it once to find the nearest town. Only the town is saved. Other players see your town and how far away it is, nothing more precise.
Stores are businesses: their full address and map pin are public.
What other users can see
- Other players: your display name, profile photo (if you add one), town, distance, trade list and want list. Cards on named lists are included, but the names of your lists are private to you.
- People you chat with: the messages and requests you send them.
- Stores: a store’s page, address, opening hours, events, announcements and any stock listings with prices are shown to signed-in users once we’ve approved the store.
- Never shown: your email address, date of birth and subscription status.
What we don’t collect
We don’t collect your contacts, photos, precise location or advertising identifiers, and we don’t use analytics or advertising trackers. Settings such as light or dark mode and your price currency, and which stores’ news you’ve already seen, stay on your phone.
Who helps us run Binder Bounty
These providers process data for us under contract and only for these purposes:
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Hosts our database, sign-in and profile photos, and sends account emails | All account data. Stored in the EU (Ireland) |
| Expo | Delivers push notifications | Push token, notification text |
| Google Firebase Cloud Messaging | Delivers notifications to Android phones | Push token, notification text |
| Apple Push Notification service | Delivers notifications to iPhones | Push token, notification text |
| Google Maps (Android) and Apple Maps (iOS) | Show the store map | Map requests from your phone, under Google’s or Apple’s own privacy policy |
| Scryfall | Serves card images | Your phone’s IP address when images load |
| RevenueCat | Manages Premium and Store Pro subscriptions | Your account ID, your App Store or Google Play purchase history, and basic app and device details (such as platform and app version) |
| Apple App Store and Google Play | Take subscription payments | Your payment details, under Apple’s or Google’s own privacy policy. We never see your card details |
Notifications say who sent a request or message, never what the message says.
Some of these providers are based in the United States. Where data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO’s International Data Transfer Agreement.
How long we keep data
- Your account data is kept while your account is open.
- Your profile photo is deleted when you change or remove it, or delete your account. Your phone shrinks it before upload, and location details are removed from it. Only signed-in users can see it, and not if either of you has blocked the other. If we remove a photo after a report, it’s deleted the same way.
- Deleting a chat (press and hold it in your inbox) removes it and its messages for you straight away. The other person keeps their copy, because it’s their conversation too. If a chat has been reported, we keep it with the report.
- Deleting your account removes your profile, lists (including named lists), requests, conversations, store page, announcements, stock listings and subscription status straight away. Your conversations also disappear for the other person. See deleting your account.
- RevenueCat, Apple and Google keep their own records of subscription purchases, as payment and tax law require. Deleting your Binder Bounty account doesn’t cancel a subscription.
- Reports you made stay on record without your name, so we can still act on them.
- Reports about you stay on record with your display name and any reported conversation, even after your account is deleted or terminated. We keep them to deal with repeat abuse and in case the police need them.
- Copies in our database backups are overwritten within 7 days.
- A phone’s push token is removed when you sign out.
Under-18s
Binder Bounty is only for adults aged 18 and over. Under-18s are not allowed to use it, and we don’t knowingly collect data about anyone younger. If we find that an account belongs to someone under 18, we will terminate it and delete its data. If you think someone under 18 is using the app, report them in the app or tell us at support@binder-bounty.com.
The app is also built to protect everyone who uses it:
- Location is shown at town level only.
- No one can message you until you accept their request.
- You can block and report anyone.
- The app suggests meeting in public game stores.
- There are no adverts and no profiling. Read our Child Safety Standards.
Your rights
You can ask us to:
- give you a copy of your data
- correct it
- delete it
- restrict or object to how we use it
- send it to you in a portable format
You can also withdraw consent for notifications in your phone’s settings at any time. We reply within one month. To make a request, email support@binder-bounty.com.
If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security
Data travels over encrypted connections. Database rules limit every user to their own data and to what other users are allowed to see. Passwords are stored only as secure hashes.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change takes effect.