Privacy statement
What we keep about you, why, and what you can do with it.
RuneBinder is a hobby project by Freek van der Horst (the Netherlands), not a company. Questions about your data: info@freekvanderhorst.com. We are the controller for the processing described below.
In short
- Without an account (guest mode), your collection, decks and wishlist stay in your browser; we never receive them.
- With an account they live in your account, so you have them on every device. Only you can see them. If you create an account while you have a guest collection, it moves into your account.
- Your CSV file is read in your browser, not uploaded as a file. With an account, what's in it (which cards, quantities, condition, language, purchase price) is stored in your account.
- We don't use tracking cookies and show no ads.
- You can export your data and delete your account, with everything in it, at any time.
What data, and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address and password (stored hashed) | Signing in | Contract | Until you delete your account |
| Collection (cards, quantities, finish, condition, language, purchase price, date added), decks, wishlist, preferences, date of last import | Making the app work across your devices | Contract | Until you delete your account |
| Shared decks (a copy of the deck) | Anyone with the link can view it | Contract | Until you stop sharing or delete your account |
| Cookieless visit statistics | Knowing which pages and features are used | Legitimate interest | Per the service (see below) |
| Error reports | Finding and fixing errors in the app | Legitimate interest | Per Sentry |
In your browser
No cookies, but your browser's storage (localStorage and IndexedDB) holds:
- your sign-in session;
- card data and image links from Scryfall, as a cache;
- your language, card size and view choices;
- the life counter's state;
- in guest mode: your collection, decks and wishlist.
This stays on your device, apart from your session going to Supabase. Clear your browser's site data to remove it.
Who processes data for us
| Service | What | Where |
|---|---|---|
| Supabase | Account, collection, decks, wishlist, shared decks; sends sign-in and confirmation emails | EU (Ireland) |
| Vercel | Hosting the site; cookieless visit statistics | US and global, under the EU-US Data Privacy Framework |
| Umami | Cookieless visit statistics, and per tool only that it was used, never which cards | EU |
| Sentry | Error reports: what went wrong, browser and page, without IP address or account; no screen recordings | EU (Germany) |
| GitHub | Nightly database backup, encrypted before storage (GitHub can't read it), kept for 30 days | US, under the EU-US Data Privacy Framework |
Scryfall is not our processor: your browser fetches card data and images directly from Scryfall. Scryfall sees your IP address and which cards you request; Scryfall's own privacy policy applies.
We don't sell data and share it with no one else.
Your rights
- Access and portability: export your collection (CSV) and a full backup (JSON) in the app. Under Account you download all your data.
- Erasure: Account → Delete account. That removes your account and all your data immediately, including shared decks. It leaves the encrypted backup within 30 days.
- Rectification, objection, restriction: email info@freekvanderhorst.com.
- Complaint: with your local data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).
Changes
When we change this statement, the date at the bottom changes. We announce major changes in What's new.
Last updated: 13 October 2026