What we collect and what happens to it

Your account. An email address, a display name and a handle. The email is how you sign in, since there are no passwords here: you get a link, you click it. You can also add a contact note, which is shown on your public binder pages because the whole point is that someone can reach you.

What you put in your binders. The cards, conditions, finishes, quantities, prices and notes you enter. On a public or link-shared binder this is visible to whoever you share it with, which is the feature. Private binders are visible only to you.

Claims and offers. When someone asks for cards from a binder they give a name, a way to be contacted and optionally a message, and that goes to the binder's owner. They do not need an account to do this. If you are the one asking, understand that you are handing your contact details to another person, and if you are the binder owner, those details are someone else's to look after too.

Technical. One session cookie, which is how the site knows you are signed in. It holds a random token and nothing about you. Ordinary server logs record IP addresses, timestamps and which pages were requested, which is what lets us tell an outage from an attack.

There is no analytics package, no tracking pixel and no advertising identifier on this site. Nothing is loaded from a third party except card images, which come from Scryfall.

To run the thing: to sign you in, show your binders to the people you shared them with, pass a claim to the owner of the cards, email you when something happens that you would want to know about, and keep the site up. That is the whole list. Your email is not used for marketing and your binder contents are not sold, licensed or handed to anyone for their own purposes.

All of these are outside Australia, which the law asks us to tell you plainly:

• Render hosts the site and the database, in Singapore.
• Resend sends the sign-in links and notification emails, in the United States.
• Scryfall serves the card images, in the United States. Your browser fetches those directly, so Scryfall sees the request the same way any image host would. We send them nothing about you.

Beyond that, information is disclosed only where the law requires it.

Most of it you can already see and edit: your account details are in settings and your binders are yours to change. For anything else, including a copy of what is held about you or deletion of your account and everything in it, ask and it will be done. Deleting an account removes the binders, items and claims attached to it.

Server logs age out on their own. Claims are kept while they are useful to the two people involved.

Come to us first. You will get an answer, and if something has gone wrong you will get a straight account of what and what was done about it. If that does not resolve it, the Office of the Australian Information Commissioner takes privacy complaints at oaic.gov.au.

Changes appear here. If one is significant, such as starting to show advertising or adding anything that tracks you, you will be told before it happens rather than left to notice.