Privacy policy
What My OP Binder collects, why, where it goes, and what you can demand.
Last updated: 28 August 2026
In short
- An account needs an email address. That is the only data the site genuinely requires.
- Your collection is yours. It is not sold, not shared, not public.
- No advertising, no data brokers, no commercial profiling.
- Analytics only start after an explicit yes from you, and can be withdrawn at any time.
Who is responsible for this data
The data controller is the site's publisher, described in the legal notice. For any question, or to exercise your rights: contact@myopbinder.com
What data, why, and on what basis
Every row below is something actually collected. Nothing is gathered just in case.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | Create the account, sign in, reset the password | Performance of the contract | Until the account is deleted |
| Password | Protect access to the account | Performance of the contract | Until the account is deleted |
| Display name and profile picture | Personalise the interface | Performance of the contract | Until the account is deleted |
| Your collection: cards, quantities, condition, purchase price, personal notes | Deliver the service — this is what the site is for | Performance of the contract | Until the account is deleted |
| Language, currency and theme preferences | Show the site the way you left it | Performance of the contract | Until the account is deleted |
| Server technical logs, including IP address | Keep the site running, detect abuse and attacks | Legitimate interest | As per the host's retention |
| Error reports: message, page, browser, IP address, account identifier | Diagnose and fix failures | Legitimate interest | As per our Sentry plan's retention |
| Analytics: page views, journeys, device | Understand what is used, in order to improve it | Consent | Until consent is withdrawn |
The password is handled by Supabase's authentication service and stored as a hash. It is never visible to the publisher, and never held in clear anywhere.
Optional. You can leave them empty or clear them from your settings.
Signing in with Google
If you choose to sign in with Google, Google passes us your email address, your name and your profile picture. We do not receive your Google password and have no access to the rest of your Google account. This sign-in method is optional: email and password registration remains available.
Google acts here as a separate controller for what happens on its side. What Google does with the sign-in is governed by its own privacy policy.
Analytics
We would like to know which pages are useful and which are not. For that we use PostHog, in its European region.
This tool does not fall within the consent exemption the French data protection authority grants to plain audience measurement, because it ties events to an identified account. So we ask for your consent, and we ask for it properly: until you have clicked, no analytics script is loaded into your browser at all. Refusing is as easy as accepting, and carrying on browsing does not count as acceptance.
You can change your mind at any time from Settings, Account tab. An accepted choice is asked again after six months in any case.
Session recording — video replay of your browsing — is disabled.
As of today no analytics key is configured in production: in practice no tracker is loaded and no banner appears. This section describes what will apply once analytics are switched on.
Cookies and local storage
The site uses the strict minimum, plus whatever you allow.
- Session cookies: required to keep you signed in. Without them there can be no account. They are exempt from consent.
- Language preference: a cookie remembering whether you read the site in French or English.
- Your analytics choice: kept in your browser's local storage so you are not asked again on every page. It never leaves your device.
- Analytics trackers: set only if you accept them, removed if you change your mind.
Who your data is entrusted to
These providers process data on our behalf, as part of running the service. None of them may use it for anything else.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts the site and serves the pages | United States (Vercel Inc.) |
| Supabase | Database, accounts, images | European Union — Ireland |
| Sentry | Error reports | European Union — Frankfurt |
| PostHog | Analytics, if you accept them | European Union (Frankfurt) |
| Namecheap | Forwards email sent to our contact address | United States |
Transfers outside the European Union
Most of your data never leaves the European Union. Accounts, collections and images are hosted in Ireland; error reports in Frankfurt; analytics, once switched on, in Frankfurt as well.
Two exceptions remain: the site's hosting, which handles technical logs and IP addresses, and the forwarding of email sent to our contact address. Both providers are established in the United States. Those transfers rely on the European Commission's standard contractual clauses and, for those who have joined it, on the EU–US Data Privacy Framework.
What we do not do
- We do not sell or rent your data to anyone.
- We do not run targeted advertising and host no advertising pixel.
- Your collection is visible to you alone. There is no public sharing feature today.
- We take no automated decisions producing legal effects concerning you.
Your rights
European law gives you the following rights over your data, and writing to our contact address is enough to exercise them. We answer within one month, free of charge.
- Access: obtain a copy of the data we hold about you.
- Rectification: correct anything inaccurate.
- Erasure: have your account and its contents deleted.
- Portability: retrieve the data you provided in a reusable format. This right is free and will never be reserved for a paid subscription.
- Objection: object to processing based on our legitimate interest.
- Restriction: ask that processing be frozen while a disagreement is settled.
- Withdrawal of consent: at any time, for analytics, without calling into question what was done beforehand.
If our answer does not satisfy you, you may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or cnil.fr.
Minors
In France the digital age of consent is 15. Below that age, creating an account requires the consent of both the minor and the holder of parental authority. A card game attracts young players: if you are the parent of a minor registered here and want the account removed, write to us and we will delete it.
Security
Traffic to and from the site is encrypted. Access to collection data is partitioned per account in the database itself, not merely in the application. Passwords are never stored in clear. No system being infallible, we will inform you if a data breach were to affect your information.
Changes
This policy will evolve with the site. The last-updated date is at the top of the page; where a change is significant, we will flag it in the app.
