Privacy policy

In short

• An account needs an email address. That is the only data the site genuinely requires.
• Your collection is yours. It is not sold, not shared, not public.
• No advertising, no data brokers, no commercial profiling.
• Analytics only start after an explicit yes from you, and can be withdrawn at any time.

Who is responsible for this data

The data controller is the site's publisher, described in the legal notice. For any question, or to exercise your rights: contact@myopbinder.com

Legal notice

What data, why, and on what basis

Every row below is something actually collected. Nothing is gathered just in case.

The password is handled by Supabase's authentication service and stored as a hash. It is never visible to the publisher, and never held in clear anywhere.

Optional. You can leave them empty or clear them from your settings.

The content of those messages is not kept: it is erased as soon as the email is handed to the recipient's server, or definitively rejected. The sending logs themselves outlive the deletion of your account by up to 365 days: they are held by our provider for a period we cannot set.

Signing in with Google

If you choose to sign in with Google, Google passes us your email address, your name and your profile picture. We do not receive your Google password and have no access to the rest of your Google account. This sign-in method is optional: email and password registration remains available.

Google acts here as a separate controller for what happens on its side. What Google does with the sign-in is governed by its own privacy policy.

Analytics

We would like to know which pages are useful and which are not. For that we use PostHog, in its European region.

This tool does not fall within the consent exemption the French data protection authority grants to plain audience measurement, because it ties events to an identified account. So we ask for your consent, and we ask for it properly: until you have clicked, no analytics script is loaded into your browser at all. Refusing is as easy as accepting, and carrying on browsing does not count as acceptance.

You can change your mind at any time from Settings, Account tab. An accepted choice is asked again after six months in any case.

Session recording — video replay of your browsing — is disabled.

Cookies and local storage

The site uses the strict minimum, plus whatever you allow.

• Session cookies: required to keep you signed in. Without them there can be no account. They are exempt from consent.
• Language preference: a cookie remembering whether you read the site in French or English.
• Your analytics choice: kept in your browser's local storage so you are not asked again on every page. It never leaves your device.
• Analytics trackers: set only if you accept them, removed if you change your mind.

Who your data is entrusted to

These providers process data on our behalf, as part of running the service. None of them may use it for anything else.

Transfers outside the European Union

Most of your data never leaves the European Union. Accounts, collections and images are hosted in Ireland; error reports in Frankfurt; our outgoing email in Paris; analytics in Frankfurt as well.

Three exceptions remain. The site's hosting, which handles technical logs and IP addresses. The forwarding of email sent to our contact address. And analytics: its data is stored in Frankfurt, but its contract provides for access from the United States. All three providers are established in the United States. Those transfers rely on the European Commission's standard contractual clauses and, for those who have joined it, on the EU–US Data Privacy Framework.

What we do not do

• We do not sell or rent your data to anyone.
• We do not run targeted advertising and host no advertising pixel.
• Your collection is visible to you alone. There is no public sharing feature today.
• We take no automated decisions producing legal effects concerning you.

Your rights

European law gives you the following rights over your data. Two of them need no message from you: deleting the account and downloading your data are both in Settings, Account tab. For the others, or if you prefer, writing to our contact address is enough. We answer within one month, free of charge.

• Access: obtain a copy of the data we hold about you.
• Rectification: correct anything inaccurate.
• Erasure: have your account and its contents deleted. The “Delete Account” button in your settings does it immediately, and it cannot be undone.
• Portability: retrieve the data you provided in a reusable format. The “Your data” block in your settings delivers your profile, your preferences and your collection, as JSON or CSV. This right is free and will never be reserved for a paid subscription.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask that processing be frozen while a disagreement is settled.
• Withdrawal of consent: at any time, for analytics, without calling into question what was done beforehand.

If our answer does not satisfy you, you may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or cnil.fr.

Minors

In France the digital age of consent is 15. Below that age, creating an account requires the consent of both the minor and the holder of parental authority. A card game attracts young players: if you are the parent of a minor registered here and want the account removed, write to us and we will delete it.

Security

Traffic to and from the site is encrypted. Access to collection data is partitioned per account in the database itself, not merely in the application. Passwords are never stored in clear. No system being infallible, we will inform you if a data breach were to affect your information.

Changes

This policy will evolve with the site. The last-updated date is at the top of the page; where a change is significant, we will flag it in the app.