Privacy Policy

This policy explains what data Bind ("we", "us") collects, why we collect it, and how you can control it. Bind is operated by DSRV USA, Inc., a Delaware corporation registered to do business in New York. If you have questions, email operation@tcg-bind.app.

1. What we collect

We collect only what we need to run the marketplace:

• Account. Email, display name, your chosen role (collector or partner), and your birthday (used once to confirm you're 18+, then retained only as a year of birth for age-bucket analytics).
• Sign-in identifiers. If you sign in with Apple or Google, we receive an opaque user identifier from that provider. Apple users may choose to share a private-relay email; we use that relay address as your contact email.
• Location. Two kinds: (1) your home location, which you set when you create an account, used to show nearby listings and partner stores; and (2) your current location at the time you message, list, reserve, or pick up a card, used to verify you're physically in the local region for that action. We don't continuously track you in the background.
• Listings and messages. The cards you list, photos you upload, prices you set, and messages you send to other users.
• Device and diagnostic. Operating system, app version, anonymous device identifiers (for session continuity and abuse detection), and crash logs.
• Card scans. When you scan a card with your camera, the photo is sent securely to our matching service to identify the card. We retain card-scan images and use them to improve and train our card-recognition model. These are images of trading cards, not of you, and are stored without being linked to your account or identity. You may email operation@tcg-bind.app with details of a scan to request its deletion.
• Payments. Today, Bind does not process payments for peer-to-peer trades — we never see your bank account, card number, or cash transactions. If we add optional third-party payment processing in the future (for example, Stripe), the data that flows through that provider will be governed by the provider's privacy policy and disclosed here at that time.

2. How we use it

We use the data above to:

• Run the marketplace (show listings, route messages, deliver pickup notifications).
• Verify your age and location (compliance + abuse prevention).
• Detect spam, fraud, and misuse (for example, impossible-travel detection on location fixes).
• Improve and train our card-recognition model, using submitted card-scan images.
• Send you account-related emails (password resets, account changes).
• Send you marketing emails or push notifications — only if you opt in. You can opt out anytime in Settings.

We do not sell your personal data. We don't run third-party advertising in Bind.

3. Who we share with

We share data only with the service providers we need to run the app. Each is bound to use the data only for the service they provide to Bind:

• Supabase — database hosting, auth, file storage, push delivery. Your account data lives here.
• Apple — Sign in with Apple, push notification delivery (APNs).
• Google — Sign in with Google (only if you choose that method).
• Our matching service — receives card-scan images to identify cards and improve recognition.
• Vercel — hosts the Bind website.

We may also share data when required by law (subpoena, court order), or to protect the safety or property of our users or the public. If we ever sell or merge the business, we'd notify you in advance.

4. Third-party data and links

The estimated values Bind displays are Bind's own reference estimates, not data taken from other services. Bind may link out to third-party marketplaces (such as eBay or TCGplayer) so you can do your own research. When you tap an external link, that site opens and is governed by its own privacy policy. We do not share your personal information with those services.

5. Other Bind users

What other users see about you, depending on context:

• Display name (shown on listings and in messages).
• Approximate city of your home location (shown next to listings — for example, "Fort Lee, NJ").
• Distance from them to your listings (for example, "0.4 mi"). We never share your exact GPS coordinates with other users.
• Reputation indicators (transaction count, response time).

Other users do not see your email, phone number, birthday, exact address, or current location.

6. Data retention

• Account data — kept while your account is active.
• Listings + messages — kept for as long as the conversation thread is active, plus 90 days after the listing is sold or removed (so disputes can be resolved).
• Location attestations — only the most recent fix is stored. Prior fixes are kept briefly for impossible-travel detection and then discarded.
• Card-scan images — retained and used to improve and train our card-recognition model. They are stored without being linked to your account. You may request deletion of a submitted scan by emailing operation@tcg-bind.app.
• Account deletion — when you delete your account, we delete your profile + listings within 30 days. Messages may remain in the other party's thread (we anonymize your name there).

7. Your rights

You have the right to:

• Access — see what data we have about you.
• Correct — update inaccurate data.
• Delete — request deletion of your account and data.
• Object — opt out of marketing communications anytime in Settings.
• Portability — request an export of your data (we deliver as JSON).

Email operation@tcg-bind.app to exercise any of these rights. We respond within 30 days.

California, Virginia, Colorado, Connecticut, and Utah residents have additional rights under state privacy laws. We honor those rights consistent with this policy.

8. Children

Bind is for adults 18 and older. We don't knowingly collect data from anyone under 18. If you believe a child has signed up, email operation@tcg-bind.app and we'll delete the account.

9. Security

We protect your data with encryption in transit (TLS), encryption at rest on our hosting provider, least-privilege access controls for our team, and row-level security on every table that holds user data. No system is perfectly secure; if we ever experience a breach affecting your data, we'll notify you per applicable law.

10. International users

Bind is currently available in the United States only. If you access Bind from outside the US, your data may still be processed in the US.

11. Changes to this policy

We may update this policy. Material changes will be announced in-app, and you'll have a chance to re-accept before continuing to use Bind. The effective date at the top of this page tracks the latest version.

12. Contact

Email operation@tcg-bind.app for any privacy question or to exercise your rights.