Privacy Policy

ChaseBinder is an iPhone app and a website at chasebinder.app, made by Paul Jarrell (“ChaseBinder,” “we,” “us”). This policy explains what information ChaseBinder handles, why, and the choices you have. It covers the app, this website and the ChaseBinder server they talk to.

1. What stays on your iPhone

Everything you put into ChaseBinder is stored on your device, in the app’s private storage:

• your collection and wishlist — cards, quantities, condition and grading details, language, purchase and manual prices, and the dates you added or collected them;
• the photos you take or choose of your cards;
• your settings and your count of free scans for the month.

Unless you’re a signed-in Pro member using backup and sync (section 6), none of this reaches us — and your photos never do. Like other app data, it may be included in your iPhone’s own backups (iCloud Backup or a computer backup) under Apple’s terms. Deleting the app deletes it from your phone.

2. Camera and photos

ChaseBinder uses your camera, or photos you pick from your library, to identify cards. The text on each card is read on your iPhone with Apple’s Vision framework, and your photo is compared on your iPhone with official card images to find the exact printing.

Your photos are never sent to us or to anyone else — not when you scan, and not by backup and sync. When you add a card, its photo is kept on your iPhone so you can see your own copy on the card’s page, and it’s deleted when you delete the card or the app.

When you add photos from your library, the app only receives the photos you pick. Camera access is optional: you can turn it off in Settings and add cards by search instead.

3. Card lookups and prices

To identify cards and show prices, the app sends search requests to card databases. A request contains card details — such as a card name, collector number or set — and never your photos, account or contact details. Searches for Pokémon, One Piece, Gundam and Riftbound cards go through our server, which passes them to Scrydex and keeps Scrydex’s answers (card data, not who asked) for up to a week so the same search is quicker for everyone. The other databases are reached straight from your phone.

App Attest

So only the real ChaseBinder app can use our card service, the app uses Apple’s App Attest. Your iPhone makes a key for the app in its secure hardware and Apple confirms to us that it belongs to a genuine copy of ChaseBinder. We keep that key’s public half, a random identifier for it and a counter, and give the app a short-lived pass for its searches. None of it is linked to your Apple ID, and it can’t be used to track you across apps. It’s only connected to your account if you turn on notifications while signed in (section 7). Requests are also limited per app install and per IP address; those counts are kept in memory for minutes, not stored.

Usage counts

To see how ChaseBinder is used, our server counts, for each day, which app installs used the card service (by their App Attest identifier) and how many card lookups each game got. We never store what you searched for: card searches are kept out of our logs, and Scrydex’s cached answers say nothing about who asked. We look at these counts only as totals, and keep them for up to 400 days.

Like any website, these services receive your device’s IP address and basic request information when the app contacts them, and they handle it under their own privacy policies. If you tap “Open on TCGplayer” or one of a card’s listing links, that card’s page or a search for it (its name, number and set) opens on tcgplayer.com or ebay.com in your browser; nothing about you is added to the link.

4. Accounts (optional)

You can use ChaseBinder without an account. Signing in is offered to ChaseBinder Pro members for features that need our server. If you sign in, here is what we receive and keep:

Sign in with Apple

• an identifier for your Apple ID that is unique to ChaseBinder;
• the email address you choose to share, which may be an Apple private relay address;
• your name, if you choose to share it the first time you sign in;
• a token from Apple that lets us revoke ChaseBinder’s access to your Apple ID when you delete your account, as Apple requires.

Sign in with Google

• your Google account identifier, email address and name.

For every account

• a sign-in session for each device. The session key stays in your iPhone’s Keychain; we store only a one-way (SHA-256) fingerprint of it, with when it was created and last used;
• when your account was created and when each sign-in method was last used.

We use this only to run your account: to sign you in, show your account in the app, and connect the Pro features that need our server to you. We don’t use it for advertising and we don’t send marketing email. Apple and Google sign-ins are kept as separate accounts — we never merge them because an email address matches.

5. ChaseBinder Pro and payments

Pro subscriptions are sold and billed by Apple through your Apple ID. We never see or store your payment details, your Apple ID or your billing address.

• The app checks whether you have Pro on your iPhone, using Apple’s StoreKit. Your free-scan count is kept on your iPhone too.
• If you’re signed in and have Pro, the app sends us the subscription record Apple signed for your purchase, and purchases made while you’re signed in carry your account’s ID so Apple’s updates reach your account. We keep the plan, its expiry date, whether it was refunded, and Apple’s transaction identifiers, so your account knows you have Pro.
• Apple also sends our server automatic notices when a ChaseBinder Pro subscription renews, expires or is refunded. They contain the same subscription details — no name, email address or payment information. A subscription that isn’t linked to an account isn’t connected to you.

6. Backup and sync (Pro)

If you’re a ChaseBinder Pro member and signed in, the app backs up your collection, wishlist and binders to our server and keeps them in step across your devices. It syncs when you open the app, when you come back to it, and a few seconds after you make a change. If you’re not signed in, or don’t have Pro, nothing is backed up.

What’s backed up

Each card’s details: the game, card name, set, collector number and rarity; Pokédex number, type and form; language, finish or printing (such as Reverse Holo), condition and grading details (grading company, grade and certificate number); quantity; your purchase price and any manual price; the market price and when it was checked; links to the card’s official image and its TCGplayer page; whether it’s in your collection or wishlist (and, for cards from the starter wishlist, its group); how you added it; which of your binders it’s in and any Pokédex spots you added it to; and the dates you added or collected it.

Your binders: each binder’s name, what it collects (a Pokédex and range, a set, an artist, a Pokémon, or your own theme), its pocket layout and its place in your list.

What’s never backed up

Your card photos. They stay on your iPhone, and we don’t store photos you take on our servers.

How it’s used

Your backed-up cards and binders are used only to restore and sync your collection for you. We don’t use them for advertising, sell them, or share them with anyone. When you delete a card or a binder, we keep only an empty marker that it was deleted, so your other devices remove it too. Signing out stops syncing; the cards on your phone stay there.

Coming to Pro: the website and share links

Seeing and editing your collection on chasebinder.app, and share links, are on the way. With share links, if you choose to share your collection, wishlist, a game, a set or a binder, anyone with the link will be able to see what you shared — the official card images, prices, quantities and conditions — and your display name. Nothing is shared unless you create a link, and we’ll update this policy with the details before these features launch.

7. Notifications (optional)

ChaseBinder can send you announcements, such as new features and new set releases. It only does so if you allow notifications when the app asks, and you can turn them off at any time in Settings › ChaseBinder › Notifications.

If you allow them, the app sends our server:

• the push token Apple gives your iPhone for ChaseBinder — an address for notifications, not your Apple ID or phone number — and the app’s App Attest identifier (section 3);
• whether you have Pro, which games are in your collection (for example Pokémon and Magic — never the cards themselves) and the app’s version;
• if you’re signed in, a link to your account.

We use these only to send ChaseBinder announcements, sometimes to a group such as Pro members or people who collect one game. They’re never used for advertising or shared. Apple delivers the notifications through its push notification service.

If you turn notifications off, the app has us delete your token the next time you open it. A token Apple reports as no longer working — usually because the app was deleted — is deleted within 30 days. Deleting your account removes the link between your token and your account.

8. This website

chasebinder.app doesn’t use cookies, analytics or third-party trackers, and its fonts and images are served from our own server.

9. Server logs

Like most online services, our server and our hosting provider automatically record basic technical information about requests to chasebinder.app, which is also the address the app uses for accounts: IP address, date and time, the page or API address requested, the response status, and the browser or app version. Card searches and notification sign-ups are logged without what was searched for or sent. We use these logs only to keep the service running and secure — troubleshooting and preventing abuse — and keep them for no more than 30 days.

10. Service providers

We use a small number of companies to run ChaseBinder. They process information on our behalf only to provide their service to us:

• Render hosts our server and database, in the United States.
• Cloudflare provides the domain’s DNS and network protection; requests to chasebinder.app pass through its network.
• Apple and Google provide sign-in. Apple also handles subscription purchases and delivers notifications, and Google hosts our support email.

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a transfer of the ChaseBinder service to a new owner, who would have to honor this policy.

11. What we don’t do

We don’t sell or rent your personal information, or share it for cross-context behavioral advertising. We don’t show ads, use analytics or advertising SDKs, or track you across other companies’ apps and websites. The usage counts in section 3 stay on our own server and are only ever seen as totals.

12. How long we keep it

• Account information: until you delete your account.
• Sign-in sessions: until you sign out, the session expires (one year after you sign in), or you delete your account.
• Backed-up cards: until you delete your account, including after Pro ends, so your backup is there if you come back. A card you delete leaves only an empty deletion marker.
• Pro subscription records: those linked to your account until you delete it; those not linked to any account, which hold only Apple’s identifiers, plan and dates, for as long as the subscription needs tracking.
• App Attest keys: the public key, its random identifier and counter, for as long as that install of the app uses our card service.
• Usage counts: up to 400 days, looked at only as totals.
• Push tokens (if you allow notifications): until you turn notifications off (deleted the next time you open the app), or within 30 days after Apple reports a token no longer works.
• Support emails: as long as we need them to help you.
• Cached card data: Scrydex’s answers to card searches, up to a week (they hold no information about who searched).
• Server logs: no more than 30 days.
• After you delete your account: it is removed from our live database immediately; copies in our hosting provider’s backups expire within 30 days.

13. Deleting your account

In the app, tap the Pro chip at the top of your Collection, then choose Delete account. This permanently deletes your account, its sign-in methods and sessions, your backed-up cards and linked Pro subscription records from our servers, unlinks any notification token from you, and — if you signed in with Apple — revokes ChaseBinder’s access to your Apple ID. The cards on your phone stay there until you delete them or the app.

Deleting your account doesn’t cancel a subscription, because Apple bills it — cancel in Settings › your name › Subscriptions. You can also ask us to delete your account by emailing [email protected].

14. Your rights

Depending on where you live — including the European Economic Area, the United Kingdom, California and other US states — you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and not to be treated differently for using these rights. To use them, email [email protected]. We’ll confirm the request comes from you, usually through your account’s email address, and answer within 30 days. If you’re not satisfied, you can complain to your local data protection authority.

If you’re in the EEA or UK, we rely on these legal bases: to provide what you ask for (your account and its features), your consent (notifications, which you can withdraw in Settings), our legitimate interests in keeping the service secure and working and in understanding how it’s used (server logs and usage counts), and complying with the law. Our servers are in the United States, so your information is processed there.

15. Children

ChaseBinder isn’t directed to children under 13, and we don’t knowingly collect personal information from them. The app can be used fully without an account or sharing any personal information. If you believe a child under 13 has signed in and given us personal information, contact us and we’ll delete it.

16. Security

All connections to our server use HTTPS. Sign-in sessions are stored on our side only as one-way fingerprints, the session key on your iPhone is kept in the Keychain for that device only, and access to our systems is limited to what’s needed to run ChaseBinder. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects it, as the law requires.

17. Changes to this policy

We’ll post any changes on this page and update the effective date. If a change is significant, we’ll let you know in the app or on this website before it takes effect.

18. Contact

Questions or requests about privacy: [email protected]. ChaseBinder is operated by Paul Jarrell.

If you email us, we keep your message and email address so we can answer you. Email us in the app fills in your app version, iPhone model and iOS version; you can see and change them before you send, and nothing is sent until you do.