Privacy notice for parents

Who we are. BinderBug is operated by Ramona AI LLC, [mailing address]. Contact: [email protected]. We are the only operator collecting information through this app.

The short version

• Only a parent or legal guardian (18+) can create an account. Kids never sign up, never give an email and never type messages.
• There is no chat, no comments, no ads, no tracking, and we never sell or rent anyone's information.
• Your card photos stay private to your family. Pages show official card art from a card database, never your photos.
• You can see, change or delete everything about your kid at any time, in the app.

What we collect about your child, and why

• Nickname (picked from word lists, never a real name), avatar, color theme, and featured cards: to build their page.
• Birth year (optional): to apply age-based privacy defaults.
• Card photos you take: to identify cards and prove ownership. Photos are stored privately, are never shown to anyone outside your family, and are deleted after 90 days unless you keep one as proof for a valuable card. Photos showing any person are rejected and deleted right away.
• Card list, prices and badges: the page itself.
• Friend connections and sticker reactions: only between kids whose parents both approved.

We do not collect your child's real name, email, phone number, school, location, contacts, voice or face. Photos are stripped of location and camera data on your phone before upload.

What we collect about you

Your email address, password (stored hashed by our sign-in provider), first name, your consent and pledge records, and, on the family plan, payment status from our payment processor (we never see your full card number).

Who we share it with

Only service providers that run the app for us, under contracts that limit their use of the data to providing the service:

• Supabase (database, sign-in and private photo storage, United States).
• Anthropic (reads card photos to identify cards; does not use them to train models under its commercial terms) [confirm data-retention settings].
• Vercel (hosts the website).
• [Payment processor, e.g. Stripe / Apple / Google] for the family plan.

Card names are looked up in public card databases (TCGdex, pokemontcg.io); no personal information is sent to them.

Your child's page is visible only to your family unless you choose otherwise. You can make it visible to approved friends, or create read-only share links, which you can turn off at any time. Dollar values are hidden from visitors unless you turn them on.

Parental consent

Before we collect anything about a child, we ask you to confirm you are their parent or guardian and agree to this notice. Free accounts are private-only and use email confirmation. Sharing a page with friends or by link requires the family plan, where a card payment confirms a parent is in charge.

Your rights

You can review your child's information, change it, stop further collection, or delete your child's page or your whole account at any time from the parent dashboard, or by emailing [email protected]. Deletion is permanent and completes within 30 days, including backups.

How long we keep it

Raw photos: 90 days. Everything else: until you delete it or close your account. Consent records: as long as the law requires.

Security

Data is encrypted in transit and at rest. Every family's data is walled off by database rules so no other family can read it. We keep a written security program and review it at least once a year.