Privacy Policy
Last updated 7 September 2026
The short version. Virtual Binder is made by a small team. There are no adverts, no analytics, no trackers and nothing is sold to anybody. Your card photos are yours; the only time one leaves our servers is when you tap Bring to life, which sends that single photo to Google to build a depth map. You can delete your account and everything in it from inside the app, and it really is deleted.
1. Who we are
Virtual Binder is an app for cataloguing trading card collections, made by Sotomi Labs.
Sotomi Labs is not yet a registered company, so the data controller for the purposes of the UK and EU GDPR is David Utomo, based in Indonesia.
Write to [email protected] about anything in this policy, including a request to see or delete your data.
2. What we collect
Only what the app needs to work. In full:
| What | Why | Where it's kept |
|---|---|---|
| Your email address | So you can sign in and recover your account. If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple's relay address and never your real one. | Supabase |
| An account ID | A random identifier that ties your binder to you. Our own database stores this and not your email — it cannot tell who you are on its own. | Our server |
| Photos you take of cards | They're what your binder looks like. Each is stored with a thumbnail. | Cloudflare R2 |
| Your binder | Which cards you own, how many, which folders and pages they're on, notes you write, what you paid, prices you set yourself, your wishlist, and any stickers or panels you place. | Our server |
| Purchases | Your credit balance, whether Pro is active, and the Apple transaction identifiers that prove a purchase happened, so it can't be redeemed twice. We never see your card or payment details — Apple handles payment entirely and tells us only that it succeeded. | Our server |
| A notification address | Only if you turn notifications on. Your phone generates a token that lets Apple deliver a message to that one app, on that one device, and we keep it so we can send you the weekly update. It identifies the installation, not you — and it stops working the moment you delete the app. We also keep your time zone, so a notification arrives in the morning rather than the middle of the night. | Our server |
| Launch-list email | Only if you typed it into the form on this website. We keep the address, when you gave it, and where — so we can tell you why you're hearing from us. | Our server |
3. Your photos
Photos you take stay on our storage and are not looked at. They are not used to train anything, not scanned for content, not shown to anyone else, and not shared with any other company — with one exception.
Bring to life sends one photo to Google. When you tap it, that single photo is sent to Google's Gemini API, which returns a depth map that lets the card tilt in 3D. It is sent only at the moment you tap the button, only the photo you chose, and nothing else about you goes with it — no name, no email, no account ID.
Google processes it under the Gemini API terms. If you never tap Bring to life, no photo of yours ever reaches Google.
Recognising a card does not send your photo anywhere. When you scan, the matching runs on our own server against our own catalogue. We keep an anonymous line recording which card was suggested, how confident the match was, and whether you corrected it — so recognition can be improved. That line has no account ID and no image attached to it, and cannot be traced back to you.
Power Search, if you use it in another language. Describing a card sends your description to our server to search against. Your phone translates non-English descriptions into English by itself before sending. If it can't — an older version of the app, or a missing language pack — the server falls back to translating the phrase with Google's Gemini API. So a non-English description may reach Google; an English one never does.
4. Who else sees any of it
The app is built on a small number of services. Each one only receives what it needs, and none may use it for their own purposes.
Each of them is contractually required to protect your data to the same standard set out in this policy. They act on our instructions only, may not use your data for their own ends, and may not pass it on further. Where one of them stops meeting that standard, we stop using them.
| Service | What it receives |
|---|---|
| Supabase | Your email address and sign-in credentials. It handles authentication; we never store your password. |
| Cloudflare | Stores your photos (R2), and sits in front of the service, so it processes the connections between your phone and us. |
| Google (Gemini API) | A single photo when you tap Bring to life. Also a Power Search description, but only in the fallback case described in section 3. |
| Apple | Handles all payments and subscriptions. Tells us a purchase happened; never gives us your payment details. |
| Resend | Your email address, only if you joined the launch list on this website, and only to send you that one message. |
Where your data is held
In the United States. Our server is in St. Louis, Missouri; your photos are in Cloudflare's Eastern North America region; and sign-in is handled in Supabase's North America region. Google, Apple and Resend may process their part elsewhere.
So if you are in the UK or the EEA, your data is transferred out of it. That transfer relies on the standard contractual clauses — the UK addendum where it applies — in our agreements with each of the companies above, and on the EU–US Data Privacy Framework where a company is certified under it. You can ask us for details of the safeguard covering any particular one.
We will also disclose data if the law genuinely requires it — a valid court order, for instance. We would tell you unless we were forbidden from doing so.
5. Why we're allowed to hold it
If the UK or EU GDPR applies to you, our lawful bases are:
- Performance of a contract — your account, your binder, your photos and your purchases. Without these the app cannot work at all.
- Consent — the launch list, and sending a photo to Google for Bring to life. You give it by joining or by tapping the button, and you can withdraw it at any time by leaving the list or not using the feature.
- Legitimate interests — keeping the service secure, stopping abuse, and the anonymous recognition statistics in section 3, which are weighed against your privacy and hold nothing identifying.
6. How long we keep it
- Your account and binder — until you delete them.
- Photos — until you delete the card, or your account.
- Purchase records — kept while the account exists, because they are what stops a purchase being claimed twice.
- Backups — encrypted, and overwritten on a rolling basis within 30 days. A deleted account can survive in a backup for up to that long before it is gone for good.
- What people search for — 90 days, and never attached to you. We keep the words typed into search, how many results came back, and nothing else: no account, no device, no IP address. It is how we find searches that return the wrong card or nothing at all. There is no way to tell from it who searched for what, including for us.
- Launch-list address — until you ask to be removed.
7. Deleting your account
You can do this yourself, at any time, without asking us.
In the app: Account → scroll to the bottom → Delete account, then type DELETE to confirm.
Or email [email protected] from the address on the account and we will do it for you within 30 days.
It is immediate and it cannot be undone. Your binder, every photo, your notes and prices, your sign-in details and any unused credits are all removed. There is no grace period and no copy kept. Unused credits and unexpired subscription time are not refunded — cancel a subscription through Apple first if you want to stop it renewing.
8. Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, hand it to you in a portable form, or stop a particular use of it. Email [email protected] and we will answer within 30 days. It is free, and we will not treat you differently for asking.
If you are in the UK or EEA and think we have got it wrong, you can complain to your national data protection authority. We would rather you told us first.
9. Age
You need to be 13 or older to have an account. If you are between 13 and the age of digital consent where you live — 16 in some of Europe — a parent or guardian needs to agree to this policy on your behalf.
Virtual Binder is not designed for or aimed at children under 13, and we do not knowingly collect anything from them. If you believe a child under 13 has made an account, email us and we will delete it.
10. Contact
Sotomi Labs
[email protected]