What we keep, and why.
Last updated 24 October 2026Binderlist is run by one person in Sweden. This page says exactly what happens to your data on binderlist.com, in plain words, and nothing that isn't true.
Who is responsible
Kevin Chong, in Sweden, is responsible for your data (the “data controller”). Write to privacy@binderlist.com. Mail to that address is forwarded by Cloudflare to a Gmail inbox, so what you write to us is also handled by Google. A Swedish limited company is being set up to run Binderlist; when it exists, it takes over this role and this page will say so.
What we collect
When you join the list: your email address, when you joined and on which page. With an account: your email address, when you last signed in, the language you use (so emails come in it), which market your prices come from and your currency if you have chosen them, your collection and your want list. If you use Pro: the sets and products you watch, the price targets and set goals you set, and which restock alerts we sent you. If you connect Tradera: your Tradera user ID, your alias and an encrypted access token, plus the listings you create through Binderlist (title, price, status, link) and, when one sells, the amount and date. Never who bought it. Photos: a scanned photo is only used to find the card and is never stored; a photo for a Tradera listing passes through our server straight to Tradera and is not kept. No name, no phone number, no payment details. If you share a binder or your want list, anyone with that link can see its cards, how many copies, today's prices and the name you chose, until you stop sharing it; never your email address or what you paid.
Why, and on what basis
The list: to tell you when Binderlist opens and send news now and then, based on your consent (GDPR article 6(1)(a)), which you can withdraw at any time. Your account and everything you use in it, such as the collection, alerts, price targets, set goals and selling on Tradera: because you asked for that service (article 6(1)(b), a contract). Keeping the service safe from abuse, such as limiting how often a form can be sent: our legitimate interest (article 6(1)(f)).
The emails we send
Only emails you asked for: sign-in links, restock alerts for what you watch, and a note when a price target is crossed. Remove a watch or a target and those emails stop. They are sent through Brevo with open and click tracking switched off. If you turn on notifications on a device, the same alerts also reach it through that device's own push service (Apple's, Google's or Mozilla's, depending on the browser). We keep the address it gives us until you turn them off or sign out on that device, and each message is encrypted so that only your device can read it.
What we don't do
No advertising, and no tracking unless you say yes to Google Analytics (below). Apart from that, your browser loads nothing from other companies: the fonts, the card pictures and the pictures of Tradera listings all come through our own server. Without that yes, the only cookie is the one that keeps you signed in, and it exists only if you sign in. Your data is never sold, and never shared with anyone for marketing.
Google Analytics, only with your yes
If you click Accept in the cookie box, your browser loads Google Analytics. It sets cookies (named _ga) and tells Google which pages you open, roughly where you are (country and city, worked out from your IP address, which Google says it does not store), your device and browser, and where you came from. We use it only to see which pages are used and where visitors come from. Google is told the page, never what is on it: in the app it hears “item” or “set”, not which card, and it never sees your collection, your email or your account. The basis is your consent (GDPR article 6.1 a). Google Ireland handles the data on our behalf; it may be processed in the USA, where Google is certified under the EU-US Data Privacy Framework. Google keeps it for 14 months. Click Decline and nothing loads. You can change your mind at any time under Cookie settings at the bottom of every page, or in the app under Profile, Your data; a no deletes the cookies.
Tradera and eBay
If you connect Tradera, you sign in on Tradera’s own page, so we never see your password. Binderlist then creates the listings you ask for and checks whether they sold. Tradera handles your Tradera account under its own privacy policy. Item pages can also show listings for sale right now on Tradera or on eBay: we show their titles, prices, pictures and links, and never who is selling. Our server fetches them, pictures included, so neither Tradera nor eBay sees you. To find eBay listings that can be sent to you, the request names the item and your country, and nothing else about you. Links to eBay are partner links: if you buy something on eBay after following one, eBay pays Binderlist a commission. The link tells eBay that the visit came from Binderlist and nothing about you, and nothing from eBay is loaded until you tap it. eBay handles your visit under its own privacy policy.
Chase Overlay
Chase Overlay is our app for selling cards live, and it runs on the seller's own computer. Each time it starts it sends a count: a random number made once on that computer, the app's version and whether it is a Mac or Windows. No IP address, name or account is kept with it. If you sign in from the app, it gets its own key to your account, kept on that computer and stored here only in scrambled form, with the computer's name. After each stream it then sends a summary: when the stream started and ended, how many cards were shown and their total value. Never the list of cards, and never anything from the camera. Your computers are listed in Profile, under Chase Overlay, where you can sign any of them out. When phone access is on in a signed-in app, the phone camera page gets a real certificate: the computer is given a random name under cam.binderlist.com that points at its address on your home network (such as 192.168.1.23). That name and address are public in DNS while the computer stays signed in, and the name is listed in Let's Encrypt's public certificate logs; neither says who you are. Signing the computer out removes the name.
Your IP address
To stop abuse, the server counts requests per IP address for a few things, such as signups and scans. That count lives only in the server’s working memory: it is never written to disk or to a log, and it is gone when the service restarts. Neither the app nor the web server keeps a visitor log.
Where your data is stored
On a server run by Hetzner Online in Helsinki, Finland. Nightly backups are stored with Cloudflare, in their EU region. Emails are sent by Brevo, in France. All three handle the data only on our behalf, and it stays inside the EU. The one exception is mail you send us, which arrives in Gmail as described above. Google Analytics, if you accept it, is a second exception (see above).
How long we keep it
The list: until you unsubscribe or ask us to delete it. An account and everything in it: until you delete it, which one button on your profile page does. The history of which restock alerts we sent: 90 days. Your Tradera token: until you disconnect or it expires. Backups roll over after 30 days, so deleted data is gone from them within a month. If Binderlist ever shuts down, we delete everything.
Age
Binderlist is for people aged 13 and over. If you are younger, ask a parent or guardian to set it up with you.
Your rights
You can see what we hold about you, correct it, have it deleted or get a copy. With an account, Download all my data on your profile page gives you everything in one file, and Delete my account removes it all. You can also email privacy@binderlist.com from the address you signed up with, and we answer within 30 days. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (imy.se) or to the data protection authority where you live.
On your device
Your browser remembers your language, theme and a few view choices (in local storage, not a cookie). A collection you build without an account is kept the same way, in this browser only. When you sign in, it moves into your account and is removed from the browser. Your answer in the cookie box is kept the same way, for a year.
If this changes
This page changes first, with a new date at the top.