FAB Binder Organizer

Privacy Policy

Last updated 26 October 2026

The short version

Without an account, nothing you create leaves your browser. With an account, we store the email you sign in with, the handle you pick, and your binders and collection - and nothing else. We never see your password. The third parties involved are Supabase (where accounts live), Cloudflare (hosting, card images, analytics and the sign-in captcha) and Google (analytics; ads are off at the moment) - details below.

Guest mode: your data stays with you

Signed out, you can try one binder. It, the light/dark theme and the language choice are stored in your browser's local storage and never sent to us. Clearing site data or using a private window deletes it. When you sign in, that binder moves into your account and the browser copy is removed.

Accounts

An account is optional. You can sign up with an email address and a password, or sign in with Google or Discord. What we store:

  • Your email address. With a password account, the password itself is hashed by Supabase and never visible to us. With Google or Discord, the provider shares the email, name and avatar of the account you chose; we keep the email and use the name only to suggest your first handle.
  • Your profile: the unique handle you pick, an optional country, your theme and language, and the display preferences from your settings (whether a binder pulls your signed copy first, the reais rate for prices, the full-width binder view).
  • Your containers: every binder and the Shoebox, with their settings (including whether a binder is shared or marked as for sale, and its asking prices) and the cards in them. The last five versions of each are kept so a bad save can be recovered, and a nightly backup of the account database is kept for 90 days on GitHub and in a private Cloudflare bucket - so a closed account lingers in those backups for up to 90 days before it is gone for good.

Accounts are hosted on Supabase, which also sends the confirmation and password-reset emails. Your browser talks to Supabase directly; a session token is kept in local storage so you stay signed in, and "Sign out everywhere" in your settings revokes every device's token.

Sharing is opt-in and off by default, with three separate switches. A public profile shows anyone with the link your handle, country, collection statistics - counts, set completion, most valuable cards and the like - and your collection as a read-only list, but never your email. A binder you share is readable by anyone with its link, page by page as you organised it, whether or not your profile is public; the other binders stay private. A binder you mark as for sale also shows each card's price (and the reais rate you chose). Visitors can copy a shared binder into their own account as a list of cards to find; that copy is theirs and no longer linked to you. Turn a switch off and that page disappears.

To close your account, email contact us from the address you signed up with and we delete the account and everything in it. A self-service button is planned. The same address is the place for any question about this policy.

Sign-in captcha

The sign-in and sign-up forms carry a Cloudflare Turnstile challenge to keep bots out. Turnstile runs a small script from Cloudflare that looks at your browser's behaviour and connection to decide whether you are human; it may set a cookie on Cloudflare's own domain for that purpose. Cloudflare does not use it to track you across sites.

Analytics

We load Cloudflare Web Analytics, a small JavaScript beacon that reports page views to Cloudflare. By Cloudflare's design it sets no cookies, uses no local storage and does no fingerprinting or cross-site tracking; what reaches Cloudflare is the kind of technical data any web request carries (page URL, referrer, browser type), which Cloudflare aggregates into page-view statistics for us. We only ever see the aggregates.

We also use Google Analytics, which does set cookies (_ga and similar) to recognize returning browsers and report to us how the site is used - pages visited, rough location, device type - as aggregate statistics. Google processes this data under its own privacy policy. You can block it with any content blocker or Google's own opt-out browser add-on, and the site works exactly the same without it.

Third parties

  • We serve the site through Cloudflare, whose infrastructure handles requests under its own privacy policy.
  • Supabase stores accounts, as described above.
  • Card images are Legend Story Studios' scans, served from our own copy on Cloudflare (img.fabbinder.com); a scan we do not have yet loads from LSS's servers directly.
  • Links to TCGplayer and CardTrader take you to their sites, governed by their own policies. The CardTrader signup link is a referral: if you register through it, CardTrader attributes the signup to us (see the Terms page).

Advertising & cookies

The one cookie we set ourselves is fab-locale, which remembers the language you picked; everything else of ours (theme, session, guest binder) lives in local storage, not cookies. Cloudflare's analytics script sets none; the captcha's and Google Analytics' cookies are described above. We show no ads at the moment. If ads return (through Google AdSense), Google and its partners use cookies (such as the DoubleClick cookie) and similar identifiers to serve and measure them - including, where permitted, ads personalized from your prior visits to this and other sites - and this page will say so; the opt-outs are these:

By using this site you accept this cookie usage - cookies have quietly made the web work since 1994, and we'd rather explain them honestly on this page than interrupt you with an annoying consent overlay.

We may update this policy as the site evolves; this page always reflects our current practice.