FAB Binder Organizer

Privacy Policy

Last updated 8 September 2026

The short version

Without an account, nothing you create leaves your browser. With an account, we store the email you sign in with, the handle you pick, and your binders and collection - and nothing else. We never see your password. The third parties involved are Supabase (where accounts live), Cloudflare (hosting, analytics and the sign-in captcha) and Google (ads and analytics) - details below.

Guest mode: your data stays with you

Signed out, you can try one binder. It, the light/dark theme and the language choice are stored in your browser's local storage and never sent to us. Clearing site data or using a private window deletes it. When you sign in, that binder moves into your account and the browser copy is removed.

Accounts

An account is optional. You can sign up with an email address and a password, or sign in with Google or Discord. What we store:

  • Your email address. With a password account, the password itself is hashed by Supabase and never visible to us. With Google or Discord, the provider shares the email, name and avatar of the account you chose; we keep the email and use the name only to suggest your first handle.
  • Your profile: the unique handle you pick, an optional country, and your theme and language preferences.
  • Your containers: every binder and the Shoebox, with their settings and the cards in them. The last five versions of each are kept so a bad save can be recovered.

Accounts are hosted on Supabase, which also sends the confirmation and password-reset emails. Your browser talks to Supabase directly; a session token is kept in local storage so you stay signed in, and "Sign out everywhere" in your settings revokes every device's token.

Public profiles are opt-in and off by default. When you turn yours on, anyone with the link sees your handle, country and collection statistics - counts, set completion, most valuable cards and the like - but never your email, and never how your binders are organised. Turn it off and the page disappears.

To close your account, email contact us from the address you signed up with and we delete the account and everything in it. A self-service button is planned. The same address is the place for any question about this policy.

Sign-in captcha

The sign-in and sign-up forms carry a Cloudflare Turnstile challenge to keep bots out. Turnstile runs a small script from Cloudflare that looks at your browser's behaviour and connection to decide whether you are human; it may set a cookie on Cloudflare's own domain for that purpose. Cloudflare does not use it to track you across sites.

Analytics

We load Cloudflare Web Analytics, a small JavaScript beacon that reports page views to Cloudflare. By Cloudflare's design it sets no cookies, uses no local storage and does no fingerprinting or cross-site tracking; what reaches Cloudflare is the kind of technical data any web request carries (page URL, referrer, browser type), which Cloudflare aggregates into page-view statistics for us. We only ever see the aggregates.

We also use Google Analytics, which does set cookies (_ga and similar) to recognize returning browsers and report to us how the site is used - pages visited, rough location, device type - as aggregate statistics. Google processes this data under its own privacy policy. You can block it with any content blocker or Google's own opt-out browser add-on, and the site works exactly the same without it.

Third parties

  • We serve the site through Cloudflare, whose infrastructure handles requests under its own privacy policy.
  • Supabase stores accounts, as described above.
  • Card images load directly from Legend Story Studios' image servers.
  • Links to TCGplayer and CardTrader take you to their sites, governed by their own policies. The CardTrader signup link is a referral: if you register through it, CardTrader attributes the signup to us (see the Terms page).

Advertising & cookies

The one cookie we set ourselves is fab-locale, which remembers the language you picked; everything else of ours (theme, session, guest binder) lives in local storage, not cookies. Cloudflare's analytics script sets none; the captcha's and Google Analytics' cookies are described above. Beyond that, we show ads through Google AdSense, and Google and its partners use cookies (such as the DoubleClick cookie) and similar identifiers to serve and measure ads - including, where permitted, ads personalized from your prior visits to this and other sites.

By using this site you accept this cookie usage - cookies have quietly made the web work since 1994, and we'd rather explain them honestly on this page than interrupt you with an annoying consent overlay.

We may update this policy as the site evolves; this page always reflects our current practice.