Privacy Policy

Version: privacy-policy-2026-1

Effective date: October 29, 2026

Last updated: October 29, 2026

Operated by: Wyrdbit LLC ("Wyrdbit", "we", "us")

Summary

This summary helps you read the policy. It is not a substitute for the full text.

• BinderPlug (the mobile app and the binderplug.app website, operated by Wyrdbit LLC) is for discovering and coordinating local trading card game trades: United States only, adults only (18 or older). The app asks your phone's app store whether the account on the phone is 18 or older; we keep the result, not an age (Section 9).
• We collect what the app needs, for example email address, display name, password (stored only as a hash), approximate location if you grant it, card lists, and trade activity, plus email you choose to send us (Section 3.6). Your phone and our server both reduce your location to a coarse grid before it is stored, and it is deleted within about 30 days of your most recent update; a coded record limits how often your area can change (Section 3.2).
• Nearby discovery is a core feature: with a stored location and tradeable cards, signed-in users near you can see your display name, avatar icon, distance range, trade reputation, and tradeable cards (Section 5).
• We do not sell personal data, show ads, or train AI models on your data, and there is no private-message system to read.
• Deleting your account deactivates it, deletes or clears most of its data, and shows it to others as "Deleted User"; records other users depend on (like completed trade history) remain so their history stays intact (Section 7).
• Privacy requests go through the request forms on our website. After you confirm a request, data reports, copies, and deletions are handled automatically, and a person answers corrections and questions; you can also delete your account in the app (Section 8).

1. Who we are

BinderPlug is operated by Wyrdbit LLC, a California limited liability company. Mailing address: Wyrdbit LLC, Attn: Owner of Wyrdbit LLC, 31441 Santa Margarita Pkwy, Ste A #8099, Rancho Santa Margarita, CA 92688, USA.

• Privacy requests: access, a copy of your data, correction, deletion, or a privacy question: use the forms at binderplug.app/account/data and binderplug.app/account/delete (Section 8). Account deletion is also in the app.
• General support: [email protected]
• Security and vulnerability reports: [email protected]
• Legal notices and formal correspondence: [email protected]

2. What BinderPlug does, and what this policy covers

BinderPlug helps collectors discover possible local trades by comparing wanted cards with cards offered for trade, and helps them coordinate an in-person meetup. Trades happen in person, between users, outside the app. The app works with card lists, approximate proximity, and trade coordination records. It does not handle payments or shipping addresses, and it has no private conversations between users.

This policy covers the BinderPlug mobile app, the binderplug.app website (including its privacy-request, account-deletion, and bug-report forms and its Share Binder pages) and the related services we operate for BinderPlug. It does not cover third-party services that carry their own policies (Section 6).

BinderPlug is offered only to users located in the United States; we make no representation that it is available or appropriate elsewhere.

3. Information we collect

3.1 Account information

• Email address: used to sign in, verify your account with a one-time code, and send account email (verification codes, password resets, security notices, and a one-time getting-started email).
• Display name: chosen at registration and shown to other users. Display names are unique and permanent: they anchor your local reputation, so there is no name-change feature and we do not change names on request. We may change a name where the law requires it, and moderation may rename a name that violates our rules (Terms of Service, Section 2).
• Password: stored only under strong one-way protection, which we review against current standards; we cannot read it. New passwords are screened against lists of passwords known to have been exposed in breaches. The screening service receives only the first few characters of a one-way hash of the new password, and never your password, email address, or account identifier (if the service is temporarily unreachable, the check may be skipped).
• Age check result: whether your account passed the 18+ check, how it was checked, and when (Section 9). We do not collect your birth date or age range.

You can change your account email in the app. Verification codes go to both addresses, and each gets a security notice identifying the other address involved so you can judge whether a change was really yours; the old address gets a 72-hour recovery option. Retention: Section 7.

Our email provider tells us when mail to your address bounces or is marked as spam; we keep that status so we stop sending to addresses that cannot receive mail. It is deleted with your account, and entries that clear are deleted about 400 days after they clear.

Acceptance records. When you create an account you accept a registration notice that names the Terms of Service and Privacy Policy versions it covers. If your phone's app store cannot confirm that its account is 18 or older, you also confirm the 18+ age attestation (Section 9). If we later ask you to accept a new version of either policy in the app, you accept it the same way. For each acceptance we record the document and version, the server-set time, the screen, and the app version (not your network address) in an append-only ledger written with your account. Choosing a meetup place in the app requires acknowledging the meetup safety disclaimer. The app lets you continue only after our server confirms it has recorded that acknowledgement for your account, with the document and version, the server-set time, the screen, and the app version, in the same append-only ledger. We keep the exact wording of each notice, attestation, and disclaimer version, so the accepted text can be shown later.

3.2 Location (approximate; required for nearby features)

BinderPlug's core features (finding nearby traders and listing public meetup places between you and a trade partner) require your approximate location. You can build and share binders and manage existing trades without it, though features that measure distance will not work, and you can revoke the permission at any time in your device settings.

• The app requests only approximate location: on Android it can request nothing more precise than coarse location, and on iOS it requests reduced accuracy. Navigation-grade GPS is never requested. If you have allowed precise location for BinderPlug in your iPhone settings, the operating system may give the app a more precise reading; the rounding below still applies before anything leaves your phone.
• Before sending a location, the app rounds it on your phone to a grid of roughly 2-kilometer squares, and our server rounds it to the same grid again before storing it. We keep only the rounded point, its update time, and your search radius. Each accepted update replaces the last. We keep no history of your locations, apart from the area-change record described below and the meetup details of your trades (Section 3.3).
• Area-change record: to limit how often the area used to show you to other traders can change, we keep a record of up to five approximate areas (grid squares) your stored location has used, with the time each was last used, and the time a new area was last added. Each area is kept only as a keyed one-way code, not as a place or coordinates. Each area stops counting toward the limit 24 hours after it was last used, and the whole record is deleted 24 hours after your last accepted location update, so an area can stay in the record for up to about 48 hours. Because of this limit, a move to a new area may take effect later than the move itself, and if the record cannot be checked the move waits; until it takes effect, distances between you and other traders are measured from your previous approximate area. We use this record solely to apply that limit: it is not shown to anyone and is not used for any other purpose. It is deleted when you delete your account, and it is not cleared when you clear your location or revoke the permission, so that clearing cannot reset the limit.
• Location is read only while the app is open; no background tracking or geofencing.
• We do not show other users your stored location or an exact distance, only a range (for example, "5–25 mi").
• Retention: we keep your reduced location only to place you in nearby discovery and to list public meetup places between you and a trade partner. It is deleted within about 30 days of your most recent update. When the app detects that you revoked the permission or turned off location services, it asks our server to clear your stored location, the next time you open the app, and retries later if it cannot reach us. Once cleared, you no longer appear to nearby traders.

3.3 Cards, trades, and community activity

• Card lists: cards in your Offer Binder and Wishlist, with printing, condition, treatment, and quantity details, and whether a wanted card can be matched by any printing.
• Trade records: proposals, responses, meetup choices (which public meetup place, what time), arrival signals you send ("on my way," "arrived"), a trade-action history log, and related trade-history records.
• Feedback: per-trade thumbs-up/down ratings with optional per-aspect ratings (for example punctuality, accuracy, and friendliness), and the reputation and badges derived from them together with your own trading activity. Feedback has no free-text comments. We also keep the ratings you give meetup places and your reports about a place (that it has closed, has moved or has the wrong address, or that something there affects meeting traders).
• Reports: who reported whom, the chosen category, the outcome of our review, and related case-handling records. Reports have no free-text field. Reports may be prioritized using the reporter's own history. Any signed-in user may report any other user; reports are visible to us, not to other users.
• Blocks, share links, saved traders: the accounts you block, the Share Binder links you create and related usage records, and the traders you save.
• Avatar and preferences: an avatar from the app's built-in icon set (photo uploads are not offered), search radius, distance units, notification settings, and records of when certain notifications and reminders were sent so they are not repeated. The analytics setting is stored on your device rather than with your account, so set it on each device you use (Section 3.5).
• Activity days: the dates (date only) your account was active, kept 90 days so we can count how many people use BinderPlug. This date record is separate from the product analytics in Section 3.5.

3.4 Device and technical data

• Camera (QR scanning only). The app's QR scanner uses the camera only to read another trader's QR code, on your device; nothing is recorded, stored, or uploaded. Scanning a trader's code opens their shared binder in the app (Section 5).
• Push notifications. If enabled, we store a delivery token for each device you use. Notifications cover your trades, nearby matches, reputation and quest events, and account changes: yours or a trade partner's. Their content passes through Expo's push service and then Apple's or Google's in readable form, and can include another trader's display name, a meetup place's name, a meeting date and time, and card names.
• Card images. Card images are fetched directly from the catalogs' image servers (Scryfall for Magic, TCGdex for Pokémon), in the app and on Share Binder web pages, so those services receive your device's network address, and the requests reflect which cards you view.
• Maps and directions. When you tap Map or Directions for a meetup place, the app opens Apple Maps or Google Maps (or the Google Maps website) with the place's name and address, or its map location when the address is missing. That service receives the request, including your device's network address, under its provider's own privacy policy, and for directions it may use your device's location under its own settings. On iPhone, the app remembers which maps app you chose on that device only.
• App updates. The app checks for updates against our update service. The check sends technical details about the installed app and no account identifier; we keep only aggregate daily counts, though the network that serves the check sees your device's network address.
• Website. Our website has no analytics or advertising tools and sets no cookies of its own. Cloudflare, which runs the network in front of it, and the Turnstile check on our forms process your network address and may use cookies or similar browser storage for security.
• Public request forms. Our website's privacy-request and account-deletion forms each identify the kind of request being made and ask for the account's email address, and optionally a display name, a country or region, and a short message. They use Cloudflare Turnstile to screen out automated abuse: Cloudflare processes your device's network address to run that check. We do not store your network address itself (only a one-way code derived from it), and we do store your browser's user-agent string and similar technical data as they were sent, alongside the request and its processing history, for abuse prevention and audit. Form submissions are rate-limited.
• Bug-report form. Our website's bug-report form collects the platform, app version, device model, your description of the problem, and a contact email, plus the same technical data as the other forms. Bug reports are kept on the schedule in Section 7.
• Device checks. To limit automated and duplicate sign-ups, sign-up can include a device integrity check provided by Apple (App Attest) or Google (Play Integrity). When it does, we store the result of the check with your account and link your account to a one-way-hashed identifier for the phone, never device contents. These records let us count how many accounts are created on one phone and investigate coordinated abuse. They stay with the closed account record after deletion (Section 7).
• Sessions and server logs. Sign-in session records include the network address and device/browser string in use. We keep them while the session lasts and, once a session has ended, for up to seven days so we can investigate security problems; sign-in records also help us detect duplicate accounts and abuse (Section 4). Our servers keep operational logs of request metadata (including network addresses) for reliability, security, and abuse prevention; we do not log passwords, authentication tokens, or one-time codes, and personal details in these logs are reduced where we can.
• Local storage on your device: session tokens, your account details (including your email address), cached data, and settings stay on the device. Signing out removes your sign-in tokens (if the sign-out cannot reach our server, the app keeps the token only to finish the sign-out later); some cached data and settings remain after you sign out. Uninstalling the app removes its stored data, except that on iPhone, sign-in items kept in the system keychain can remain on the phone after the app is deleted.

3.5 Analytics and crash reporting

• PostHog (product analytics). The app sends selected product events (for example, account created or trade proposed) and app-lifecycle events (for example, app opened, installed, or updated), with the name of the screen you were on and basic technical properties the analytics SDK attaches automatically (such as app version, operating system, device model and screen size, language, and time zone). While you are signed in, events use a random analytics identifier we assign to your account instead of your account ID. Before you sign in, PostHog uses a random identifier stored on your device; those events can be linked to your account when you sign in. These identifiers are not your name or email address, but the data is pseudonymous, not anonymous. Analytics does not replay your session, does not capture your screens automatically, and does not derive your location from your network address. "Share Usage Data" is on when you first install the app; you can turn it off in Settings → "Share Usage Data", and off means no analytics events at all, including at app start. The setting is stored on your device, so set it on each device you use. Where this data is processed: Section 11.
• Sentry (crash and error reporting). When the app or our servers hit an error, a report goes to Sentry with technical context, including basic device details (such as model and operating-system version). These reports are configured not to carry your account identity, the network address is stripped from server-side reports, and our own telemetry sends indicators rather than raw identifiers. Crash reporting is separate from the analytics setting and not affected by it.

3.6 Email you send us

If you email our published addresses (support, security, or legal, listed in Section 1) or reply to a message from us, we receive and keep what you send: your email address, the message contents and any attachments, and ordinary delivery metadata. We use it to handle your support question, account or security issue, appeal, report, or legal matter, to keep a record of how it was handled, and to protect our users and ourselves. These mailboxes are hosted by Google Workspace (Section 6). Retention: Section 7.

The categories in Sections 3.1 to 3.5 describe what the app itself collects and requests. Correspondence and attachments may contain additional personal information. For legal notices and authorized-agent requests, we may ask for contact details, a signature, or proof of authority, as described in our Terms of Service and Section 8.

These messages are not part of the access and copy reports described in Section 8, which cover the records in BinderPlug's own systems. If you want copies of correspondence you sent us, make a "Privacy question" request (Section 8) from the address you used, and a person will handle it. If you delete your account, we delete correspondence we no longer need for the matter it belongs to; messages tied to an active safety, abuse, security, or legal matter are kept until that matter ends.

3.7 What we do not collect through the app

(Email you choose to send us is described in Section 3.6 and is under your control.)

• No payment information (the app has no purchases).
• No birth date or age range. When your phone's app store shares an age range, it stays in the app on your phone, and a birth month and year you type are checked on your phone; neither is sent to us (Section 9).
• No access to your phone's contacts, photo library, or microphone; camera use is QR scanning only. (Traders you save in the app are kept as a list in your account, Section 3.3.)
• No navigation-grade GPS, no background location, no advertising identifiers, and no third-party advertising or tracking SDKs.
• No private messages: there is no chat system, and feedback and reports have no free-text fields.

3.8 Categories under U.S. state privacy laws

Some state privacy laws use their own vocabulary for personal information. This table maps what Sections 3.1 to 3.6 describe onto those categories.

The app does not request or collect precise geolocation, government identifiers, biometric or health data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or the contents of communications with other users (there is no user-to-user messaging). What you volunteer in an email to us (Section 3.6) is under your control and may contain information beyond these categories.

4. How we use information

We use the data above to: create and secure your account; check that accounts belong to adults and review accounts placed on hold for age (Section 9); match Wishlists with Offer Binders and show nearby traders; coordinate trades; deliver notifications you enable; show trade partners community-produced reputation signals; review reports and enforce our Terms of Service; detect and prevent fraud, abuse, duplicate accounts, and threats to our users (including re-registration abuse after a ban, and limits on how many accounts are created on one phone); diagnose crashes and understand aggregate usage; respond to messages you send us; and comply with legal obligations.

We do not sell or rent personal data, share it with advertisers or data brokers, or use it to train AI models.

5. What other users can see

BinderPlug is a local trading community, so some information is visible to other users by design:

• your display name, avatar icon, join date, an indicator of whether you have signed in recently, and your trade reputation (trust tier, completed trades, unique partners, repeat trades, positive-feedback rate, and your positive and negative feedback counts);
• your presence as a nearby trader. If your account has a stored location and tradeable cards in your Offer Binder, signed-in users near you can see you in the Nearby list. That happens two ways: traders whose card lists match yours can find you from farther away, and traders simply browsing the Nearby list (with no matching cards) can also see you, at a shorter reach. The reach is regional either way, not neighborhood-sized. Both see your display name, avatar icon, distance range, trade reputation, and a preview of your tradeable cards, and can open your full tradeable-card list with quantities. Your Wishlist is different: other traders are not shown the list itself; they see matches, the cards where what you want lines up with what they offer. Distance is shown as a range, only to signed-in viewers, and only when both of you have a stored location; your stored coordinates are never shared, though ranking signals may reflect relative proximity between the coarse stored points;
• in a trade, the cards each side puts into the proposal, which the other trader sees with the trade;
• anything you put in a Share Binder link. Your share link is off until you turn it on. While it is on, anyone holding the link can see what it shares, with no account and no sign-in needed: your display name and the cards in your Offer Binder that are up for trade, with each card's image, name, and quantity. The link opens in the BinderPlug app, or as a preview page in a web browser, and both show the same things to someone who is not signed in. They do not see your avatar, trade reputation, join date, card details such as condition, or any location. Signed-in BinderPlug users who open the link see what they would see in Nearby: your public trading profile, card details, and a distance range when both of you have a stored location, and they can save you as a trader. When you send the link in a messaging app, that app may show a preview with your display name and how many cards you have up for trade, and it may keep that preview after the link stops working. The app can also display the link as a QR code for someone to scan, and scanning another trader's code opens their shared binder the same way. You can turn the link off at any time, or replace it with a new one; either way the old link stops working, and you are removed from the saved-trader lists of everyone who saved you, until they open a current link and save you again. Deleting your account deletes the link. We ask search engines not to index the web page, but while a link is live, anyone holding it can open the binder;
• your feedback scores and trade statistics.

There is no separate visibility switch for Nearby: appearing follows from having a stored location and tradeable cards. To stop appearing, revoke the location permission (the app then clears your stored location, Section 3.2) or remove tradeable cards from your Offer Binder. Blocking a user removes each of you from the other's discovery surfaces, stops new trades between you, and cancels trades between you that haven't happened yet; a trade whose meetup time has already passed stays open so each of you can leave feedback. We do not tell the other person that they were blocked. Past trade records on their side keep your display name.

Other users and people who receive a Share Binder link can copy, screenshot, or pass on anything they can see. Turning a link off or deleting your account cuts off access to a shared binder; blocking is not a reliable way to cut off access to a shared binder: it stops the blocked account while signed in, but the link still opens without signing in. And nothing we do can delete a copy someone has already made.

PUBLIC MEANS PUBLIC

Anything you show other traders or put behind a share link can be seen, saved, and passed on by people you did not choose. Exercise caution before revealing information that could identify you in the real world.

6. Service providers and other disclosures

We share data with providers only as needed to run BinderPlug:

Legal, safety, and business-transfer disclosures

Besides the providers listed above, we may disclose information:

• to comply with law, legal process, subpoenas, or lawful requests from public authorities;
• to enforce our Terms of Service, investigate suspected fraud or abuse, or protect the rights, property, or safety of users, the public, or us, including responding to an emergency involving a risk of serious harm; and
• to a successor if Wyrdbit LLC is involved in a merger, acquisition, financing, or sale of assets. If that happens we will require the successor to honor this policy, or give you notice before a materially different policy applies to your data.

We do not volunteer account information to law enforcement outside these situations, and we have no obligation to tell you about a legal request where telling you is prohibited or would risk harm.

7. Retention and deletion

Data is retained while your account exists, and for the purposes and periods below. Beyond these, we may retain the subset of records reasonably necessary for an active security incident, an abuse investigation, a legal hold, or a legal obligation, until that need ends, after which we delete them or reduce them to records that no longer identify you.

You can delete your account in the app (confirmed with your password), or on the account-deletion page or through a privacy request, where the deletion is carried out after the waiting period described in Section 8. Either way, deletion deactivates the account and deletes or overwrites its data as follows:

• your display name is replaced with "Deleted User"; your email address, avatar, location, push tokens, and settings are overwritten or cleared; and the account is permanently barred from signing in. The area-change record described in Section 3.2 is deleted (if that fails, it is still deleted automatically 24 hours after your last accepted location update);
• sign-in sessions are revoked; your Share Binder links are deleted; saved-trader entries are deleted in both directions (the traders you saved, and other people's entries for you); and your badges, activity days, and alert subscriptions are deleted;
• cards in your Offer Binder and Wishlist are deleted, except cards that are part of a trade, which are kept, hidden from your lists and from matching, so that trade's record stays complete;
• in-progress trades are cancelled and we attempt to notify your partners; they keep a record of the cancelled trade, and your account appears to them as "Deleted User";
• completed trade records, per-trade feedback ratings, report records and blocks are retained (your name shows as "Deleted User") so other users' history and our moderation records stay intact; your ratings of meetup places and your place reports are also retained, and are never shown with your name; notes you added to a trade's history are removed. Feedback left by deleted or banned accounts stops counting toward reputation totals; the underlying ratings are retained. These records stay linked internally to the deactivated and pseudonymized account for as long as the other users' records they support exist; acceptance records are retained per the table above;
• bug reports sent through our public form from the account's current email address keep their content but lose the contact address;
• we keep limited information about closed accounts, for these purposes. A one-way code derived from the account's email address (we keep the code, not the address) enforces the hold on registering again with the same address; we delete it after that 30-day hold, unless an open report or a pending or active ban involving the account still needs it. If the account is permanently banned when it is deleted, codes derived from its email addresses are kept so that deleting an account does not undo a ban, for as long as that purpose lasts. If we delete an account because its holder is under 18, the address is blocked from registering again for one year. The device-check records described in Section 3.4 and the age check records described in Section 9 stay with the closed record so that deleting an account does not reset device limits or erase the record of how eligibility was checked. The Terms of Service (Section 10) describe how deletion affects registering again with the same email address.

Deletion is not reversible. We may keep other records where required for safety, fraud prevention, security, or legal obligations. We keep the 35 most recent daily encrypted database backups, so deleted data normally ages out of those backups about 35 days after deletion; our database host also keeps short-term recovery copies under its own retention.

8. Your choices and rights

How to make a privacy request. Use the request forms on our website: binderplug.app/account/data for access, copies, corrections, and general privacy questions, and binderplug.app/account/delete for account deletion. Account deletion is also available in the app (Settings → Delete Account, with password confirmation). Before acting on a request about an account, we verify that you control its email address: the form sends a single-use verification link that expires after a short time. The link opens a page that shows the request, and nothing happens until you confirm it there. Requests for a data report, a copy of your data, or deletion are then handled automatically, and anything the automatic handling cannot complete goes to a person, who replies by email. If the account's email address, or control of the account, changes after you confirm one of those requests (for example through an email change or a password reset), we don't carry it out; we ask you to make a new request. Corrections and privacy questions are answered by a person, after an automatic email acknowledging the request. We act on the form's message only for corrections and privacy questions, so to ask us anything else, including about a report, copy, or deletion, make a "Privacy question" request. In-app deletion uses your signed-in session and password confirmation instead. We do not disclose, change, or delete data on an unverified request. That verification rule applies to requests about an account's own data; a report that someone under 18 holds an account is not a privacy request and is handled as Section 9 describes: on our own investigation, not on the report alone.

• Access: a report of the personal information linked to your account, as a plain-text file. We email the account address a link to download it, which works for up to five downloads. The download link stops working after 72 hours, and a daily cleanup then deletes the file. The report lists up to the most recent 1,000 records in each category, and describes some categories rather than listing them, for example one-way codes and security records. If the report can't be built automatically, we email you that a person will handle it, and a person follows up. If no account uses the address, we tell you so; some records, such as trade history kept for another trader, can outlast an account, and a person will look into those if you ask in a "Privacy question" request. Bug reports are not included: the public bug-report form accepts any email address without proof the sender controls it, so a report carrying your address is not necessarily yours. To get or delete a bug report you sent, make a "Privacy question" request from the address you used and tell us in the form's message field roughly when you sent it and what it was about, and a person will find it. Email you sent to our addresses is handled the same way (Section 3.6): it is not in the report, and a person retrieves it on request.
• Copy of your data: a machine-readable (JSON) file with every record the report lists, without its per-category limit, subject to the same exclusions and delivered the same way.
• Correction: you can change your email address (with verification), avatar, and preferences in the app; where an in-app control exists, our response points you to it. Display names are permanent (Section 3.1), so they are not correctable on request. For anything else, submit a correction request and a person reviews it. If we decline a correction, we explain why.
• Deletion: in the app, on the deletion page, or through a privacy request. Deletion in the app happens right away. For a request on the deletion page or through a privacy request, after you confirm it we email the account address the time after which the account will be deleted, at least 24 hours later, with a link to cancel. If you cancel before the deletion is carried out, nothing is deleted. After that time the deletion is carried out automatically, and we email you when it is complete. If we cannot send that notice, or anything else needs a check, a person handles the request instead. Once carried out, deletion cannot be undone. Section 7 describes exactly what deletion does.
• Location: grant or revoke the permission in your device settings at any time (Section 3.2 describes what revoking clears and what it does not).
• Sign-in sessions: you can sign out on the device you are using, and changing your password signs out your other sessions.
• Analytics: Settings → "Share Usage Data" (off = no analytics events at all). The setting is stored on your device, so set it on each device you use; crash reporting is separate (Section 3.5).
• Push notifications: you can turn notification categories off in the app, and turning notifications off in your device settings stops them appearing on that device.

We answer verified privacy requests within 45 days, and we will tell you if we need more time (up to a further 45 days) as state privacy laws allow. That is subject to verifying who you are and to the exceptions those laws provide. Your privacy-request records are kept for 24 months after you submit the request (Section 7).

United States. Depending on your state, you may have statutory rights to access, correct, delete, or export personal data, and to opt out of sale, sharing, or targeted advertising. We do not sell or share personal data as the California Consumer Privacy Act defines those terms, and we do not use it for targeted advertising, so there is nothing to opt out of. We answer access, correction, deletion, and copy requests from all users, regardless of state; you can make them through the request forms or the app, as described above. Our website does not respond to browser "Do Not Track" signals, and we do not track visitors across third-party sites; because we do not sell or share personal data, a Global Privacy Control (GPC) signal does not change how we handle information.

• If we decline your request, we tell you why, and you can appeal. Reply to our decision, or make a new "Privacy question" request through the privacy-request form with "appeal" in the message, identifying the request and the decision. A person reviews it, and we tell you the outcome and our reasons. If you disagree with the outcome, you may contact the attorney general of your state.
• Authorized agents. You can use an authorized agent to make a request. We will ask for proof of the agent's authority (for example a signed permission or a power of attorney) and we may contact you directly to confirm.
• No penalty for asking. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

9. Age requirement: adults only

BinderPlug is for adults and is not directed to children or teens. You must be 18 years of age or older to create or hold an account, and accounts may be created only for yourself.

• The age check uses your phone's app store. When you create an account, and when you sign in, the app asks your phone's app store whether the Apple Account or Google account on the phone belongs to someone 18 or older (Apple's Declared Age Range on iPhone, Google Play Age Signals on Android). Your phone may ask you to share an age range with BinderPlug. The range stays in the app on your phone: the app sends us only the result, which store gave it, and the technical details listed below.
• When the store cannot answer. Where the store cannot give an answer on your phone (for example, older phone software, an account its age feature does not cover, or a choice not to share where sharing is optional), creating an account asks for your birth month and year instead, which are checked on your phone and never sent to us, and asks you to confirm the statement "I am 18 years of age or older." We record which version of that statement you confirmed and when (Section 3.1). Where the store could answer once something is fixed or finished (for example, updating Google Play, or an age step Google Play asks you to complete), the app asks you to do that and try again. If the store's answer is unclear, the account can't be created on that phone until the store gives a clear answer. Signing in to an existing account when the store cannot answer relies on the check made when the account was created, except where Google Play asks you to finish its age step first.
• What we record. For each sign-up: whether Apple, Google, or your own confirmation answered the check, the answer codes the store gave, your app, operating-system and store-software versions, when the check ran, and the versions of our age policy and registration notice. On the account itself, we keep the latest result (allowed or refused), its source, and when it was recorded. We never receive or store a birth date, an age, or an age range. Retention: Section 7.
• If the check refuses a sign-up, no account is created, and the app reports only that a refusal happened. We log the attestation version, whether the refusal came from an app store (and which one), the time, the app version, and a one-way code derived from a partially masked network address. The log holds no birth date, no age, and nothing that names an account. These entries are deleted after 90 days.
• Not identity verification. The store's answer describes the Apple Account or Google account on the phone, and a typed birth month and year are self-declared. We do not verify who is holding the phone or anyone's actual age.
• Accounts placed on hold. If the store reports an age under 18 when someone signs in to an existing account, we place the account on hold: it cannot sign in, it is signed out on every device, hidden from other traders (including Nearby, discovery, and saved-trader lists), and its open trades are cancelled, except confirmed trades whose meetup time has already passed, which stay open for feedback. A person reviews every hold. The account holder can email [email protected] from the account's email address to explain, for example, a shared or family phone. If the explanation fits an adult, we release the hold. If it does not, or if we do not hear back within seven days, we may delete the account as described below.
• Under-18 accounts. If we learn an account is held by, or was created for, a person under 18, we will terminate it and apply the deletion treatment in Section 7, as our Terms of Service state. The account's email address then cannot be used to register again for one year, unless a person lifts the block earlier on a verified request through support.
• If you believe someone under 18 has an account. A parent, guardian, or anyone else can tell us without controlling the account's email address: email [email protected], or make a "Privacy question" request on the privacy-request form (Section 8) and say so in the message field. This is a report, not a privacy request about your own account, so the account-email verification in Section 8 does not apply to it: we act on our own investigation, not on the report alone. We may ask for enough information to locate the account. If we find the holder is under 18 we terminate the account and apply the deletion treatment in Section 7. We do not disclose account information to the person reporting.

Questions about this section: use the privacy-request form (Section 8).

10. Security

Passwords are stored only under strong one-way protection and screened against lists of known-breached passwords (Section 3.1). Connections to our servers are encrypted in transit. Sign-in uses tokens that expire and can be revoked, and email verification uses one-time codes that expire and are rate-limited. We accept vulnerability reports at [email protected].

No system is perfectly secure, and we cannot guarantee absolute security.

11. Where data is processed

Our servers and database are hosted by Render in the United States. Analytics data is hosted by PostHog in the EU. Encrypted database backups are stored with Cloudflare. The other service providers in Section 6 may process data in the United States or in other countries where they operate. BinderPlug is offered only in the United States (Section 2); if you reach it from somewhere else, that does not make it available there, and your data will still be transferred to and processed in the places described here.

12. Changes to this policy

This policy is versioned; from its effective date, each change is recorded here. If we make a material change, we will announce it at least 30 days before it takes effect (at least 60 days for a change that materially reduces your rights, materially expands our use of your data, or changes dispute-resolution, liability, or fee terms) by email to your account address. A change required by law, or needed urgently for security, may take effect sooner, but shorter notice never shortens consent: a change that materially expands our use of your data applies to your data only after you accept it. That consent step is a blocking screen in the app: it asks you to review and accept the new version before you keep using your account, and it records your acceptance. We keep a dated record of each version and its announcement. Non-material changes, for example clarifications, contact-detail updates, or new features that do not reduce your rights, take effect on posting with an updated version identifier.

13. Contact

Wyrdbit LLC (Attn: Owner of Wyrdbit LLC): mailing address in Section 1. Privacy requests: the forms at binderplug.app/account/data and binderplug.app/account/delete (Section 8) · General support: [email protected] · Security and vulnerability reports: [email protected] · Legal notices: [email protected]