Privacy notice
Last updated: 25 October 2026
Lorebinder is a free, fan-made collection manager for Disney Lorcana TCG. You can use it without an account: your collection then stays in your browser and we receive none of it. This notice explains what happens to personal data, mostly when you create an account.
Without an account
- Your browser. Your collection, display settings, theme and a copy of the card list are stored in your browser (local storage and IndexedDB) so the site works and opens quickly. The theme stays in this browser even when you sign in. Analytics cookies are used only if you choose to allow optional analytics.
- Hosting. The site is served by Google Firebase Hosting. Like any web server, it processes your IP address and browser details to deliver the pages. We do not look at these logs.
- Card data and images. Your browser loads them directly from Lorcast, an independent service, which receives your IP address as part of those requests. Lorcast is not run by us; its own practices apply.
The sign-in software (Google Firebase) loads on every visit, so Google also receives your IP address and browser details when the page opens, even if you never sign in.
With an account
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (stored by Google in hashed form, we cannot read it) | Create your account, sign you in, send password reset emails | Providing the service you asked for (GDPR art. 6(1)(b)) |
| Account id, sign-up and last sign-in times | Run the account and keep it secure | Providing the service (art. 6(1)(b)) |
| Your saved collection | Cloud save across your devices | Providing the service (art. 6(1)(b)) |
We do not use your data for advertising or profiling, we never sell it, and we do not send marketing emails.
Optional analytics
Only if you choose Allow analytics, Google Analytics for Firebase uses cookies to measure visits, successful sign-ins and sign-outs, account creation, and time spent with the page visible. When a page becomes hidden, we record whether you are signed in and have unsaved changes. This can mean switching tabs or leaving; it does not tell us why you left.
Google receives cookie identifiers, browser/device information and network requests including your IP address. We do not send your email, account id or collection contents in our events. Advertising features are disabled. See how Google uses information from sites using its services.
Analytics is based on your consent and is off until you accept, wherever you visit from.
Use Privacy settings to withdraw at any time without affecting your collection or account.
Withdrawal stops future collection and clears Analytics cookies; it does not erase past data.
The necessary lorebinder_consent cookie remembers your choice and notice revision for
180 days. Analytics cookies (_ga and _ga_*) last 60 days without renewal.
Server-side event retention is controlled separately in Google Analytics; aggregate reports may remain longer.
Contact us using the details below for retention information or privacy requests.
Who processes it for us
Accounts and cloud saves use Google Firebase (Authentication and Firestore). Optional analytics uses Google Analytics. These services are provided by Google under its data processing terms. Account data and cloud saves are stored in the United States. Transfers outside the EU rely on the EU-US Data Privacy Framework, under which Google is certified, and on the Standard Contractual Clauses in Google's terms.
How long we keep it
Account data is kept until you ask us to delete your account. We then remove your login, your cloud collection and your settings together. Copies may remain in Google's backups for a short period before they are overwritten.
Your rights
You can ask for a copy of your data, or to correct, restrict or delete it, and you can object to its processing. To do so, including to delete your account, write to lorebinder.privacy@gmail.com from your account's email address. We answer within one month, free of charge. You can save your collection yourself at any time with Export in the menu (☰). You can also complain to a data protection authority, in Italy, the Garante per la protezione dei dati personali, or the one where you live.
Age
You need to be at least 16 to create an account, or have permission from a parent or guardian. Using Lorebinder without an account has no age limit.
Changes
If this notice changes, the date at the top changes too. Important changes will be shown on the site.