PeachyBind Privacy Policy

Last updated: 8 October 2026 · Effective for the PeachyBind mobile apps, web collector studio, and peachybind.com marketing pages

PeachyBind is a photocard collection service operated by Bernardo Costa, an individual based in Portugal (“operator”, “I”, “me”). I am the data controller for personal data described here. This policy explains what data is collected, why, legal bases under the GDPR (where it applies), and your choices. Contact: astrylvyan@gmail.com.

1. Data I collect

• Account data — email address, Google account profile (name, email, photo) when you sign in with Google, and passwords hashed by Firebase Authentication.
• Profile data — display name, username, optional profile photo, showcase preferences, trade contact fields you choose to add, language, and collector settings.
• Collection data — binders, owned cards, wishlists, cosmetics, quests progress, and related activity you create in the app.
• Photos / media — images you capture or upload for card claim, catalog submission, on-device recognition, or profile — stored in Firebase Storage. When you manually correct card crop corners during catalog submission, I may also store the original photo, the initial automatic crop, and your corrected crop to improve auto-framing (not linked to the public catalogue until a submission is approved).
• Recognition — when you use scan/match features, image embeddings may be computed on your device and a query vector may be sent to my backend, which queries a Pinecone vector index to suggest catalogue matches. I do not use this to identify you outside providing the feature.
• Marketplace activity — listings, interest pings, and group-order participation (no payment card data processed by PeachyBind for collector-to-collector trades).
• Shop payments — Cash Premium may be purchased via Google Play billing on Android (when enabled) or via Stripe on supported checkout flows. Peach packs (when offered for real money) are processed by Stripe on web when cash checkout is enabled, not via Play billing. I receive transaction identifiers, amounts, and metadata needed to grant your purchase. I do not store full card numbers.
• Device & ads identifiers — when ads are enabled: advertising ID / AdMob identifiers, Firebase installation/instance identifiers, and Firebase App Check attestation tokens. Web display ads use Google AdSense after consent where required (see Cookie notice).
• Push notifications (mobile) — if you enable alerts, Firebase Cloud Messaging stores a device token to deliver notifications you asked for.
• Diagnostics — on mobile release/profile builds, Firebase Crashlytics may receive crash and error reports tied to an app installation (not used for advertising). Cloud Functions produce limited operational logs for security and abuse prevention. I do not use a separate third-party analytics SDK in current builds.
• Cookies and similar technologies — on the website and web studio; see the Cookie notice.
• Support & moderation — messages you send me and reports you file about other users or content.

2. Purposes and legal bases (GDPR)

Where the GDPR applies, I rely on the following legal bases (Article 6 GDPR):

I do not sell your personal information.

3. Processors and sharing

I use service providers (processors) who process data on my instructions, including:

• Google — Firebase (Authentication, Firestore, Storage, Cloud Functions, App Check, Cloud Messaging, Crashlytics on mobile), Google Cloud infrastructure, and when enabled Google AdMob (mobile) and/or Google AdSense (web). See Google’s Privacy Policy.
• Stripe — card payments for Cash Premium (where Stripe is offered) and for peach packs on web when enabled. See Stripe’s Privacy Policy.
• Google Play — billing for Cash Premium on Android, where offered (not peach packs).
• Pinecone — vector search for card recognition queries you initiate.

Public showcase profiles and binder share links only expose what you choose to make public. Other users see marketplace listings according to your listing settings; do not post personal contact details on listings.

4. International transfers

Processors such as Google, Stripe, and Pinecone may process data in the United States and other countries outside your country of residence, including outside the European Economic Area. Where required, transfers rely on appropriate safeguards (for example the EU Standard Contractual Clauses and/or adequacy decisions). You can contact me for more information about transfer safeguards.

5. Retention

• Account and collection data — kept while your account is active and deleted or anonymized when you delete your account, subject to the exceptions below.
• Shop records — payment ids and entitlement history may be kept as needed for support, fraud prevention, and legal/tax obligations.
• Logs and security records — kept for a limited period appropriate to security and troubleshooting, then deleted or aggregated.
• After deletion — see section 6; some anonymized marketplace rows, community catalog contributions, or moderation/fraud records may be retained as described on the Delete account page.

6. Account deletion

You can schedule deletion in the Android app or web studio under Profile → Settings → Delete Account when you signed in with email/password or Google (other sign-in methods: use email support on the Delete account page). Confirming deletion starts a 14-day grace period during which you can cancel; after that, a server job permanently purges your data. Email deletion requests are handled manually within 30 days of verification where applicable law requires a response in that timeframe. See the Delete account page for details.

7. Your rights (EEA/UK and similar laws)

Depending on where you live, you may have the right to:

• Access a copy of your personal data
• Rectify inaccurate data
• Erase data (“right to be forgotten”) in certain cases
• Restrict or object to certain processing
• Data portability for data you provided, where applicable
• Withdraw consent at any time (without affecting prior lawful processing)
• Lodge a complaint with a supervisory authority

To exercise these rights, email astrylvyan@gmail.com from your account email (or explain how you can be verified). I will respond within the time required by applicable law (typically one month under the GDPR).

Supervisory authority (Portugal): Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. You may complain to CNPD or to the authority in your country of residence.

8. Permissions

Camera and photo library access are used only to capture or select photocard / profile images. I do not request contacts or precise location for core features.

9. Children

PeachyBind is intended for a general audience of collectors, including teens, and is not directed at children under 13. If you believe a child under 13 created an account, contact me so I can delete it.

10. Cookies

See the Cookie notice for types of cookies, advertising partners, and how to manage consent.

11. Security

I use industry-standard measures through Firebase and cloud providers (encryption in transit, access controls, App Check on sensitive calls). No method of transmission or storage is completely secure.

12. Changes

I may update this policy. Continued use after an update means you accept the revised policy where permitted by law. Material changes will be reflected by updating the date above and, when required, prompting you to accept updated terms in the app.

Cookie notice · Terms of Service · Community Guidelines · Delete account