1.Who we are
Runebound is a collection tracker, deck builder and market tracker for the Riftbound trading card game, available at runebound.gg and as the Runebound app for iOS and Android ("Runebound", "we", "us"). This policy explains what we collect, why, who processes it, and the choices you have.
Questions or requests: noreply@runebound.gg.
2.What you can use without an account
Browsing cards, prices, the meta and public community pages needs no account. The app keeps a collection you build while signed out on your device only; we never receive it unless you sign in.
3.What we collect when you sign in
- Account: your email address, your password (stored only as a salted hash by our authentication provider), how you sign in, and when the account was created and last used.
- Collection and decks: the cards you track (printing, quantity, condition, finish, language), your binders and boxes, tags, and anything optional you add such as purchase price, purchase date, slot or notes; your decks. We store these so they are backed up and sync between your devices and the website.
- Profile (optional): display name, handle, bio, the card you pick as your avatar, main domain, X / Instagram / TCGplayer usernames, and your privacy choices.
- Community (if you use it): who you follow, the decks and collections you publish and post, likes, people you block, and reports you send.
- Porodigy: the questions you ask, the answers, the deck or collection details you attach to a question, and feedback you send about an answer. Your chat history itself stays on your device or in your browser.
- Technical: our hosting providers keep IP addresses and basic request logs for security and to keep the service running.
4.What we do not collect
- Camera frames: card scanning runs entirely on your device; nothing from the camera is stored or uploaded.
- Photos you attach in the Poro chat stay on your device; they are not uploaded.
- Contacts, location, advertising identifiers or browsing history on other sites.
There are no ads in Runebound and we do not sell or rent personal data. The website uses Cloudflare Web Analytics, which counts visits without cookies and without tracking you across sites. The app contains no analytics or advertising SDKs.
5.What other people can see
Your profile is private by default. If you make it public, anyone (including people without an account) can see your display name, handle, bio, avatar, main domain, social links, follower and following counts, and the decks and collections you publish, plus your total collection value and card count if you turn that on. Your private collection, notes, purchase prices and email address are never shown to others. Blocking someone hides your profile and content from them and theirs from you.
6.How we use your data
- To provide Runebound: backing up and syncing your collection and decks, valuing them with market prices, and showing your profile and community features.
- To answer Porodigy questions and improve answers (reviewing answers reported as wrong).
- To keep the service safe: rate limits, handling reports, blocks and abuse.
- To email you about your account only: sign-up confirmation, password reset and email-change confirmation. We do not send marketing email.
7.Service providers
We use these companies to run Runebound. They process data on our behalf and only for these purposes:
- Supabase: database, authentication and server functions (stores your account and everything listed above).
- Cloudflare: hosting of runebound.gg and cookieless web analytics.
- OpenAI: generates Porodigy answers. Your question, recent chat turns and any deck or collection details you attach are sent to OpenAI to produce the answer.
- Spacemail: sends account emails from noreply@runebound.gg.
- Expo: delivers app updates (receives standard request information such as IP address and app version).
- Apple and Google: if you choose to sign in with them, they confirm your identity and share your email address with us.
Card prices come from JustTCG and card data from Riot Games and Riftcodex; no personal data is shared with them. Links to TCGplayer open their website, whose own policy applies.
8.How long we keep it, and deleting your account
We keep your data for as long as you have an account. You can delete your account at any time in the app (Settings → Account and security → Delete account) or on the website (Settings → Account & security). This permanently deletes your account and all data stored on our servers: collection, decks, profile, community content and Porodigy history. When you delete or sign out in the app you choose whether to keep the cards on that device.
Copies may remain in our providers’ backups and logs for a limited period before they are overwritten. You can also email us to ask for a copy of your data, a correction, or deletion.
9.Children
Runebound is not intended for children under 13 and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it.
10.Security and storage
Data is encrypted in transit, and database access rules ensure each account can only read and change its own private data. Our providers may store and process data in countries other than yours.
11.Changes to this policy
If we change this policy we will update the date above, and tell you in the app or on the website when the change is significant.