Privacy notice
Your raw binder stays in your browser
Last updated September 16, 2026
Local imports
RuneLite TCG save files are decoded in your browser. A normal local import is not uploaded to this website.
New-card unlock comparisons
The planning tools keep the previous and latest unique card names for up to ten recently used collections on this device to explain what new cards make available. Official and local-import comparisons persist in browser storage. Existing account and private-group comparisons use tab-session storage and are shown only with a matching loaded collection; account comparison history is cleared when the account session is reset. This comparison history is not sent to analytics or stored in a new server database. A first load establishes a baseline rather than inventing past unlocks.
Group Ironman collections
When you intentionally use a Group Ironman collection, the service stores the group name, player names, card names, normal and foil counts, pull times, wishlist flags, editable universal Bronzeman whitelist entries, and binder update times. Whitelist entries are sent only when an authorized player adds or removes one. The service does not store the raw save file or RuneScape account credentials.
Custom groups
When you create or join a custom group, the service stores the group name, owner account, member profile IDs, and membership times. It reads each member's existing saved binder instead of making another copy. One-use invitation secrets are stored only as hashes and are not included in logical backups.
Skill Access settings and whitelist
For an official or locally imported collection, the universal whitelist and Skill Access filters are stored only in that browser under the selected RuneScape name. Existing Google-linked profiles can still store them on the exact site-managed profile. A pasted Bronzeman export is decoded locally; the export code itself is not sent or stored.
Feedback
Feedback stores the selected type, message, submission time, and any name or contact information you voluntarily enter. No IP address is stored with the feedback entry. Feedback is visible only to the authenticated site administrator.
Public roster lookup
The group name you enter is sent to this site so it can read player names from Jagex's public Group Ironman hiscores.
Checking an IGN
Submitting a name in Quest Readiness sends that name to this site to check public levels and quest progress. If only the demonstration collection is loaded, it also requests and saves that name's public official Solo collection. These checks run separately: a failed progress check does not prevent a collection from loading. An existing selected collection is not replaced by checking another name.
Official OSRS TCG public collections
When you deliberately enter an IGN and choose a public Solo or group collection, this site requests that public collection from the official OSRS TCG service. It stores a normalized snapshot containing the requested name, public member names, card names, V1 and legacy normal/foil counts, pull times, official revision and update time. It does not store individual card instance IDs, who originally pulled a card, an official group key, RuneScape login credentials, or the raw official response. The snapshot remains available between visits. Once linked, checks of that player's levels and quests also refresh the collection when its 15-minute limit has passed. A recent manual refresh counts against the same limit. These checks only run while using the site; locally imported saves and private account/group collections are not automatically replaced. A failed refresh keeps the saved copy.
Google sign-in
Google sign-in requests only the basic OpenID identity scope. The service stores Google's stable account identifier and sign-in times so you can return to profiles you deliberately connect. It does not store Google access tokens, refresh tokens, your email address, Gmail, Drive files, contacts, or Google profile details.
Visitor analytics
Public pages use Cloudflare Web Analytics to measure aggregate visits, the public page where a visit began, external referring sites, approximate country, device and browser type, and page performance. Cloudflare says this service does not use cookies, local storage, or fingerprinting and does not collect or use personal data. Query strings are not logged. The analytics script is not loaded when a visit begins on an account, administration, individual player, or private sharing page, or when a private link fragment is present. It does not receive binder contents, card lists, RuneScape names, Google account identifiers, feedback, or private access links. Learn about Cloudflare Web Analytics.
Cookies and advertising
Signing in creates a secure, HTTP-only session cookie so the site can recognize the same browser. Visitor analytics does not add an analytics cookie. If advertising is activated later, this notice and any required consent controls will be updated before ads are shown.
Access and security
Protected teams use private, unguessable links. The site administrator can issue replacement owner access for support, but cannot browse card contents through the administration page.