Last updated: 2026-05-27.
Crew Builder ("we", "us") is a One Piece Trading Card Game deck-building app for iOS and Android. This policy explains what data we collect, why, and how to control it.
Crew Builder is a fan-made tool and is not affiliated with, endorsed by, or licensed by Bandai Co., Ltd., Eiichiro Oda, Shueisha, or Toei Animation. All trademarks referenced are the property of their respective owners.
What we collect
- Account data when you sign in: your email (magic link), Apple ID (Sign in with Apple — which requests your email and full name), or Google account (Continue with Google). We never see your password. Apple Sign-in may relay a private email; we honor that. We store a Supabase-issued user id linked to your account.
- Your saved content you create in the app: saved decks (leader, card list, quantities), owned sets, per-card "I own N copies" ownership markers, and onboarding preferences. Stored locally on your device and, if you're signed in, mirrored to our database to sync across devices.
- Push notification tokens via Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs): a device token, your user id, and platform, used to deliver banlist alerts and deck notifications you opt into in Settings.
- App usage analytics via PostHog: which screens you visit, which leaders and playstyles you pick, deck saves and swaps, and which buttons you tap. Usage analytics are collected without direct identifiers before you sign in. After you sign in, analytics events are linked to your account identifier. You can turn off usage analytics at any time in Settings.
- Crash reports via Sentry: stack traces, app version, operating system, and device model when the app crashes. No name, email, or location is included.
- Card scanner (Pro) uses your device's camera and Google ML Kit's on-device text recognition to read the printed card code. Camera frames and recognized text never leave your device — only the matched card identifier is added to your collection. We do not record video, store frames, or upload images.
- Subscriptions and purchases (Pro): when you subscribe to Crew Builder Pro, the purchase is processed by Apple (or Google, on Android). We use RevenueCat to verify your receipt and track entitlement state. RevenueCat receives an anonymous App User ID, the Apple/Google transaction identifier, and your entitlement state. Card data and bank details are handled exclusively by Apple/Google and never reach us or RevenueCat.
What we don't collect
- We do not sell your data.
- We do not share your data with third parties for advertising.
- We do not track you across other apps or websites.
- We do not record your screen or microphone.
- The Pro card scanner uses your camera on-device only — frames are never uploaded.
- We do not collect your location, contacts, photos, health data, or payment card information.
Third-party recipients
The app uses these services to function. Each has its own privacy policy:
- Supabase — database and authentication. Cloud data is stored with row-level security so your data is only readable by you.
- Firebase / Google — push notifications and optional Google sign-in.
- PostHog — usage analytics.
- Sentry — crash reporting.
- Apple — optional Sign in with Apple.
- Cloudflare R2 — card image hosting.
- TCGplayer / Impact — when you tap "Buy on TCGplayer," your browser opens TCGplayer's site. We use the TCGplayer Affiliate program via the Impact affiliate network, which receives a referral identifier so any resulting purchase can be attributed to us. We may earn commission.
- JustTCG — card pricing data. JustTCG receives card lookup requests but no account data.
- RevenueCat — subscription receipt verification and entitlement state for Crew Builder Pro.
- Google ML Kit (on-device) — text recognition for the Pro card scanner. Runs entirely on your device; no frames or recognized text leave the device.
How to delete your data
Open the app → Settings → Delete account. Deleting from inside the app removes your server-side data immediately. Email-based requests sent to [email protected] are actioned within 7 business days. Full server-side deletion completes within 30 days. Backups that contain your data are purged within 90 days. Local data on your device is removed immediately on sign-out.
International data transfers
Our processors — Supabase, PostHog, Sentry, Firebase / Google, Apple, Cloudflare, TCGplayer / Impact, and JustTCG — are hosted in the United States. If you use the app from the European Economic Area, the United Kingdom, or elsewhere outside the United States, your personal data is transferred to and processed in the United States. These transfers rely on Standard Contractual Clauses or each processor's own approved transfer framework.
Security & breach notification
Cloud data is protected by Supabase Row-Level Security, so your records are only readable by your account, and is encrypted in transit using TLS. No system is perfectly secure, but if a breach affects your personal data we will notify affected users without undue delay.
GDPR rights (EEA / UK users)
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation applies to your personal data.
- Data controller. Crew Builder is the data controller for the personal data described in this policy. Contact the controller at [email protected].
- Lawful bases. Performance of a contract (creating your account, syncing your decks and collection, authentication); legitimate interests (usage analytics and crash diagnostics to operate and improve the app); and consent (push notifications).
- Your rights. You have the right to access, rectification, erasure, data portability, restriction of processing, objection to processing, withdrawal of consent at any time, and to lodge a complaint with your local supervisory authority.
To exercise any of these rights, email [email protected].
California privacy rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, applies to you. Notice at collection — in the past 12 months we collect:
- Identifiers (email, Apple / Google sign-in identifiers, Supabase user id) — to create and authenticate your account.
- Internet or network activity (screens viewed, buttons tapped, leaders and playstyles selected, deck saves and swaps) — to measure feature usage and improve the app.
- User-generated content (saved decks, owned sets, per-card ownership, onboarding preferences) — to provide and sync the app.
- Device and diagnostic information (crash stack traces, app version, operating system, device model) — to diagnose crashes.
- Commercial information (Crew Builder Pro subscription state, transaction identifiers from Apple/Google, RevenueCat App User ID) — to provide and verify your Pro entitlement.
We do not sell your personal information. When you tap an affiliate "Buy on TCGplayer" link, a referral identifier is passed to a third-party affiliate network (Impact) so a resulting purchase can be attributed to us. Under the CPRA this may constitute "sharing." We do not share personal information for any other purpose.
Do Not Sell or Share My Personal Information. To opt out of this affiliate-link sharing, email [email protected] with the subject "Do Not Sell or Share." You may also avoid it entirely by not tapping affiliate links. California residents also have the right to know, to delete, to correct, and to non-discrimination for exercising these rights.
Children
Crew Builder is a general-audience app. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided us personal information, we'll delete it promptly. If you are in the EEA or UK and below the age of digital consent in your country, please use Crew Builder only with the involvement of a parent or guardian.
Changes
If we change this policy materially we'll update the "Last updated" date and (when signed in) show an in-app notice on next launch.
Contact
Questions: [email protected].
Crew Builder is not affiliated with Bandai, Eiichiro Oda, Shueisha, or Toei Animation. Card images and names are property of their respective owners.