Privacy Policy

1. Scope

The Services are offered from the United States and are intended for users located in the United States. We do not market the Services to, or seek users in, the European Economic Area or the United Kingdom. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

2. Our Role, and Collector Crypt's

Collector Club operates a front-end interface. The underlying marketplace, the randomized distribution mechanics, the minting and custody of digital items, and the vaulting and redemption of physical cards are operated by Collector Crypt Inc. ("Collector Crypt") and its partners, not by us.

Collector Crypt is an independent company, not a service provider acting on our behalf. Some of your information reaches them in two ways:

• Through us. When you request a redemption, our systems send Collector Crypt the account email address associated with your request so that shipping notifications can be sent.
• Directly from your browser. Your shipping address book is held in your Collector Crypt account rather than ours. When you enter or select a shipping address, your browser communicates directly with Collector Crypt's systems. As with any direct connection, this means Collector Crypt also receives your IP address and browser information. We keep a copy of the shipping address you confirm for an order.

Collector Crypt handles all of this information under its own privacy policy, available at https://collectorcrypt.com, and makes its own decisions about it. We recommend you read it.

3. Information You Provide and Generate

• Account information: email address, username, and, where you provide them, name and display name.
• Wallet information: the public address of any Solana wallet you connect, or that is created for you through our authentication provider, Privy (https://www.privy.io/).
• Shipping information: where you request redemption of a physical card — full name, street address, city, state, postal code, phone number, and email address. As described in Section 2, this is held in your Collector Crypt account, and we retain a copy of the address you confirm for an order.
• Purchase records: for each purchase we retain the amount, currency, tax, region code, the items purchased, and the order reference from our payment processor. For purchases made with a card, this record also includes the email address and IP address supplied to us by the payment processor. For purchases made with cryptocurrency, we retain your contact email, public wallet addresses, and on-chain transaction signatures.
• Communications: messages you send to support, feedback, and anything you post through community features.
• Beta and waitlist registrations: email address, where you register for early access.
• Inventory data: the cards, packs, and other items you acquire — through purchases, pack openings, gameplay, the marketplace, transfers from other users, or by linking a wallet that holds items in Collector Crypt custody — together with their attributes, such as rarity, set, condition, grade, and certification number where applicable. We store these as records in our own database, along with an estimated value for each item, which we update over time.
• Progression data: your activity on the Services and the standing it earns — experience points, your collector level, badges and achievements, first-catch records in the Cardex, the items you add to your wishlist, and the marketplace listings you save as favorites. Each record names the action that earned it and when it happened; where that action was a purchase or a sale, it also records the amount that counted toward your total.
• Sweepstakes entries: the entries you earn toward a sweepstakes, including the action that earned each one and when it happened, and your running entry total. When a sweepstakes closes we freeze the list of entrants for that draw: it records your entry count against a hash of your account identifier, so that anyone can check the result for themselves.

We never receive your payment card details. Card entry takes place entirely within the hosted checkout provided by our payment processor, Stash. No card number, security code, expiry date, card brand, or partial card number exists in our systems, our database, or our logs at any point.

Identity verification by third parties. Some services you can reach through our interface may ask you to verify your identity. When you add funds using our on-ramp providers — MoonPay, Stripe, or Coinbase — those providers collect identity and payment information directly from you, within their own interfaces, under their own privacy policies. Our payment processor, Stash, and Collector Crypt may also carry out identity or compliance checks in connection with checkout or redemption. Any information you provide to these companies goes to them, not to us. We do not collect, receive, store, or have access to identity documents, government-issued identification numbers, or biometric data.

Sensitive personal information. We do not collect any category of information treated as sensitive personal information under state privacy law. If that changes, we will update this policy before collecting it, describe what we collect and why, and provide the additional choices those laws require.

Notice at the point of collection. Where we collect personal information directly from you — at sign-up, at beta registration, at checkout, and at redemption — we provide a link to this policy at or before the point of collection.

4. Information Collected Automatically

• Online identifiers: IP address and referring URLs. We store the IP address and browser user agent associated with each sign-in session, server-side, to protect your account and detect unauthorized access.
• Device information: device type, operating system, browser type and version.
• Usage information: pages viewed, features used, access times, and error logs.
• Performance data: anonymous page-load and performance timings, which contain no user identifiers.
• Approximate location: a coarse country and region, derived from the network request as reported by our hosting provider — at account creation, or on a later sign-in for accounts created before this was introduced — so we can understand which regions our usage comes from. We store only the derived country and region code — we do not keep a separate or precise location record for this purpose.
• Cookies and similar technologies: described in Section 7.

We do not collect precise geolocation. We do not use GPS or device-level location, and the country/region described above is coarse and approximate. We may also receive a country or region code from our payment processor in connection with a purchase.

5. Blockchain Information

Some activity on the Services is recorded on the Solana blockchain. This includes wallet addresses, item ownership, and transaction history.

Information recorded on a public blockchain is permanent, publicly visible, and cannot be altered or deleted by us or by anyone else. This is a property of the technology, not a choice we make. Blockchain data can sometimes be linked to a person through analysis or through information held by others.

Most of our communication with the Solana network passes through our own servers. One exception: to keep your balances and items up to date in real time, your browser maintains a direct connection to a public Solana network endpoint. That connection exposes your IP address and the wallet addresses you are viewing to the operator of that endpoint.

This has a direct effect on your rights described in Section 9: any request to delete your information applies only to information we hold off-chain and under our control. It cannot extend to on-chain records.

6. How We Use and Share Information

We use your information to: operate your account and the Services; process purchases and sales and pass redemption requests to Collector Crypt; provide customer support; detect and prevent fraud, abuse, and security incidents; run progression features, events, and promotions; understand how the Services are used and improve them; send you service and transactional messages; and comply with our legal obligations.

We share your information with the following companies, each of which receives only what it needs to perform its function:

• Collector Crypt — marketplace, custody, and redemption. Receives shipping name, address, phone number and email, account email, wallet addresses, and, on direct browser connections, your IP address. An independent company; see Section 2.
• Privy — authentication and embedded wallets. Receives your email address, your account identifier, and your wallet addresses. Privy does not receive your phone number.
• Stash — payment processing. Receives your account identifier, email address, display name, avatar, and the items you are purchasing, and returns order details including your email and IP address.
• MoonPay, Stripe, and Coinbase — fiat on-ramp services within the "add funds" feature. Collect payment and identity information directly from you; see Section 3.
• Mailjet — email delivery. Receives your email address and the contents of sign-in codes, order confirmations, wallet-export codes, and any mailing list you have joined.
• Helius — Solana network and indexing services. Receives wallet addresses. Your browser also loads item images from their network, which exposes your IP address to them.
• Pusher — real-time messaging in community features. Receives your display name and the messages you send.
• Beamable — game services. Receives your player identifier and in-game inventory.
• WalletConnect and WalletLink — connection services for external wallets.
• Neon — our database provider, which stores the information described in this policy.
• Vercel — hosting, logging, profile image storage, and website analytics.
• Upstash — caching. Receives hashed identifiers and cached game data, which may include your inventory.
• Strapi — content management. Receives promotional codes you enter.
• unpkg — a content delivery network used to load parts of the site, which receives your IP address.

We may also disclose your information to law enforcement, regulators, and courts where we are legally required to or where we reasonably believe it is necessary to investigate or prevent illegal activity or harm; to a buyer or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will notify you; to our professional advisors, including legal and accounting advisors; and to anyone you direct us to, with your consent.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use advertising pixels, and we do not disclose your information to data brokers or advertising networks.

Community features are public. Display names and messages you post in community features are transmitted through our real-time messaging provider on channels that other people can access. Treat anything you post there as public, and do not share personal information in it.

7. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand how the Services are used.

• Essential: required for the Services to work, including authentication, session management, and security.
• Analytics: we use Vercel Web Analytics and Vercel Speed Insights to understand how the site performs and how it is used. We do not use session recording or session replay of any kind, and we do not record your screen, keystrokes, or mouse movements.
• Advertising: we do not use advertising or conversion tracking cookies.
• Embedded content: some pages include content hosted by third parties, such as embedded videos. Those providers may set their own cookies when the content loads. Their use of cookies is governed by their own policies.

You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the Services from working.

8. How Long We Keep Information

We keep personal information for as long as we need it for the purposes described in this policy, and then delete or anonymize it. Specifically:

• Account information: for as long as your account is open, and for twelve (12) months after closure.
• Transaction records: for seven (7) years, to meet financial record-keeping obligations.
• Support communications: for up to three (3) years after the last interaction.
• Analytics data: for up to 24 months in identifiable form.
• Logs, IP addresses, and device identifiers: for up to twelve (12) months, for security and fraud prevention.
• Inventory data: for as long as your account is open. We delete these records when we delete your account, through the manual process described in Section 9; where an item also appears in a transaction record, the seven-year period above applies. Cached copies are described below.
• Progression data: for as long as your account is open. We delete these records when we delete your account, through the manual process described in Section 9.
• Sweepstakes entries: for as long as your account is open. We delete the entries you have earned when we delete your account, through the manual process described in Section 9. A sweepstakes that has already closed is the exception: we remove your identifier from the entrant list published for that draw, but your entry count remains in that published list permanently, so the result stays verifiable.
• Cached data: copies of your game data, which may include your inventory, held to keep the Services fast. We do not set a fixed expiry, so a copy remains until it is refreshed or replaced — which may be indefinitely, and a cached copy is not removed when an account is deleted.
• Blockchain data: permanent. We cannot delete it.

9. Your Rights and Choices

9.1 Rights. Depending on the state you live in, you may have the right to:

• know what personal information we have collected about you, and obtain a copy of it;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of the sale or sharing of your personal information for targeted advertising;
• opt out of profiling used in decisions that produce legal or similarly significant effects (see Section 10); and
• not be discriminated against for exercising any of these rights.

We provide these rights to all users in the United States, regardless of the state you live in.

9.2 Making a request. Email admin@collector.club with your request and the email address on your account. We will verify your identity before responding. You may use an authorized agent, in which case we may ask for additional verification.

We aim to respond within forty-five (45) days. If we need longer, we will tell you why and respond within ninety (90) days. There is no charge unless a request is excessive or repetitive, in which case we will give you a cost estimate first.

9.3 If we decline your request — appeals. If we refuse to act on your request, we will tell you why. You may appeal that decision within a reasonable period by emailing admin@collector.club with the subject line "Privacy Request Appeal." We will review the appeal and respond in writing within forty-five (45) days, explaining the reasons for our decision. If we deny the appeal, we will provide you with a method to contact your state attorney general to submit a complaint.

9.4 Deleting your account. To request deletion of your account, email support@collector.club from your registered email address, or use the request option in your account settings. Account deletion is a manual process handled by our support team — it is not immediate. We will confirm receipt and complete the deletion within forty-five (45) days.

We may need to keep some information after deletion — for example, records required for tax, accounting, fraud prevention, or legal compliance. As explained in Section 5, we cannot delete information recorded on the blockchain. As explained in Section 8, cached copies of your game data are not removed when an account is deleted. We cannot delete information held by Collector Crypt or by any other company on its own behalf; to exercise rights against those companies, contact them directly.

9.5 Opting out of sale or sharing. Some state privacy laws give you the right to opt out of the sale of your personal information, and of sharing it for cross-context behavioral advertising. We do neither, so there is nothing to opt out of. If our practices change, we will update this policy and provide an opt-out mechanism before the change takes effect.

9.6 Marketing and promotional emails. We send transactional and service messages — sign-in codes, purchase confirmations, security notices, shipping updates, and account notices. These are necessary to provide the Services and are not marketing.

If we send you marketing or promotional email — product announcements, event invitations, drop alerts, or newsletters — every such message will include a working unsubscribe link and our postal address, and unsubscribing will stop all marketing email while leaving your transactional messages in place. You can also opt out at any time by emailing support@collector.club. We will honour an opt-out request promptly and at no charge.

10. Automated Decision-Making and Profiling

We use automated systems in a limited number of places:

• Fraud and abuse detection: automated analysis of transaction patterns and account behaviour to identify likely fraud, multi-accounting, or manipulation.
• Security: automated checks to detect unauthorized access and bot activity.

Where an automated decision meaningfully affects your access to the Services — for example, if your account is restricted or a transaction is blocked — you can ask a person to review it by emailing support@collector.club. We will have someone review the decision and respond.

Some state privacy laws give you the right to opt out of profiling used in decisions that produce legal or similarly significant effects. To exercise that right, contact admin@collector.club. Where the profiling is necessary to prevent fraud or to secure the Services, we may not be able to offer the Services to you without it, and we will tell you if that is the case.

11. Children

Under 18. The Services are intended only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will close the account and delete the information.

Under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly in accordance with the Children's Online Privacy Protection Act. A parent or guardian may contact us at admin@collector.club to request that we review, delete, or stop collecting their child's information.

If you believe a person under 18 has provided us with personal information, contact us at admin@collector.club.

12. Security

We use commercially reasonable technical and organizational measures to protect personal information, including encryption of data in transit, access controls limiting employee access to what is needed, and monitoring for security issues. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your own account credentials and any wallet private keys.

13. Data Breach Notification

If a breach affects your personal information, we will notify you and any required authorities as and when required by applicable state breach notification laws, using the most expedient means available.

14. Changes to This Policy

We may update this policy. We will post the updated version on this page and change the Effective Date. If the changes are material, we will notify you by email or through a prominent notice on the Services before they take effect.

15. Contact

Privacy questions, data rights requests, and appeals: admin@collector.club
Account support and deletion requests: support@collector.club

Digital Collector Club Inc., a Delaware C corporation