Privacy Policy

1. Scope

The Services are offered from the United States and are intended for users located in the United States. We do not market the Services to, or seek users in, the European Economic Area or the United Kingdom. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

2. Our Role, and Collector Crypt's

Collector Club operates a front-end interface. The underlying marketplace, the randomized distribution mechanics, the minting and custody of digital items, and the vaulting and redemption of physical cards are operated by Collector Crypt Inc. ("Collector Crypt") and its partners, not by us.

This matters for your privacy in two ways:

• Some of your information is shared with Collector Crypt so that transactions, redemptions, and fulfilment can be completed. If you add or edit a shipping address, your browser sends that information (name, address, phone number, and email) directly to Collector Crypt, authenticated with your account credentials — it does not pass through our servers. When you redeem a physical card, your browser sends Collector Crypt only a reference to your saved address, not the address details themselves; our server separately confirms the redemption with Collector Crypt, supplies your verified account email, and keeps a copy of the accepted shipping details in our own records. Marketplace and Arcade activity (wallet addresses, transaction data, and gameplay data) is sent to Collector Crypt from our servers, not directly from your browser. See Section 6.
• Collector Crypt handles that information under its own privacy policy, available at https://collectorcrypt.com, and makes its own decisions about it. We recommend you read it.

3. Information You Give Us

• Account information: email address, username, and, where you provide them, name and display name.
• Wallet information: the public address of any Solana wallet you connect, or that is created for you through our authentication provider, Privy (https://www.privy.io/).
• Shipping information: where you request redemption of a physical card — full name, postal address, email address, and phone number.
• Communications: messages you send to support, feedback, and anything you post through community features.
• Beta and waitlist registrations: email address, where you register for early access.
• Payment information: payment card and bank details are collected and processed by our payment processor. We do not store full payment card numbers, card verification codes, or expiration dates on our systems, including in logs. Our payment processor shares limited transaction information with us — such as your email address, IP address, and order details — so we can confirm and fulfil your purchase.

Sensitive personal information. We do not collect government identification numbers, biometric data, precise geolocation, or financial account credentials ourselves. If you add funds to your wallet using a fiat on-ramp — MoonPay, Stripe, or Coinbase — those providers may collect identity-verification information (such as a government ID or date of birth) directly from you, as part of their own compliance obligations, under their own privacy policies. We do not receive or store that information. If our own practices change — for example if identity verification is introduced on our end — we will update this policy before collecting it, describe what we collect and why, and provide the additional choices those laws require.

Notice at the point of collection. Where we collect personal information directly from you — at sign-up, at beta registration, at checkout, and at redemption — we provide a link to this policy at or before the point of collection.

4. Information Collected Automatically

• Online identifiers: IP address and referring URLs.
• Device information: device type, operating system, browser type and version.
• Usage information: pages viewed, features used, clickstream data, access times, and error logs.
• Cookies and similar technologies: described in Section 7.

We do not collect precise geolocation. We may infer the country you are in from your IP address.

5. Blockchain Information

Some activity on the Services is recorded on the Solana blockchain. This includes wallet addresses, item ownership, and transaction history. Some real-time features — for example, live balance and marketplace updates — connect directly from your browser to our blockchain infrastructure provider so that on-chain data can update without a page reload. That connection exposes your IP address and the wallet address you are viewing to that provider.

Information recorded on a public blockchain is permanent, publicly visible, and cannot be altered or deleted by us or by anyone else. This is a property of the technology, not a choice we make. Blockchain data can sometimes be linked to a person through analysis or through information held by others.

This has a direct effect on your rights described in Section 9: any request to delete your information applies only to information we hold off-chain and under our control. It cannot extend to on-chain records.

6. How We Use and Share Information

We use your information to: operate your account and the Services; process purchases and sales and pass redemption requests to Collector Crypt; provide customer support; detect and prevent fraud, abuse, and security incidents; run progression features, events, and promotions; understand how the Services are used and improve them; send you service and transactional messages; and comply with our legal obligations.

We share your information with:

• Collector Crypt and its vault partners, so that marketplace transactions, custody, and redemption can be completed. This includes wallet addresses, transaction data, and — for redemptions — your shipping name, address, and contact details. Collector Crypt handles this information under its own privacy policy.
• Privy, our authentication and embedded wallet provider, which receives your email address or social account identifier and your wallet address.
• Our payment processor, which processes card and crypto checkout on our behalf. If you add funds to your wallet using a fiat on-ramp, MoonPay, Stripe, or Coinbase collect payment and identity-verification information directly from you, under their own privacy policies.
• Our blockchain infrastructure provider, which connects the Services to the Solana network and loads collectible images, and which may see your wallet address and IP.
• Our email provider, which sends account, security, and transactional email on our behalf.
• Our real-time messaging provider, which powers live chat and in-app notifications. Messages you post to public channels are visible to other users.
• Our hosting and database providers, which store the information described in this policy on our behalf.
• Other service providers who perform functions on our behalf, under contractual obligations to protect it.
• Law enforcement, regulators, and courts, where we are legally required to or where we reasonably believe it is necessary to investigate or prevent illegal activity or harm.
• A buyer or successor, in connection with a merger, acquisition, financing, reorganization, or sale of assets. We will notify you of any such transfer.
• Professional advisors, including legal and accounting advisors.
• Anyone you direct us to, with your consent.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use advertising or conversion-tracking pixels of any kind, and we do not work with data brokers.

7. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand how the Services are used.

• Essential: required for the Services to work, including authentication, session management, and security.
• Analytics: we use Vercel Web Analytics and Speed Insights to understand aggregate usage and performance and to diagnose errors. We do not use session recording or session replay of any kind.
• Advertising and measurement: we do not use advertising or conversion-tracking cookies or pixels.

You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the Services from working.

8. How Long We Keep Information

We keep personal information for as long as we need it for the purposes described in this policy, and then delete or anonymize it. Specifically:

• Account information: for as long as your account is open, and for twelve (12) months after closure.
• Transaction records: for seven (7) years, to meet financial record-keeping obligations.
• Support communications: for up to three (3) years after the last interaction.
• Analytics data: for up to 24 months in identifiable form.
• Logs, IP addresses, and device identifiers: for up to twelve (12) months, for security and fraud prevention.
• Blockchain data: permanent. We cannot delete it.

9. Your Rights and Choices

9.1 Rights. Depending on the state you live in, you may have the right to:

• know what personal information we have collected about you, and obtain a copy of it;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of the sale or sharing of your personal information for targeted advertising;
• opt out of profiling used in decisions that produce legal or similarly significant effects (see Section 10); and
• not be discriminated against for exercising any of these rights.

We provide these rights to all users in the United States, regardless of the state you live in.

9.2 Making a request. Email admin@collector.club with your request and the email address on your account. We will verify your identity before responding. You may use an authorized agent, in which case we may ask for additional verification.

We aim to respond within forty-five (45) days. If we need longer, we will tell you why and respond within ninety (90) days. There is no charge unless a request is excessive or repetitive, in which case we will give you a cost estimate first.

9.3 If we decline your request — appeals. If we refuse to act on your request, we will tell you why. You may appeal that decision within a reasonable period by emailing admin@collector.club with the subject line "Privacy Request Appeal." We will review the appeal and respond in writing within forty-five (45) days, explaining the reasons for our decision. If we deny the appeal, we will provide you with a method to contact your state attorney general to submit a complaint.

9.4 Deleting your account. To request deletion of your account, email support@collector.club from your registered email address, or use the request option in your account settings. Account deletion is a manual process handled by our support team — it is not immediate. We will confirm receipt and complete the deletion within forty-five (45) days.

We may need to keep some information after deletion — for example, records required for tax, accounting, fraud prevention, or legal compliance. As explained in Section 5, we cannot delete information recorded on the blockchain. We cannot delete information held by Collector Crypt on its own behalf; to exercise rights against Collector Crypt, contact them directly.

9.5 Opting out of sale or sharing. Some state privacy laws give you the right to opt out of the sale of your personal information, and of sharing it for cross-context behavioral advertising. We do not sell your personal information or share it for that purpose. If our practices change, we will update this policy and provide an opt-out mechanism before the change takes effect.

9.6 Marketing and promotional emails. We currently send only transactional and service messages — purchase confirmations, security notices, shipping updates, and account notices. These are necessary to provide the Services and are not marketing.

If we send you marketing or promotional email — product announcements, event invitations, drop alerts, or newsletters — every such message will include a working unsubscribe link and our postal address, and unsubscribing will stop all marketing email while leaving your transactional messages in place. You can also opt out at any time by emailing support@collector.club. We will honour an opt-out request promptly and at no charge.

10. Automated Decision-Making and Profiling

We use automated systems in a limited number of places:

• Fraud and abuse detection: automated analysis of transaction patterns and account behaviour to identify likely fraud, multi-accounting, or manipulation.
• Security: automated checks to detect unauthorized access and bot activity.

Where an automated decision meaningfully affects your access to the Services — for example, if your account is restricted or a transaction is blocked — you can ask a person to review it by emailing support@collector.club. We will have someone review the decision and respond.

Some state privacy laws give you the right to opt out of profiling used in decisions that produce legal or similarly significant effects. To exercise that right, contact admin@collector.club. Where the profiling is necessary to prevent fraud or to secure the Services, we may not be able to offer the Services to you without it, and we will tell you if that is the case.

11. Children

Under 18. The Services are intended only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will close the account and delete the information.

Under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly in accordance with the Children's Online Privacy Protection Act. A parent or guardian may contact us at admin@collector.club to request that we review, delete, or stop collecting their child's information.

If you believe a person under 18 has provided us with personal information, contact us at admin@collector.club.

12. Security

We use commercially reasonable technical and organizational measures to protect personal information, including encryption of data in transit, access controls limiting employee access to what is needed, and monitoring for security issues. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your own account credentials and any wallet private keys.

13. Data Breach Notification

If a breach affects your personal information, we will notify you and any required authorities as and when required by applicable state breach notification laws, using the most expedient means available.

14. Changes to This Policy

We may update this policy. We will post the updated version on this page and change the Effective Date. If the changes are material, we will notify you by email or through a prominent notice on the Services before they take effect.

15. Contact

Privacy questions, data rights requests, and appeals: admin@collector.club
Account support and deletion requests: support@collector.club

Digital Collector Club Inc., a Delaware C corporation