Privacy Policy

We collect information in the following categories:

• Account information: email address, display name, sign-in identifiers, account settings, and information needed to verify identity, age, address, payment ownership, or tax status when a transaction requires verification.
• Profile information: the profile photo and bio you choose to provide, plus your display name and public activity shown with your profile or on leaderboards. Do not put sensitive personal information in a bio.
• Transaction and vault information: deposits, pack purchases and openings, pulled and owned cards, sell-backs, EVOLVE attempts, referral and promo-code activity, bonuses, playthrough progress, balances, and transaction history.
• Shipping information: recipient name, postal address, phone number, selected carrier and service, insurance choice, package contents, tracking information, and delivery or claim status.
• Payment information: payments are processed by Stripe. We do not store your full payment-card number. We may receive a transaction identifier, payment status, amount, and limited card or payment-method details supplied by the processor, such as brand and last four digits.
• Location information: the country and U.S. state derived from your IP address for eligibility and fraud-prevention purposes. We do not collect precise GPS location for the location gate.
• Device, usage, and security information: IP address, browser and device characteristics, pages and features used, timestamps, error and security logs, and signals used to detect automation, location spoofing, account abuse, and payment fraud.
• Communications: support messages, survey or waitlist submissions, and the contact details supplied with them.

We use personal information to:

• create and secure accounts and profiles;
• decide geographic and age eligibility and enforce the location gate;
• process deposits, pack purchases, draws, sell-backs, EVOLVE, referrals, promotions, and bonuses;
• hold, source, verify, package, insure, and ship physical cards;
• provide transaction history, balances, customer support, and service notices;
• prevent fraud, chargeback abuse, multi-accounting, location spoofing, and other prohibited conduct;
• maintain, debug, and improve the Service; and
• comply with tax, accounting, sanctions, court, and other legal obligations.

When a request reaches our hosting platform, the network connection supplies an IP address from which a country and, for a U.S. connection, a state can be approximated. We use that state-level result to decide whether money and rip routes may open. IP location can be inaccurate, especially with mobile networks, corporate networks, or privacy relays. We do not use the location gate to collect precise device GPS coordinates, and a VPN or proxy does not change your actual eligibility under the Terms of Service.

We disclose information to service providers and other recipients only as needed for the purposes above:

• Stripe for payment processing, fraud screening, refunds, and chargeback handling.
• Supabase for production account, database, and related backend services when the live backend is enabled.
• Vercel for hosting, delivery, security, and the country/state signal used by the location gate.
• Carriers such as USPS, UPS, and FedEx, and any applicable insurer, for delivery, tracking, and claims.
• professional advisers, payment networks, regulators, courts, or law enforcement when required by law or reasonably necessary to protect rights, safety, and the integrity of the Service; and
• a buyer or successor in connection with a merger, financing, sale, or transfer of the business, subject to appropriate confidentiality protections.

We do not sell personal information. We also do not disclose personal information to third parties for their own cross-context behavioral advertising.

We use essential cookies and browser local storage to sign you in, remember settings such as sound and display preferences, preserve demo or account state, support security, and operate core features. In demo mode, local storage is the primary place where profile and vault state is kept on your device. We do not currently use advertising cookies. If optional analytics or advertising technology is added later, this policy will be updated before or when it is introduced.

We retain personal information for as long as reasonably necessary to operate your account, complete transactions, fulfill shipments, resolve disputes and chargebacks, prevent fraud, and meet tax, accounting, and legal requirements. Retention periods vary by record type. Demo information stored in your browser remains there until you sign out, reset the demo, clear browser data, or the browser removes it. Service providers may retain information under their own legal and operational requirements.

Depending on where you live, including under the Colorado Privacy Act and other applicable state laws, you may have rights to confirm whether we process your personal information and to request access, a portable copy, correction, or deletion. You may also have the right to appeal a denied request and to opt out of a sale of personal information or targeted advertising; we do not currently sell personal information or use it for targeted advertising.

You can update your display name, profile photo, and bio on your profile page. For a privacy request that cannot be completed in the product, contact us through the support channel identified on the Service and provide enough information for us to verify that the request concerns your account. We will not discriminate against you for exercising a privacy right.

We use administrative, technical, and organizational measures designed to protect personal information, including access controls and encrypted transport. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed by an unauthorized act.

THE VAULT is intended only for people who are at least 18 years old and the age of majority where they access it. We do not knowingly collect personal information from a child. If we learn that an account belongs to someone under the required age, we will close the account and delete or restrict the associated information as required by law.

We may update this policy to reflect changes in the Service, our processors, or the law. The “last updated” date will change, and material changes will be announced through the Service or another reasonable method when required. For privacy questions or requests, contact us through the support channel identified on the Service.