Privacy Policy

1. Information we collect

Account information: your email address, or your Google account details if you sign in with Google, and your username and avatar. We do not use passwords: you sign in with a one-time code sent to your email.

Activity on the Platform: your coin balance and top-ups, cards bought, upgraded, sold back or shipped, upgrade records and the seeds used to verify them, and your settings and notification preferences.

Shipping information: the name, shipping address, email and, where provided, other delivery details you enter when requesting a shipment. Shipping addresses are stored encrypted.

Payment information: the amount, method, status and reference of each top-up. Card or wallet details are handled by our payment providers; we do not store full payment card numbers.

Verification information: information you provide when we ask you to confirm your age, identity, address or payment method, for example before shipping or to prevent fraud.

Device and usage information: IP address, browser and device type, pages requested and timestamps, recorded by our servers and hosting providers for security and operation, and push notification subscriptions if you enable notifications.

Communications: messages you send to support and the records of our replies.

2. How we use information

We use personal information to: provide and secure your account; process top-ups, purchases, upgrades, sellbacks and shipments; verify outcomes; prevent fraud, abuse and payment disputes; confirm eligibility; provide support; send service messages and, if you opt in, marketing emails or notifications; improve the Platform; and comply with legal obligations and enforce our Terms.

3. What other players can see

Your username and avatar appear on your public profile and in the live feed of recent upgrades, together with the cards involved. If your public history setting is on, other players can also see your upgrade history and collection activity. You can change this setting in your profile.

4. How we share information

We share personal information only as needed to run the Platform, with service providers acting on our behalf: our database, hosting and authentication provider (Supabase); Google, for Google sign-in and for address suggestions when you type a shipping address; payment providers, to process top-ups; TCGplayer and other card sellers and carriers, which receive your name and shipping address to source and deliver your cards; and browser push services, if you enable notifications.

We may also disclose information to comply with law or legal process, to protect the rights, property and safety of our users and the Platform, to prevent fraud, or in connection with a merger, acquisition or sale of assets, subject to this Policy.

We do not sell your personal information and do not share it for cross-context behavioral advertising. We do not use advertising or analytics cookies.

5. Retention

We keep personal information for as long as your account is open and afterwards as needed to complete transactions, resolve disputes, prevent fraud, keep accounting and transaction records, and meet legal obligations. Upgrade and transaction records are kept so outcomes remain verifiable. When information is no longer needed, we delete or de-identify it.

6. Security

We use technical and organizational measures to protect personal information, including encryption in transit, encrypted storage of shipping addresses and restricted access to our systems. No system is completely secure; tell us at once if you suspect unauthorized access to your account.

7. Your choices and rights

You can update your account and profile details in the Platform, turn notifications and marketing emails on or off, and change your public history setting.

Depending on where you live, including under the privacy laws of California and other US states, you may have the right to know, access, correct or delete personal information we hold about you, to obtain a copy of it, and to opt out of certain processing. To make a request, email [email protected] from your account email. We will verify your request and respond within the time required by law. We will not discriminate against you for exercising these rights. You may use an authorized agent where the law allows.

Some information may be kept after a deletion request where we must retain it for transactions, fraud prevention or legal obligations.

8. Children

The Platform is only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

9. Where information is processed

We are based in the United States and process information in the United States and in other countries where our service providers operate. By using the Platform, you understand that your information may be transferred to and processed in these countries.

10. Changes to this Policy

We may update this Privacy Policy. We will post the updated version with a new effective date and, for material changes, notify you on the Platform or by email.

11. Contact

Questions or requests about privacy: [email protected], or by mail to NOXA GROUP LLC, 30 N Gould St Ste N, Sheridan, WY 82801.