Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect the following personal information:

• Full name
• Email address
• Username and display name
• Shipping address (when you request card delivery)
• Authentication data from Google OAuth (if you choose to sign in with Google)

1.2 Payment Information

All payment processing is handled by Stripe. We do not store your full credit card number, CVV, or banking details on our servers. Stripe may collect and store your payment card information in accordance with their own privacy policy. We receive only a tokenized reference, the last four digits of your card, and transaction confirmation details.

1.3 Usage Data

We automatically collect certain information when you interact with the Service, including:

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages viewed, features used, and time spent on the Service
• Referring URLs and search terms
• Pack opening history, marketplace activity, and vault interactions

1.4 Provably Fair Data

To support our provably fair system, we store cryptographic data related to your pack openings, including server seeds, client seeds, nonces, and resulting hashes. This data is retained to allow you to verify the fairness of your pulls at any time.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process transactions, including pack purchases and marketplace sales
• Facilitate vault storage and shipping of physical cards
• Provide customer support and respond to your inquiries
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Improve and optimize the Service through analytics and usage patterns
• Send transactional emails (order confirmations, shipping updates, security alerts)
• Send promotional communications (only with your consent; you may opt out at any time)
• Comply with legal obligations and enforce our Terms

3. Third-Party Services

We share personal information with third parties only as necessary to provide the Service. We do not sell your personal information.

4. Cookies and Tracking

4.1 What We Use

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication, session management, and security. The Service cannot function without these.
• Preference cookies: Remember your settings and display preferences.
• Analytics cookies: Help us understand usage patterns and improve the Service.

4.2 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service, including logging in and making purchases.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained until you request account deletion.
• Transaction records are retained for a minimum of 7 years as required by Canadian tax law.
• Provably fair data (seeds, hashes) is retained indefinitely to allow ongoing verification.
• Usage logs are retained for up to 24 months, after which they are anonymized or deleted.

6. Data Security

We implement industry-standard technical and organizational measures to protect your personal information, including encryption in transit (TLS) and at rest, secure authentication protocols, regular security audits, and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. Your Rights Under PIPEDA

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy legislation, you have the following rights:

• Right of Access: You may request access to the personal information we hold about you.
• Right to Correction: You may request that we correct inaccurate or incomplete personal information.
• Right to Withdraw Consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawing consent may limit your ability to use certain features of the Service.
• Right to Complain: If you believe we have not handled your personal information appropriately, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, please contact us at support@cardchase.net. We will respond to your request within 30 days.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@cardchase.net.

9. International Data Transfers

CardChase is based in Canada. If you access the Service from outside Canada, your information may be transferred to, stored, and processed in Canada. By using the Service, you consent to the transfer of your information to Canada, where data protection laws may differ from those in your jurisdiction. We ensure that any third-party service providers processing your data outside of Canada provide an adequate level of protection consistent with Canadian privacy standards.

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and notify you via email or through a prominent notice on the Service. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Officer: