1. About this policy
This policy explains how LEGAL ENTITY NAME, of REGISTERED ADDRESS (“we”, “us”, “booty.cards”) handles personal information when you use booty.cards. It should be read with our Terms of Service. We are the controller of the personal information described here.
Personal information means information that identifies you, or that could reasonably be linked to you, on its own or combined with other information.
2. booty.cards is for adults
The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not market to them. If we learn that we hold information about someone under 18, we will close the account and delete the information. If you believe a child has given us information, email privacy@booty.cards.
3. What we collect
Information you give us
- Account details — your username and a cryptographically hashed password. We store a hash, never the password itself. If you sign in with a wallet, we store your wallet address instead.
- Profile details — a display name and avatar image, if you set one, and your display preferences such as language and currency.
- Shipping details — the recipient name, street address, city, state or region, postal code, and country you give us so a redeemed card can reach you. We keep an address book so you do not have to retype it.
- Correspondence — what you write to us in support requests, and our replies.
- Identity information, where the law requires it — if we or a partner must verify your age, identity, or eligibility, or run anti-fraud or sanctions checks, we may collect government identification and similar documents. We collect this only when it is required, and only for as long as it is required.
Information created as you use the Service
- Play and holdings — the packs you open, the cards you are awarded, what is in your collection, and any listings, offers, or bids you make.
- Transaction records — a ledger of entries, awards, sales, and redemptions, including amounts and timestamps. We keep these for accounting, anti-fraud, and dispute resolution, and we are often required to.
- Redemption records — which card was shipped, where, when, and its delivery status.
Information collected automatically
- Device and connection data — IP address, browser and device type, operating system, and language settings.
- Usage data — pages viewed, features used, and timestamps, so we can find bugs and improve the Service.
- Approximate location, derived from your IP address, so we can apply the geographic restrictions our Terms require.
- Server logs — request paths, response codes, and timing. We use these for security and debugging.
Information from other sources
- From Collector Crypt and its vaulting partners: which card you were awarded, its vault and certification records, and shipment tracking.
- From wallet and payment providers: confirmation that a transaction settled, and the wallet address involved.
- From public blockchains: transactions associated with your wallet address.
- From fraud, sanctions, and identity-verification providers, where those checks apply to you.
We also use third-party card pricing, population, and sales data (from sources including eBay, PriceCharting, and grading companies). That is data about cards, not about you, and we query it without sending anything that identifies you.
4. Why we use it
- To run the Service — create and secure your account, run the draw, record what you own, and get redeemed cards to you.
- To keep it honest and safe — detect and prevent fraud, multi-accounting, bots, abuse of free-entry mechanics, and unauthorised access.
- To comply with the law — age and eligibility checks, geographic restrictions, sanctions screening, tax and accounting obligations, and responding to lawful requests.
- To support you — answer your questions and investigate problems.
- To improve the Service — understand which features are used and where they break.
- To contact you — service messages about your account, prizes, and shipments. Marketing only if you have opted in, and you can opt out at any time.
Where the GDPR or UK GDPR applies, we rely on: contract (running the Service and supporting you), legal obligation (age, eligibility, sanctions, tax, accounting), legitimate interests (security, fraud prevention, improving the Service — balanced against your rights), and consent (marketing, and any non-essential cookies we may introduce — see Section 8 — withdrawable at any time).
5. Who we share it with
We do not sell your personal information, and we do not share it for anyone else’s advertising. We share it only as follows:
- Collector Crypt Inc. and its vaulting and shipping partners — your wallet address, the award, and your shipping address, so the right card reaches you. Their handling of it is governed by their own privacy policy.
- Service providers — hosting and database infrastructure, wallet infrastructure, payment processing, email delivery, customer support tooling, analytics, and fraud prevention. They may use it only to provide the service we engaged them for.
- Professional advisers — lawyers, accountants, and auditors, where needed.
- Law enforcement and regulators — where we are legally required, or where we reasonably believe it is necessary to prevent harm or investigate fraud.
- An acquirer — if we are involved in a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply.
- Anyone you tell us to.
6. What other users can see
Some activity is public by design. Specifically:
- Recent pulls may appear in a live feed, and leaderboards or similar features may show a display name alongside a result.
- If you list a card, make an offer, or place a bid, your username and avatar are shown to other users alongside the amount and the time. That is how the other side of a trade knows who they are dealing with.
Your account identifier is never exposed — only the handle you chose. So choose it accordingly: do not use your real name, or any name you use elsewhere, if you would rather not be identified.
7. Blockchain data is public and permanent
Transactions on a public blockchain cannot be edited, hidden, or deleted — not by you, and not by us. Your wallet address and its full transaction history are permanently visible to anyone.
This has a consequence worth understanding. If your wallet address is ever linked to your identity — by you, by an exchange, by another service, or by analysis of the chain — then activity associated with that address can be linked to you as well, permanently and by anyone. A right to erasure cannot reach data on a public blockchain. It reaches our own systems, which is where we can and do act.
8. Cookies and similar technologies
Today we set only strictly necessary cookies. There are two: one that keeps you signed in, and one that remembers you have passed the pre-launch access gate. Both are required for the Service to work, and neither is used to profile you.
We also use your browser’s local storage to remember display preferences — theme, language, currency, and similar. That never leaves your device.
We do not use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. Because we set no non-essential cookies, there is nothing here for you to consent to and we show no cookie banner. If that ever changes, we will ask for your consent first wherever the law requires it, and update this section before doing so.
You can block or delete cookies in your browser, but blocking the two above will stop you from signing in.
9. How long we keep it
We keep personal information for as long as your account is open, and afterwards only as long as we need it. In practice:
- Account and profile data — until you close your account, then deleted or anonymised.
- Transaction, prize, and redemption records — retained after account closure to meet tax, accounting, anti-fraud, and prize-award record-keeping obligations.
- Shipping addresses — deleted with your account, once no shipment is open.
- Support correspondence — kept for a reasonable period after the matter closes.
- Server logs — kept short-term for security and debugging.
10. Security
We encrypt traffic in transit, hash passwords rather than storing them, restrict access to personal information to those who need it, and separate privileged database access from the public application. No system is perfectly secure, and we cannot guarantee absolute security.
We will never ask for your seed phrase or private keys. Anyone who does is trying to steal from you.
11. International transfers
We and our providers operate in several countries, so your personal information may be processed outside the country you live in, including in the United States. Where we transfer information out of the EEA, the UK, or another region with transfer restrictions, we rely on an approved safeguard such as the European Commission’s standard contractual clauses.
12. Your rights
Wherever you live, you can ask us to give you a copy of your personal information, correct it, or delete it. Email privacy@booty.cards. We will verify who you are before acting, and will respond within the time the law allows — and in any case within 30 days. We do not charge for this unless a request is repetitive or excessive.
Some information we may have to keep despite a deletion request — transaction and prize records, for example, where the law requires us to retain them. We will tell you if that applies and delete the rest.
Europe and the United Kingdom
If the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and data portability, and the right to withdraw consent at any time without affecting processing already carried out. You may also complain to your national data protection authority, or to the UK Information Commissioner’s Office.
California
Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use, disclose, and — if we did — sell or share; the right to delete it; the right to correct it; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of them. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. You may use an authorised agent.
Canada
Under PIPEDA and Quebec’s Law 25, you may access and correct your personal information, withdraw consent subject to legal and contractual limits, and complain to the Office of the Privacy Commissioner of Canada or your provincial authority.
13. Changes to this policy
We may update this policy. The date at the top of this page shows when it last changed substantively, and we will give notice through the Service before a material change takes effect.
14. Contact
Privacy questions, requests, and complaints: privacy@booty.cards
LEGAL ENTITY NAME
REGISTERED ADDRESS