The short version
- · We collect what we need to run the shop: account email, transactions, address when you ship, and basic device and advertising-measurement data.
- · We never sell your data. We do share limited advertising-measurement data (including a scrambled, irreversible form of your email) with ad platforms so we can tell which ads work.
- · We email you about your account, and occasionally about offers — every promotional email has a one-click unsubscribe.
- · You can access, correct, delete, and export your data.
The summary is a courtesy; the full text below is what governs.
1. What we collect
Account data (email, password hash, age confirmation, and, if you choose "Continue with Google", the Google account identifier and verified email address we receive from Google to link your account; disconnecting Google from your account settings removes that link); transaction data (Sparks purchases, pack purchases, opens, sales, redemptions); shipping addresses when you redeem physical cards; contact-form submissions (name, email, message) when you write to us; device and usage data (IP address, browser type, pages viewed) for security and debugging; and cookies and similar technologies for session authentication, preferences, analytics, and advertising measurement. We use privacy-friendly analytics (Plausible) and, so we can measure which ads bring people to the site, advertising and conversion-tracking tools from Google Ads, Microsoft (Bing), TikTok, and Reddit (loaded on our pages, including through Google Tag Manager). When you sign up or make a purchase we may also send those ad platforms a record of that event from our servers, identified only by a scrambled, irreversible form of your email address (a "hash"), never your email in readable form.
2. Why we collect it
To operate your account and wallet; to secure your account (verifying your email address, confirming a password reset, and, when you change your email address, sending a verification message to the NEW address before that change takes effect); to fulfill redemptions (card shipping, code emails); to meet legal obligations (age verification, anti-money-laundering review, tax reporting, unclaimed property); to prevent fraud and abuse; to measure our advertising; and to email you. We send two kinds of email. TRANSACTIONAL email keeps your account working (receipts, verification, password resets, shipment and redemption updates); because it is part of the service you cannot unsubscribe from it while your account is open. PROMOTIONAL email is occasional news about offers, rewards, and new sets; every promotional message is clearly identified as promotional, carries a working one-click unsubscribe link, and includes our postal address (CAN-SPAM). You can opt out of promotional email at any time, from the link in any such message or from Email preferences in your account settings, and we honor opt-outs promptly. Opting out never affects transactional email.
3. Who sees it
Service providers acting for us: payment processors, email delivery, cloud hosting, and shipping carriers, each bound to use data only to provide their service. We disclose data when the law requires (subpoena, unclaimed-property reporting, AML obligations). WE DO NOT SELL YOUR PERSONAL DATA, and we never receive money for it. We do share limited advertising-measurement data with the ad platforms named in Section 1 (Google, Microsoft, TikTok, Reddit): the pages you view on our site and, for signups and purchases, a scrambled, irreversible form of your email address, so those platforms can tell us which ads worked. Under some U.S. state privacy laws (for example California's) this counts as "sharing" personal information for cross-context behavioral advertising, so we disclose it plainly here, and you can opt out as described in Section 4.
4. Your rights
Wherever you live, we extend the rights of the current U.S. state privacy laws: access a copy of your data; correct it; delete it (subject to records we must keep, like transaction history); port it; opt out of the advertising-measurement sharing described in Section 3; and appeal a refusal. To opt out of that sharing, or to exercise any other right, email legal@packlab.gg and we will action it for your account and respond within 45 days. To stop the ad-measurement tools in your browser generally, you can also use your browser's tracking protection or an ad blocker; note that we do not currently detect Global Privacy Control (GPC) browser signals automatically, so please use the email route above and we will honor it. To stop promotional email, use the unsubscribe link in any promotional message or Email preferences in your account settings.
5. Retention and security
Account and transaction records are kept for as long as your account is open plus the period required by tax, AML, and unclaimed-property law (typically 5–7 years). Passwords are stored only as salted hashes; data in transit is encrypted (TLS); access to production data is limited to personnel who need it.
6. Children
The service is for adults 18 and over. We do not knowingly collect data from anyone under 18; accounts found to belong to minors are closed and their data deleted, with any balance refunded to the payment source.
7. Changes and contact
We may update this policy at any time. The current version always lives at this URL and takes effect when posted, with the "Updated" date above as the notice of record. Where the law requires advance or individual notice of a particular change, we will give it. Questions and requests: legal@packlab.gg · Tyler Mailman (d/b/a PackLab), 74 Old Orchard Rd, Saco, ME 04072, USA.