Privacy Policy

Personal Information You Provide

• Shop Orders: Email address, billing name, payment details (processed by Stripe — we never see full card numbers)
• Contact Forms: Name, email, message content, order number (if provided)
• Newsletter Signup: Email address (only with explicit consent)
• Account Creation: If we add user accounts, username, email, hashed password

Automatically Collected Information

• Analytics: IP address (anonymized), browser type, device, pages visited, referral source, time on page
• Cookies: Essential session cookies, analytics cookies (with consent), preference cookies
• Server Logs: Standard access logs for security and debugging

Information We Do NOT Collect

• Game login credentials (Apple ID, Google Play, Facebook, etc.)
• In-game account information or progress data
• Payment card details (handled entirely by Stripe)
• Precise geolocation data

• Order Processing: Fulfill shop orders, send redemption codes, provide order support
• Communication: Respond to contact forms, send order confirmations, important service updates
• Analytics: Understand site usage, improve content, optimize user experience (Google Analytics, anonymized)
• Security: Detect fraud, prevent abuse, protect against attacks
• Legal Compliance: Respond to legal requests, enforce terms, protect rights
• Marketing (Opt-in Only): Newsletter, promotions — only with explicit consent, easy unsubscribe

We do not sell your personal information to third parties.

Service Providers (Process Data on Our Behalf)

• Stripe: Payment processing — we receive only tokenized data, never full card details
• Email Provider (e.g., SendGrid, Resend): Transactional emails (order confirmations, support replies)
• Hosting/CDN (Vercel, Cloudflare, AWS): Infrastructure, DDoS protection, caching
• Analytics (Google Analytics, Plausible): Anonymized usage statistics

Legal Requirements

We may disclose information if required by law, court order, or to protect our rights, safety, or the safety of others.

Business Transfers

In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the business assets. You will be notified of any such change.

Cookie Categories

• Essential (Always Active): Session management, CSRF protection, load balancing
• Analytics (Optional): Google Analytics / Plausible — only with your consent via cookie banner
• Preferences (Optional): Theme preference, dismissed banners, language

Cookie Control

You can manage cookie preferences via our cookie banner (bottom of page) or your browser settings. Disabling essential cookies may break site functionality.

Third-Party Cookies

Stripe, YouTube embeds, and social media links may set their own cookies. We do not control these.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Limit processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing for direct marketing or legitimate interests
• Withdraw Consent: Withdraw consent for optional processing at any time

To exercise these rights, please use our Contact page with "Privacy Request" in the subject. We respond within 30 days (GDPR) or 45 days (CCPA).

• Order Data: 7 years (tax/legal compliance)
• Contact Form Data: 2 years after last interaction
• Analytics Data: 26 months (Google Analytics default)
• Server Logs: 30 days
• Marketing Data: Until you unsubscribe or 2 years of inactivity

Anonymized/aggregated data may be retained indefinitely for statistical purposes.

We implement appropriate technical and organizational measures:

• HTTPS/TLS encryption for all traffic
• Stripe PCI DSS Level 1 compliance for payments
• Hashed passwords (bcrypt) if accounts are added
• Regular security updates and dependency scanning
• Access controls and principle of least privilege

No internet transmission or storage is 100% secure. We cannot guarantee absolute security.

Our site is not directed to children under 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us immediately for deletion.

Our servers and service providers may be located in the United States and other countries. By using our site, you consent to transfer of your data to these jurisdictions, which may have different data protection laws. We use Standard Contractual Clauses or equivalent safeguards where required.

We may update this policy. The "Last Updated" date reflects the current version. Material changes will be announced via site banner or email (for subscribed users). Continued use constitutes acceptance.

For privacy questions or requests, please use our Contact page.