Privacy Policy

1. Information We Collect

• Account and identity: name, username, email address, account identifiers, sign-in method, and, if you choose to give it, phone number. If we need to verify your age or identity, we may collect a date of birth or confirmation of identity from a verification provider.
• Sign-in providers: if you sign in with Google, Discord, or Facebook, we receive your account ID with that provider, your name, your email address, and whether it is verified. If you link Discord, we also receive your Discord username and whether you are a member of our Discord server. We do not post to, or read your activity on, these services.
• Purchases and payments: Holofoil Credit purchases, amounts, dates, and payment status. Payments are handled by Stripe; we receive limited payment details such as the card brand, last four digits, expiration, issuing country, wallet type, and a card fingerprint that lets us recognize the same card again. We never receive or store your full card number or security code.
• Platform activity: packs opened, cards received, pull history, vault contents, sell-backs, conversions, binders, Rarity Runs, Party Packs, balances, promotions, and referrals.
• Shipping: name, shipping address, phone number where a carrier needs it, shipping choices (such as insurance or signature), tracking, and customs information for cross-border shipments.
• Communications: support messages, emails, feedback, survey answers, and your marketing preferences.
• Device and usage: IP address and the approximate location it implies (city, state or province, country), browser and device type, operating system, language, screen size, referring page, pages and features used, timestamps, error reports, and the ad or link that brought you to us (such as campaign tags and click identifiers).
• Security and fraud signals: device identifiers, browser and device characteristics, signs of automation, VPN or proxy use, account-linkage signals (for example, accounts that share a device, payment card, or address), payment risk signals from Stripe, and the results of our fraud checks (see Section 4).
• Inferences: limited conclusions drawn from the above, such as which products you are interested in, how likely an account is to be fraudulent, or which marketing channel you came from.

We do not intentionally collect sensitive personal information such as government ID numbers, precise geolocation, health, or biometric information. If we ever need to verify identity with a government ID, we will tell you at the time, and the verification will be performed by a specialist provider.

2. Where It Comes From

• From you, when you create an account, buy credit, open packs, request shipping, or contact us.
• Automatically, from your browser or device through cookies and similar technologies (Section 6).
• From service providers and partners, such as sign-in providers, Stripe, carriers and address-validation tools, fraud-prevention providers, Discord, and advertising platforms (for example, whether an ad click led to a visit).
• From other users, such as when someone refers you.

3. How We Use It

• To provide the Platform: creating and securing your account, sending sign-in codes, processing purchases, opening packs, running the vault and sell-backs, shipping cards, and providing support.
• To keep the Platform safe: preventing fraud, stolen payments, chargebacks, multiple accounts, promotion abuse, bots, and other violations of our Terms; investigating errors and malfunctions; and keeping audit records.
• To improve the Platform: understanding how features are used, diagnosing errors, testing new designs (including A/B tests), and pricing and stocking products.
• To market Holofoil: sending promotional emails or messages you have agreed to, running referral and promotion programs, and measuring and improving our advertising.
• To meet legal obligations: tax and accounting records, responding to lawful requests, enforcing our Terms, and defending legal claims.

Where a law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running a safe and successful business (balanced against your rights), your consent (which you can withdraw), and legal obligations.

4. Fraud Prevention and Automated Decisions

Card-based platforms are frequent targets of stolen payment methods. To protect our users and our inventory, we use automated systems that combine payment risk signals from Stripe, device intelligence from our fraud-prevention providers (including Verisoul), our own device identifier, IP and network information, account history, and links between accounts. Based on these signals, our systems may automatically place an account in a risk level that can limit how much credit can be purchased, require a more secure payment method, delay or hold a purchase, sell-back, or shipment, or flag the account for review.

Decisions to close an account are reviewed by a person. If you believe an automated limit is wrong, email [email protected] and a person will review it. Where the law gives you the right to opt out of automated decision-making, that right may not apply to fraud prevention and security processing, but we will still review your request.

5. How We Share It

We share personal information only as described here:

• Service providers who process it on our behalf, under contracts that limit their use of it:

• Advertising platforms, as described in Section 7.
• Payment networks and banks, when needed to process or contest a payment or dispute, including our records of the purchase, account, device, and delivery.
• Legal and safety: to comply with law or legal process, to respond to lawful requests from authorities, and to protect the rights, property, and safety of Holofoil, our users, and others, including sharing with law enforcement and payment providers to fight fraud.
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction: when you choose to make something public (such as a public binder) or ask us to share it.

6. Cookies and Similar Technologies

We use cookies, local storage, pixels, and similar technologies. Some are essential; others help us measure and improve the Platform and our advertising. You can block cookies in your browser, but parts of the Platform (such as staying signed in) will not work without essential cookies.

We do not respond to “Do Not Track” browser settings, which have no common standard, but we do honor Global Privacy Control (Section 7).

7. Advertising, “Selling,” and “Sharing”

We advertise on platforms such as Google, Meta (Facebook and Instagram), TikTok, Reddit, Microsoft, and OpenAI. To learn which ads work, we let these platforms place pixels on our site and we send them information about events such as sign-ups and purchases, including device and cookie identifiers, IP address, click identifiers, and, for some platforms, a hashed (scrambled) version of your email address or phone number. The platforms may combine this with information they already have about you.

Customer lists. We may also upload a list of our customers’ email addresses or phone numbers, hashed (scrambled) before or as they are uploaded, to advertising platforms such as Google (Customer Match) and Meta (Custom Audiences). The platforms match the list against their own users so we can show our ads to existing customers, leave existing customers out of ads meant for new customers, measure our ads, and reach people with similar interests. If you opt out (below), we leave you off these lists.

We do not sell personal information for money. However, some state laws treat this kind of advertising measurement as a “sale” of personal information or “sharing” it for cross-context behavioral advertising. In the past 12 months we have “sold” or “shared” identifiers, internet activity, commercial information (such as purchase events), and inferences with advertising platforms for these purposes.

You can opt out at any time on our Your Privacy Choices page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out for that browser automatically, and, if you are signed in, for your account. When you opt out while signed in, we save the choice to your account so it applies on every device you sign in on and to what we send from our servers. You can also control ad personalization in your settings with each ad platform. We do not knowingly sell or share the personal information of anyone under 18.

8. Communications

We send service emails that you cannot opt out of while you have an account, such as sign-in codes, receipts, shipping updates, security notices, and changes to our Terms. We send marketing emails only as permitted by law, and every marketing email includes an unsubscribe link. If we offer text messages, we will send marketing texts only with your express consent; reply STOP to stop and HELP for help. Message and data rates may apply.

9. What Other People Can See

Your username is not shown publicly by default, and your binder is private unless you make it public. If you make your binder public, anyone with the link can see the cards in it and the name you display. Things you post in our Discord server are governed by Discord’s policies and visible to its members. Some Platform features may show recent pulls without identifying who opened them.

10. How Long We Keep It

We keep personal information only as long as we need it for the purposes in this Policy. Typical periods are:

We may keep information longer where the law requires it, to resolve a dispute or legal claim, or in backups until they are overwritten. When we no longer need it, we delete or de-identify it.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, restricted access to production systems, separation of secrets, passwordless sign-in, and monitoring for abuse. No system is perfectly secure. Please keep your email account and devices secure, since access to your email can be used to sign in. If we learn of a breach that affects your personal information, we will notify you and regulators as required by law.

12. Your Rights and Choices

Wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy;
• correct information that is wrong;
• delete your information and close your account (see our data deletion page);
• stop sending you marketing; and
• opt out of the “sale” or “sharing” of your information for advertising (see Section 7).

To make a request, email [email protected] from the email on your account, or use the Privacy Choices page. We will verify your request by confirming control of your account email and may ask for more information if needed. You may use an authorized agent, who must show us your signed permission; we may still ask you to verify your identity. We respond within 45 days (30 days in Canada), and will tell you if we need more time.

We may keep some information after a deletion request where the law allows, for example to complete a transaction, keep tax and accounting records, prevent fraud or repeat abuse, or defend legal claims. We will not discriminate against you for exercising your rights.

13. U.S. State Privacy Rights

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have the rights in Section 12, as provided by their state’s law, including the right to know the categories and specific pieces of personal information we hold, to correct and delete it, to obtain a portable copy, and to opt out of sales, sharing, and targeted advertising. Oregon residents may also ask for a list of the specific third parties to which we have disclosed personal information.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal.” We will respond within the time your state’s law requires. If you are not satisfied, you may contact your state attorney general.

California notice at collection. In the past 12 months we collected the categories of personal information listed in Section 1: identifiers; customer records (name, address, phone, limited payment details); commercial information; internet and network activity; approximate geolocation; audio or electronic information you send us (such as support messages and images); and inferences. We collected them from the sources in Section 2, for the purposes in Sections 3 and 4, and disclosed them to the categories of recipients in Section 5. We “sold” or “shared” the categories described in Section 7. We do not use or disclose sensitive personal information for purposes that require a right to limit. Retention is described in Section 10.

Financial incentives. Promotions such as referral rewards or sign-up bonuses may involve collecting personal information like your email address. Their value is reasonably related to the value of a new customer relationship to us. You can opt in by joining the promotion and withdraw by contacting us.

14. Canada

We handle the personal information of Canadian residents in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Québec’s Act respecting the protection of personal information in the private sector. You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits (for example, we cannot operate your account without some information).

Holofoil is based in the United States, and our service providers may store and process your information in the United States and other countries, where it may be accessible to courts and authorities under local law. We use contracts and other measures to protect it.

Our person in charge of the protection of personal information can be reached at [email protected] (attention: Privacy Officer). If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

15. Children

Holofoil is only for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it and close the account.

16. Changes and Contact

We may update this Policy. We will change the date above, and for material changes we will notify you by email or on the Platform before they take effect. Questions, requests, and complaints can be sent to First Edition TCG LLC (Holofoil) at [email protected].