Skip to main content

🔐 Account & Security

How signing in works on GalaxyGrails.io, what protects your account and your funds, and which parts of your profile other collectors can see.

Signing in​

GalaxyGrails.io uses email and password, or a passkey once you have added one (see Passkeys below). There is no "sign in with Google," Apple, or other social login. If someone offers you one, it isn't us.

When you register, your account starts out unverified. Check your email and click the verification link before you can use the Platform. If the message doesn't arrive, you can request a new one from the sign-in screen.

Forgot your password? Use the Forgot password link to receive a reset email. A password reset signs out every device and deletes every passkey on the account; add yours again afterward.

Password requirements​

Passwords must be:

  • Between 12 and 128 characters
  • Contain at least one uppercase letter, one lowercase letter, one number, and one special character
  • Free of spaces and tabs

We also reject passwords that appear on a list of commonly-used and easily-guessed choices — including obvious variations on "galaxygrails". If your password is refused, pick something less predictable rather than adding a character to the end.

Usernames​

Your username is what other collectors see in chat, on the leaderboard, and in pull history.

  • 3 to 30 characters
  • Letters, numbers, and underscores only
  • Must be unique — usernames are compared without regard to capitalization, so Collector and collector are the same name
  • Screened against a profanity filter

You can change your username later from your account settings, subject to the same rules.

🔑 Two-factor authentication​

GalaxyGrails.io uses emailed one-time codes for two-factor authentication. There is no SMS option and no authenticator-app setup — codes always arrive at your account email address.

A code is required for:

  • Signing in with your password (a passkey sign-in needs no code)
  • Withdrawing funds
  • Requesting a PSA Vault transfer
  • Adding a passkey

How codes work:

  • Each code is valid for 10 minutes.
  • You get five attempts per code. After that you'll need a fresh one.

Trusted devices. After a successful login you can mark a device as trusted for 30 days, which skips the code on subsequent sign-ins from that device. Two important limits:

  • Changing your password immediately invalidates every trusted device, so a stolen session can't outlive a password reset.
  • Withdrawals and vault transfers always require a fresh code. A trusted device never bypasses a money-out or card-out action, by design.

If you receive a code you didn't request, someone may have your password. Change it immediately — that also revokes every trusted device.

Sign-in codes, password resets, passkey notices, and other security emails are sent even if you've unsubscribed from marketing emails or marked one of our marketing emails as spam. They stop only if messages to your address bounce because the mailbox doesn't exist. If you change your email address, make sure the new one can receive mail.

Passkeys​

A passkey lets you sign in with Face ID, Touch ID, or your device PIN, with no password to type and no emailed code to wait for. The check your device performs counts as both factors.

  • Signing in. Choose Use a passkey on the sign-in page (your browser may also offer it from the email field). The button appears only on browsers that support passkeys.
  • Adding one. Adding a passkey always requires an emailed code, because a passkey is a standing way into the account. Right after a sign-in that used a code, a device that can make a passkey is offered one with nothing more to enter; Not now keeps the offer quiet on that browser for 30 days. You can also add one at any time from the Passkeys section of Settings, where you will be asked for a code first.
  • Managing them. The Passkeys section of Settings lists your passkeys and lets you remove any of them. Removing one asks for nothing extra.
  • You are told every time. Every passkey added and every passkey removed sends an email to your account address. If you get one you don't recognize, reset your password from the sign-in page: that deletes every passkey on the account and signs out every device. Then contact [email protected].
  • Up to 10 passkeys per account.

💳 Saved cards​

You pay for Packs and Breaks from your wallet balance, with a saved card, Apple Pay, Google Pay or a stablecoin payment covering any difference. Cards are saved and charged through Stripe; GalaxyGrails.io never sees your full card number.

  • Up to three saved cards per account. Remove one (the trash icon next to it) to add another. You can remove a card at any time.
  • U.S.-issued cards only. Cards issued outside the United States are refused.
  • One account per card. A card that is already used on another GalaxyGrails.io account can't be added to yours.
  • Some cards can't be used. For security reasons we may refuse a card without saying why. If you see "This card can't be used," try a different card.

Your bank may ask you to confirm a payment. Card payments go through your bank's own security check. Most banks approve without asking. If yours asks you to confirm in its app or with a code, the payment sheet tells you so, and that step can take up to 30 seconds.

18+ and U.S. confirmation. The first time you pay, you'll be asked to tick a box confirming you are at least 18 and located in the U.S. We record it once and won't ask again. See KYC Process for how this relates to identity verification.

👤 Private profiles​

Your profile is public by default. Turning on private profile in your account settings limits what other people can see.

What a private profile hides:

  • Your total collection value and card count
  • The points you have earned this month and your monthly leaderboard rank
  • Your public card list, which becomes unavailable to others
  • Your entry on the monthly leaderboard — you're removed from it entirely, including from your own "your rank" panel

What a private profile does not hide:

  • Your username in live chat and in @mentions
  • Your username in the recent pulls feed
  • Your username in Break queues and buyer lists on Break pages
  • Your username in card ownership history and in public fairness reports for the Packs and Breaks you took part in

In short: private profile hides your collection and standing, not your presence. If you open a Pack or take part in a Break, your username is part of that pull's public record. Turn the setting on or off at any time. The change takes effect within about a minute for other viewers.

🖼️ Profile pictures​

You can upload an avatar from your account settings.

  • Formats: JPG, PNG, GIF, or WebP
  • Maximum size: 5 MB

Every uploaded image is automatically screened before it goes live, using a third-party content-moderation service. While a new picture is being reviewed it is held privately — nobody else can see it — and your existing avatar stays visible. Nothing changes on your profile until the new image is approved.

The screening looks at what an image contains. It does not identify people, doesn't compare your photo against any database, and doesn't build a faceprint. If an image is rejected or you cancel the upload, the file is deleted.

If an image is rejected, you'll be told it doesn't meet our community guidelines and can upload a different one. Review decisions apply to the image only; they do not affect your account standing.

Uploading a picture is entirely optional — everything else on the Platform works the same without one. See Terms of Service Section 4 for the full terms.

Reviews, holds, and suspensions​

  • Reviews. Some withdrawals and PSA Vault transfers are checked by our team before they go out. Whether a request is held depends on a check of the account, not on the account's age alone. A withdrawal in review has already left your balance, and you can cancel it while it waits; if we decline it, the full amount comes back to your balance. A vault transfer in review shows "In review" on its page after your payment is received.
  • Identity checks. Withdrawals and vault transfers always require a verified identity. See KYC Process.
  • Suspended accounts. An account can be suspended for a violation of the Terms of Service. An account is also suspended when a chargeback or payment dispute is opened on a GalaxyGrails.io charge, as Section 12 of the Terms of Service allows. A suspended account can't sign in, and you'll see "This account has been suspended" on the sign-in screen. Withdrawals that haven't been sent yet are stopped, and their amounts go back to your balance. If you believe a suspension is a mistake, contact [email protected].

Keeping your account safe​

  • Use a unique password that you don't reuse on other sites, or add a passkey so there is no password to phish.
  • Treat unexpected two-factor codes and passkey emails as a warning sign, not an annoyance.
  • GalaxyGrails.io will never ask for your password, a two-factor code, or your Stripe login — not by email, not in chat, not on a live stream. Anyone who does is impersonating us.
  • Report suspicious accounts or messages to [email protected].

For identity verification, see KYC Process. For closing your account, see Account Management.