Skip to main content

Privacy Policy

Last Updated: October 17, 2026
Effective Date: October 17, 2026

This Privacy Policy describes how GalaxyGrails.io LLC, a Delaware limited liability company (“GalaxyGrails.io,” “we,” “our,” or “us”), collects, uses, and safeguards your personal information when you use GalaxyGrails.io and any related services, features, or communications (collectively, the “Services”).

By using the Services, you agree to this Privacy Policy. If you do not agree, please stop using GalaxyGrails.io.

Note: GalaxyGrails.io is operated by GalaxyGrails.io LLC and partners with Stripe for payments and identity verification, and with PSA (Professional Sports Authenticator) for physical card storage and vault transfers. GalaxyGrails.io is not affiliated with, sponsored by, or endorsed by any grading or vault service referenced in connection with the Services.

1. Scope​

This Privacy Policy applies to all personal information collected through GalaxyGrails.io, including account registration, Pack and Break purchases, deposits or withdrawals, buyback transactions, taking part in Packs and Breaks, and customer support.
The Services are currently available only to residents of the United States.

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia: Please see state-specific disclosures in Section 8, "U.S. State Privacy Rights," below.

2. Information We Collect​

2.1 Information You Provide​

We collect the following types of information directly from you when you use GalaxyGrails.io:

  • Account Information: Name, email address, username, password, and (optionally) profile picture. Uploaded profile pictures are screened by an automated third-party image-moderation service before they are published. The image is transmitted to that provider, analyzed for harmful content, and used for no other purpose. The screening classifies the content of the image; it does not identify individuals, does not compare the image against any database of people, and does not create or store a facial-recognition template. If you upload a picture of yourself, that picture is a photograph and is handled as one. See Section 6 for how long uploads are kept. We also keep a history of the usernames your account has used, including who made each change.
  • Payment & Billing Details: Payment card details are collected and stored by Stripe; GalaxyGrails.io never receives your full card number. For each card you save, we keep the card brand, the last four digits, the expiration date, a Stripe payment-method identifier, and a card fingerprint (an identifier Stripe assigns to a card number). We use the card fingerprint to detect a card that has been used on more than one account. We also keep transaction identifiers for card payments, deposits, refunds, and withdrawals, and the information needed to set up your Stripe payout account.
  • Consent Records: The date, time, and version of the Terms of Service you accepted, and the date, time, and IP address of your confirmation that you are at least 18 years old and located in the United States.
  • Vault Transfer Information: GalaxyGrails.io may collect your PSA Vault account identifier and your PSA Vault email address in order to facilitate vault-to-vault transfers via PSA, and records your consent, given when you request a transfer, to receive marketing communications from PSA.
  • Transaction & Account Data: Deposits, withdrawals, buybacks, Pack and Break purchases, points earned and redeemed, monthly leaderboard rank, and referral activity.
  • Communications: Emails, live chat messages, chat reactions, and customer support interactions, including any moderation actions taken on those messages (e.g., timeouts, deletions, or bans). Live chat messages are retained in an internal archive after they scroll out of the visible chat window; see Section 6 ("Data Retention").
  • Verification Information: Before you withdraw funds or request a vault transfer, Stripe Identity collects identity verification data (e.g., full legal name, date of birth, government-issued photo ID, and a live selfie for biometric comparison). GalaxyGrails.io does not directly store copies of your identity documents or biometric data; this information is processed and retained by Stripe Identity. From Stripe we receive and keep the verification status, the date of verification, whether you are 18 or older, and, if an attempt fails, Stripe's reason code (for example, that the selfie did not match the ID). We also read your verified name, date of birth, and identity document type, issuing country, and number from Stripe in order to compute one-way keyed fingerprints, which we keep and use to make sure each person verifies only one account. We do not keep your date of birth or document number, and the fingerprints cannot be reversed to reveal them. We may also compare your verified name with the name on your Stripe payout account to detect fraud.

2.2 Information Collected Automatically​

  • Device & Usage Data: IP address, browser type, operating system, device identifiers, session times, and interaction logs. We record the IP address and browser user agent with each card payment and each sign-in session, and the IP address with Break purchases.
  • Fraud-Prevention Signals: To detect fraud, chargeback abuse, and linked accounts, we analyze signals such as card and identity fingerprints, the IP addresses and kinds of devices used to verify identity and to make payments, addresses also used by banned accounts, the email domains of new signups, and whether a payout account is in the same name as the verified identity.
  • Signup and Onboarding Events: We may record the steps of signup, identity verification, and payment that an account or browser session reaches, including pages viewed, the names (never the contents) of form fields that showed an error, and requests that failed, linked to a random session identifier stored in your browser. These records are not collected from a browser that has opted out of targeted advertising or sends a Global Privacy Control signal, and are deleted after 30 days.
  • Error Diagnostics: When an error occurs in your browser, our error-monitoring provider receives diagnostic information about it, including your account ID and username and a replay of the session leading up to the error, which is recorded with the provider's default masking of on-screen text and form inputs.
  • Usage Information: How you interact with the Services, such as pages visited, features used, time spent on pages, and other activity within GalaxyGrails.io.
  • Analytics & Advertising Technologies: Cookies, pixels, tags, and similar technologies help authenticate users, monitor security, improve performance, measure how the Services are used, and measure the effectiveness of our advertising. Some of these technologies are operated by third parties and transmit information about your activity on GalaxyGrails.io directly to them. For more detail, and to exercise your choices, see Section 7 ("Your Rights and Choices") below.

2.3 Third-Party Service Relationships​

  • Stripe: Provides payment processing, saved cards, card authentication (such as 3D Secure), payouts, identity verification, and transaction confirmations. Stripe receives your email address, account ID, and username, and the IP address of each card payment. We may receive transaction status, card details described in Section 2.1, verification results, and fraud signals from Stripe.
  • PSA: Our vault custodian, PSA, receives the data necessary to facilitate vault transfers (your PSA Vault email address, name, PSA Vault account identifier, and order identifier). Because a vault transfer requires your consent to receive marketing communications from PSA, PSA may also use your information for its own marketing under the Collectors Privacy Policy. PSA does not receive analytics, payment, or communication data from us.
  • Analytics Providers: Collect device and usage information about how visitors interact with the Services, as described in Section 2.2, so we can measure performance and improve the product. We use Google Analytics for this purpose.
  • Advertising Partners: We use the Meta (Facebook) Pixel and Meta's Conversions API to measure advertising effectiveness and to reach people who may be interested in GalaxyGrails.io. Meta receives information about your activity on our site and may use it for its own purposes. This is described in full in Section 4.1, and you can opt out at any time; see Section 7.2.
  • Infrastructure, Storage, and Error-Monitoring Providers: Host the Services, store uploaded images and card scans, and capture diagnostic information when something goes wrong, as described in Section 2.2.
  • Live Video Provider: Delivers live show video. Your browser connects to the provider directly to play a show, so the provider receives your IP address and technical connection data; we identify you to it only by a random token, not by your account.
  • Email Delivery and Email Marketing Providers: Send transactional email (verification, security codes, transaction notices) and, where you have opted in, marketing email. Our marketing email provider receives your email address, name, and username, along with account and activity attributes used to decide which emails you receive (for example, your signup date and source, purchase and deposit counts and totals, wallet and promotional balances, points balance and rank, whether you have set a deposit limit, were referred, or are identity-verified, whether your email address is verified, any promo code you signed up with, the dates of your first and last purchase and last deposit, upcoming shows, and your email preferences), and events such as packs you open, cards you pull (card name, grade, image, and value), cards you sell back, and completed vault transfers. This provider's script also runs on our website for every visitor and may set its own cookie.
  • YouTube (Google): A host may connect their YouTube channel and broadcast a show there. The broadcast can show the show's chat, including usernames and messages, the pull queue, and recent pulls. Chat messages from the host's YouTube audience may be shown in our chat with the author's YouTube name and avatar; we do not currently store those messages beyond the short-lived live chat buffer described in Section 6. Some messages relayed before this practice began remain in our chat archive, with the author's YouTube channel identifier, and are deleted under the chat retention period in Section 6.
  • Customer Support Provider: Receives the contents of support requests you submit, including any attachments.
  • Automated Image Moderation Provider: Receives uploaded profile pictures for automated screening, as described in Section 2.1. The image is analyzed for harmful content categories and is not used to identify anyone; it is not matched against any face database, and no facial-recognition template is created or stored. This provider receives the image only, and no other account data. Under our agreement with the provider, submitted images are processed in real time and are not stored by the provider after analysis, are not used to train or improve its models, and are not made available for human review by the provider's personnel.

GalaxyGrails.io does not buy, sell, or rent personal information for monetary consideration. Our sharing of limited activity data with advertising partners, and your right to opt out of it, are described in Sections 4.1, 7.2, and 8.4.

3. How We Use Your Information​

GalaxyGrails.io uses collected information to:

  1. Operate and maintain the Services, including Packs and Breaks, Account Funds features, vault storage, the Loyalty Program, and the live chat.
  2. Process payments and payouts, managed by Stripe using your stored billing details.
  3. Facilitate vault transfers of Items through PSA.
  4. Verify identity and prevent fraud, including KYC verification through Stripe Identity, confirming that you are 18 or older, making sure each person verifies only one account, detecting cards used on more than one account, analyzing the fraud-prevention signals described in Section 2.2, and security holds and reviews on certain transactions.
  5. Communicate with you about transactions, account updates, support issues, and (where you have opted in or are otherwise permitted) product announcements.
  6. Comply with legal requirements, including tax, AML, and recordkeeping laws.
  7. Improve the user experience, through analytics, A/B testing, and feature development.
  8. Moderate live chat and other public surfaces, including via automated profanity and link filtering, rate limiting, and admin-issued timeouts, bans, or message deletions, in order to keep the community safe and on-topic.
  9. Provide public Pack and Break history, replays, fairness tools, and leaderboards, including Pack and Break pages, replays, monthly points leaderboards, and fairness reports that may display your username, monthly points, leaderboard rank, and pull history to other users and visitors on GalaxyGrails.io.
  10. Measure and deliver advertising, including measuring which advertising brings people to GalaxyGrails.io and reaching people who may be interested in the Services. This involves sharing limited activity data with advertising partners as described in Sections 2.3 and 4.1. You can opt out at any time — see Section 7.2.

We do not use your identity-verification data (other than the fact that you completed verification, which is sent to Meta as described in Section 4.1), biometric information, payment card details, vault account identifiers, or the contents of your support requests for advertising or profiling, and we do not sell personal information for money.

4. How We Share Information​

4.1 Service Providers and Advertising Partners​

Service providers process personal information only on our instructions and only for the purposes we specify. They may not use it for their own purposes. GalaxyGrails.io shares limited information with the following categories of service provider:

  • Stripe, Inc.: for payment processing, saved cards, card authentication, payouts, identity verification, and fraud prevention. Stripe requires billing addresses for regulatory compliance.
  • PSA: for physical Item storage and vault transfers. PSA receives the data necessary to facilitate transfers (e.g., PSA Vault email address, name, PSA Vault account identifier, order identifier) and does not receive any financial or communication data from us. Because requesting a vault transfer requires your consent to receive PSA's marketing communications, PSA may also use your information for its own marketing purposes. Once an Item is transferred into your own PSA Vault account, PSA's and Collectors' handling of your information is governed by the Collectors Privacy Policy rather than this Policy.
  • Hosting, Storage, and Infrastructure Providers: for secure site operation, storage of uploaded images and card scans, live video delivery, and performance and error monitoring (including the error diagnostics described in Section 2.2).
  • Analytics Providers: for measuring how the Services are used. We use Google Analytics for this purpose; it receives device and usage information as described in Section 2.2.
  • Email Delivery and Email Marketing Providers: for sending transactional and (where you have opted in) marketing email. These providers receive your email address, and our marketing email provider also receives the account and activity attributes described in Section 2.3.
  • Customer Support Provider: for receiving and managing support requests, including any attachments you submit.
  • Automated Image Moderation Provider: for screening uploaded profile pictures. This provider receives the image only, and no other account data.
  • Randomness and Fairness Providers: for generating verifiable randomness used in the selection of Items in Packs and Breaks. These providers process technical metadata only and do not receive your billing details, email address, or vault account identifier from GalaxyGrails.io.

All of the service providers above are under contractual obligations to process data only for the specified purposes and to maintain industry-standard security measures.

Advertising Partners are different, and we identify them separately because the distinction matters legally. An advertising partner is a third party, not a service provider: it receives information about your activity on GalaxyGrails.io and may use that information for its own purposes, not solely for ours.

  • Meta (Facebook): we use the Meta Pixel to measure the effectiveness of our advertising and to reach people who may be interested in GalaxyGrails.io. The Pixel transmits information about your activity on our site to Meta, which may use it for ad measurement and audience building, including for its own purposes. The information involved is device and internet activity data: identifiers such as cookie IDs and device identifiers, and pages viewed and actions taken on GalaxyGrails.io.
  • Meta Conversions API: in addition to the Pixel, our servers send Meta certain events directly: account registration, completed identity verification (sent as two events), starting a card payment, completed card payments (including whether a payment is your first or a repeat payment), and opening a Pack or a Break. These server events carry a hashed (SHA-256) email address, a hashed account identifier, the Meta cookie identifiers stored in your browser, and details of the event, such as its amount; registration and card-payment-start events also carry your IP address and browser user agent. We do not send server events for an account that has opted out of targeted advertising.

Under some U.S. state privacy laws this is considered "sharing" personal information for cross-context behavioral advertising, or "targeted advertising."

You can opt out of this sharing at any time. See Section 7.2 ("Your Privacy Choices"). Opting out in a browser prevents the Pixel from loading in that browser, and an opt-out recorded on your account (including one made while signed in, or signaled by Global Privacy Control while signed in) also stops the server events described above.

Note that Google Analytics, listed above, is used as an analytics service provider rather than an advertising partner: we have disabled its advertising and ad-personalization features, so it is not used to build advertising audiences.

GalaxyGrails.io may disclose data:

  • To comply with applicable laws, subpoenas, or government requests;
  • To enforce our Terms of Service and prevent fraud or abuse;
  • To protect the rights, property, or safety of GalaxyGrails.io or its users.

4.3 Business Transfers​

In case of a merger, acquisition, or asset sale, user data may transfer as part of the transaction. Any successor entity will remain bound by this Privacy Policy.

4.4 Referred Users​

If you refer another user through our referral program, your referral dashboard displays limited information about users who signed up through your referral link — their username, the date they joined, and the commissions their qualifying activity has generated for you — so you can track your referral earnings. Likewise, if you sign up through someone else's referral link, that referrer can see this limited information about your account.

GalaxyGrails.io does not sell personal information for money. We do share limited activity data with advertising partners for cross-context behavioral advertising as described in Section 4.1, which some state laws classify as "sharing" or "targeted advertising." You can opt out — see Section 7.2.

5. Data Security​

GalaxyGrails.io employs robust technical, administrative, and physical safeguards, including:

  • Encryption of data in transit and at rest;
  • Tokenization of payment information by Stripe (GalaxyGrails.io never stores full card data);
  • Encrypted storage of billing addresses and vault account identifiers;
  • Identity checks based on one-way keyed fingerprints rather than stored identity document numbers or dates of birth;
  • Role-based access control and security monitoring;
  • Ongoing security monitoring and review.

While no online system is completely secure, GalaxyGrails.io follows industry best practices to minimize risk.

6. Data Retention​

GalaxyGrails.io retains personal information only as long as necessary to:

  • Provide and maintain your account and Services;
  • Satisfy legal and financial recordkeeping obligations;
  • Prevent fraud or abuse;
  • Resolve disputes and enforce agreements.

Where a retention period applies and expires, data is securely deleted or anonymized.

Profile picture uploads. An image awaiting automated screening is held privately and is not visible to other users. Approved images become your profile picture and are retained until you replace or remove them, or your account is erased. Rejected and canceled uploads are deleted.

Signup and onboarding events. The records described in Section 2.2 are deleted after 30 days.

Identity fingerprints and card records. Identity fingerprints are kept for as long as your account exists. Saved-card records, including card fingerprints, are kept after you remove a card so that a card used on more than one account can still be detected. See Section 7.7 for what happens on account erasure.

Chat relayed from YouTube. Messages relayed from a host's YouTube chat are held only in the short-lived live chat buffer (currently up to 48 hours after a show's most recent chat message) and are not written to our chat archive. Messages relayed before this practice began remain in the archive and follow the live chat retention below.

Live chat. The visible chat window shows only the most recent messages, but messages you post are also written to an internal archive used for moderation, dispute resolution, fraud prevention, and product analytics. Archived messages are retained for up to two (2) years from the date they are posted and are then deleted, except where a longer retention is required by law or by an active dispute or investigation. Messages removed by a moderator remain in the archive with a record of the removal. If your account is erased, your username is detached from your archived messages, but the message text itself is retained — see Section 7.7.

7. Your Rights and Choices​

7.1 Email Preferences​

Every marketing email links to an email preference center where you can control what we send you. You can adjust individual topics — product updates, show alerts, and lifecycle messages — or unsubscribe from all marketing email at once. You may optionally tell us why you unsubscribed; that is never required.

The link in an email works without signing in, so an unsubscribe link remains usable long after the message was sent. You can also unsubscribe by contacting [email protected].

Even if you opt out of marketing email, we may still send transactional communications regarding your account, purchases, vault transfers, security codes, or support requests. These are not marketing and cannot be unsubscribed from while your account is open.

GalaxyGrails.io uses the following categories of cookies:

  • Essential / Strictly Necessary: Required for the Services to function and cannot be disabled. These include your session and authentication cookies, and a trusted-device cookie set for up to 30 days when you choose to remember a device for two-factor authentication.
  • Functional: Enable features like saved preferences (such as volume settings), including a referral cookie that records the referral code you arrived with (up to 7 days) so we can credit the referring user if you sign up, and marketing-attribution cookies that record the source, campaign, and ad you first arrived from, and any Meta click identifier in the link (up to 90 days). Attribution cookies are not set in a browser that has opted out of targeted advertising. Disabling these may impact some functionality.
  • Analytics / Performance: Collect usage data to improve the Services. These can be disabled in your browser settings.
  • Marketing / Advertising: Set by our advertising partners to measure advertising effectiveness and to reach people who may be interested in the Services. These are the technologies described in Section 4.1 under "Advertising Partners."

Your Privacy Choices — opting out of targeted advertising. You may opt out of the sharing of your personal information for targeted advertising at any time, at no cost, and without any effect on your access to the Services:

  • Use the Your Privacy Choices page. Your choice is stored on the device and browser you use to make it, so repeat it on each browser you use, and again if you clear your cookies.
  • Or send a request to [email protected] with the subject line "Do Not Sell or Share My Personal Information."
  • Or send an opt-out preference signal such as Global Privacy Control — see Section 7.5. We honor these automatically, so no further action is needed.

You may also control these technologies through your browser settings, and through the advertising controls that Google and Meta provide directly.

7.3 Public Profile Visibility​

Your profile is public by default. You can turn on private profile in your account settings at any time to hide your collection value, card count, points earned this month, and leaderboard rank from other users, and to remove yourself from the public monthly leaderboard. Note that a private profile does not hide your username where it forms part of a public or shared record: live chat, mentions, recent-pull feeds, Break queues, card ownership history, and Pack and Break fairness reports. See the Account & Security guide for the full breakdown.

7.4 Do Not Track​

As of the Effective Date, there is no commonly accepted standard response to Do Not Track (DNT) signals. GalaxyGrails.io does not currently respond to DNT signals.

7.5 Global Privacy Control (GPC)​

GalaxyGrails.io honors opt-out preference signals, including Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a request to opt out of the sharing of your personal information for targeted advertising, and we apply it automatically to that browser without requiring you to do anything else. The signal applies to the browser that sends it. If you are signed in when your browser sends it, we also record the opt-out on your account.

For more information, visit globalprivacycontrol.org.

7.6 State-Specific Rights​

Depending on your state of residence, you may have additional rights to access, correct, delete, or appeal regarding your personal information. See Section 8 ("U.S. State Privacy Rights") below for the full list and instructions on how to exercise these rights. For account closure specifically, see Section 7.7 below or the Account Management guide.

7.7 Account Closure and Right to Erasure​

You may request closure of your account and deletion of your personal information at any time by emailing [email protected] with the subject line "Account Closure Request" or "Data Deletion Request." Before we can process the request, you must bring your Account Funds balance to zero (withdrawing your earned balance to your linked Stripe account and asking us to refund any unspent deposited funds, as described in the Terms of Service), accept the buyback or request a vault transfer of any cards remaining in vault custody under your account, allow any in-flight vault transfer or withdrawal to complete, and resolve any pending disputes.

Once these prerequisites are complete, an authorized GalaxyGrails.io administrator will process the erasure. We will:

  • Remove or scramble identifying personal information associated with your account (including your name, email, username, password hash, profile picture, referral code, PSA Vault email, and identity-verification session identifier);
  • Cancel any profile picture still awaiting moderation and delete the uploaded file;
  • Clear your marketing preferences and suppress your profile with our email marketing provider, so you are removed from future sends;
  • Delete your username history and remove the IP address recorded with your 18+ and U.S. confirmation (the date and time of the confirmation are kept as a consent record);
  • Delete your identity fingerprints, unless your account was banned, in which case they are kept so that the account's owner cannot verify a new account;
  • Revoke all active sessions and refresh tokens; and
  • Mark your account as deleted on our systems.

Retained records. Certain information is retained for legal, financial, anti-fraud, and tax compliance purposes even after an erasure, including: financial transactions (deposits, withdrawals, buybacks, refunds, disputes, balance ledger entries, including the IP address and user agent recorded with card payments), pull history and the Packs and Breaks you took part in, vault transfer records, chat messages and chat moderation logs, identity-verification status, saved-card records including card fingerprints, consent records, and Stripe customer/account identifiers. The following are also not removed by an erasure today: copies of emails we have sent you, sign-in session records (including IP address and user agent) until they expire, marketing-attribution data recorded at signup, records from our former physical shipping service, support tickets held by our customer support provider, data held by Stripe, and your profile with our email marketing provider, which is suppressed from future sends rather than deleted. These records are retained under a legal-obligation basis for the periods required by applicable law (typically 5 to 7 years for tax records, longer where required by AML or anti-fraud rules). Where retention is required, the underlying user identifier remains stable so the record can still be reconciled, but personally-identifying fields are scrubbed.

Limits on erasure in free-text content. Some retained records contain text that we do not rewrite. Your archived chat messages are retained with your username removed, but the message text itself is preserved as posted. Transaction descriptions and messages posted by other users may also refer to you by name. We do not scan or edit the contents of these records as part of an erasure request. If you believe a specific retained record contains personal information that should be removed, contact [email protected] and we will review it individually.

Stripe Identity data. Identity verification documents (government ID, selfie, biometric data) are processed and retained by Stripe Identity, not by GalaxyGrails.io, and are governed by Stripe's data-handling practices. To request deletion of verification data held by Stripe, you may contact Stripe directly at [email protected] in addition to your request to us.

8. U.S. State Privacy Rights​

The following disclosures apply to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

8.1 Categories of Personal Information Collected​

See Section 2 ("Information We Collect") for a full description. Categories include: identifiers (name, email, address, account credentials); commercial information (transaction, purchase, points, and leaderboard history); device and internet activity information; financial information (processed by Stripe); biometric and identity-verification information (processed by Stripe Identity), including the verification status, whether you are 18 or older, and one-way keyed fingerprints derived from your verified name, date of birth, and identity document number; sensitive personal information as defined by California law (e.g., account login credentials and payment-card information, processed in connection with operating the Services and not used for any other purpose); and user-generated content (live chat messages and moderation history).

Personal information is retained for the periods described in Section 6 and Section 8.3, disclosed for a business purpose to the categories of service providers listed in Section 4.1, and shared for cross-context behavioral advertising as described in Section 8.4.

8.2 Purposes for Collection​

See Section 3 ("How We Use Your Information") for the business and operational purposes for which we collect personal information.

8.3 Retention​

GalaxyGrails.io retains personal information for the period necessary to fulfill the purposes described in this Policy, unless a longer period is required by law. We may be required to retain certain data after our relationship with you ends to satisfy legal or regulatory obligations.

8.4 Sale and Targeted Advertising​

GalaxyGrails.io does not sell personal information for monetary consideration.

GalaxyGrails.io does share personal information for cross-context behavioral advertising (referred to in some state laws as targeted advertising). The categories shared are identifiers (cookie IDs, device identifiers, and a hashed email address and account identifier), device and internet activity information (information about pages viewed and actions taken on GalaxyGrails.io, and for some events your IP address and browser user agent), and commercial information (events such as registration, card payments, and pack openings). The categories of recipients are our advertising partners, identified in Section 4.1. We do not share sensitive personal information, identity-verification or biometric data (other than the fact that you completed identity verification), payment card details, or support-request contents for this purpose.

You have the right to opt out of this sharing, and we will not discriminate against you for exercising it. See Section 7.2 ("Your Privacy Choices") for the ways to opt out, including the Your Privacy Choices page and Global Privacy Control.

We do not knowingly sell or share the personal information of consumers under 16 years of age. The Services are limited to users 18 and older.

8.5 Your State Law Rights​

You may have the right to:

  • Access / Know: Confirm whether we process your personal information and request access to specific pieces we hold about you.
  • Correct: Request correction of inaccurate personal information.
  • Delete: Request deletion of personal information we have collected from you. Note that exercising this right may affect our ability to provide certain Services.
  • Portability: Request a copy of the personal information you provided to us in a portable and, where technically feasible, readily usable format.
  • Opt-Out of Sale / Sharing / Targeted Advertising: Direct us to stop sharing your personal information for cross-context behavioral or targeted advertising. Use the Your Privacy Choices page, send a Global Privacy Control signal, or email us — see Section 7.2. We do not sell personal information for money, so no opt-out is needed for that.
  • Appeal: If your request is denied, you may appeal by contacting [email protected] and including "Privacy Request Appeal" in the subject line.

We will not discriminate against you for exercising any of the above rights.

8.6 How to Exercise Your Rights​

Submit a request by emailing [email protected] with the subject line "Privacy Rights Request." We may require you to provide your name, contact information, and other details to verify your identity before fulfilling a request. We do not require identity verification for requests to opt out of the sharing of personal information for targeted advertising — those are honored as described in Section 7.2.

9. Children's Privacy​

GalaxyGrails.io is intended solely for users 18 years of age or older. If you are under 18, you may not use the Services. We do not knowingly collect personal information from individuals under 18. If you believe a minor has submitted personal information to us, please contact [email protected] and we will promptly delete it.

10. Notice of Monitoring​

GalaxyGrails.io and its service providers may monitor activity on the Services for security, fraud prevention, and operational purposes. This may include logging pages visited, features used, items clicked, session duration, and other interactions. Cookies and similar technologies described in this Policy may also capture this information. By using the Services, you acknowledge and consent to this monitoring. If you do not consent, please discontinue use of the Services.

GalaxyGrails.io may link to third-party services such as Stripe and PSA. These websites operate independently and are subject to their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of any third-party site.

12. Updates to This Policy​

GalaxyGrails.io may update this Privacy Policy from time to time and will post any revisions on this page. The Effective Date at the top of this Policy reflects the most recent update. If material changes occur, GalaxyGrails.io will use reasonable efforts to notify users via email or a notice on the website. Continued use of the Services after an update constitutes your acceptance of the revised Policy.

13. Contact Us​

Email: [email protected]
Mail: GalaxyGrails.io LLC
16192 Coastal Highway
Lewes, DE US