Skip to main content

Privacy Policy

Effective Date: August 10, 2026

This Privacy Policy describes how GalaxyGrails.io LLC, a Delaware limited liability company (“GalaxyGrails.io,” “we,” “our,” or “us”), collects, uses, and safeguards your personal information when you use GalaxyGrails.io and any related services, features, or communications (collectively, the “Services”).

By using the Services, you agree to this Privacy Policy. If you do not agree, please stop using GalaxyGrails.io.

Note: GalaxyGrails.io is operated by GalaxyGrails.io LLC and partners with Stripe for payments and identity verification, and with PSA (Professional Sports Authenticator) for physical card storage and vault transfers. GalaxyGrails.io is not affiliated with, sponsored by, or endorsed by any grading or vault service referenced in connection with the Services.

1. Scope​

This Privacy Policy applies to all personal information collected through GalaxyGrails.io, including account registration, pack purchases, deposits or withdrawals, buyback transactions, live event participation, and customer support.
The Services are currently available only to residents of the United States.

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia: Please see state-specific disclosures in Section 8, "U.S. State Privacy Rights," below.

2. Information We Collect​

2.1 Information You Provide​

We collect the following types of information directly from you when you use GalaxyGrails.io:

  • Account Information: Name, email address, username, password, and (optionally) profile picture. Uploaded profile pictures are screened by an automated third-party image-moderation service before they are published. The image is transmitted to that provider, analyzed for harmful content, and used for no other purpose. The screening classifies the content of the image — it does not identify individuals, does not compare the image against any database of people, and does not create or store a facial-recognition template. If you upload a picture of yourself, that picture is a photograph and is handled as one. See Section 6 for how long uploads are kept.
  • Payment & Billing Details: Billing address, payment method details, and transaction identifiers (processed by Stripe).
  • Vault Transfer Information: GalaxyGrails.io may collect your PSA Vault account identifier in order to facilitate vault-to-vault transfers via PSA.
  • Transaction & Account Data: Deposits, withdrawals, buybacks, pack purchases, points earned and redeemed, monthly leaderboard rank, and referral activity.
  • Communications: Emails, live chat messages, chat reactions, and customer support interactions, including any moderation actions taken on those messages (e.g., timeouts, deletions, or bans). Live chat messages are retained in an internal archive after they scroll out of the visible chat window; see Section 6 ("Data Retention").
  • Verification Information: Stripe may request identity verification data (e.g., full legal name, date of birth, government-issued photo ID, and a live selfie for biometric comparison) for compliance with U.S. financial regulations. GalaxyGrails.io does not directly store copies of your identity documents or biometric data; this information is processed and retained by Stripe Identity.

2.2 Information Collected Automatically​

  • Device & Usage Data: IP address, browser type, operating system, device identifiers, session times, and interaction logs.
  • Usage Information: How you interact with the Services, such as pages visited, features used, time spent on pages, and other activity within GalaxyGrails.io.
  • Analytics & Advertising Technologies: Cookies, pixels, tags, and similar technologies help authenticate users, monitor security, improve performance, measure how the Services are used, and measure the effectiveness of our advertising. Some of these technologies are operated by third parties and transmit information about your activity on GalaxyGrails.io directly to them. For more detail, and to exercise your choices, see Section 7 ("Your Rights and Choices") below.

2.3 Third-Party Service Relationships​

  • Stripe: Provides payment processing, identity verification, and transaction confirmations. We may receive transaction status, verification results, and fraud signals from Stripe.
  • PSA: Our vault custodian, PSA, receives only the data necessary to facilitate vault transfers (name, PSA Vault account identifier, and order identifier). PSA does not access or store analytics, payment, or communication data.
  • Analytics Providers: Collect device and usage information about how visitors interact with the Services, as described in Section 2.2, so we can measure performance and improve the product. We use Google Analytics for this purpose.
  • Advertising Partners: We use the Meta (Facebook) Pixel to measure advertising effectiveness and to reach people who may be interested in GalaxyGrails.io. Meta receives information about your activity on our site and may use it for its own purposes. This is described in full in Section 4.1, and you can opt out at any time — see Section 7.2.
  • Infrastructure, Storage, and Error-Monitoring Providers: Host the Services, store uploaded images and card scans, and capture diagnostic information when something goes wrong.
  • Email Delivery and Email Marketing Providers: Send transactional email (verification, security codes, transaction notices) and, where you have opted in, marketing email. Our marketing email provider receives your email address for that purpose.
  • Customer Support Provider: Receives the contents of support requests you submit, including any attachments.
  • Automated Image Moderation Provider: Receives uploaded profile pictures for automated screening, as described in Section 2.1. The image is analyzed for harmful content categories and is not used to identify anyone; it is not matched against any face database, and no facial-recognition template is created or stored. This provider receives the image only, and no other account data. Under our agreement with the provider, submitted images are processed in real time and are not stored by the provider after analysis, are not used to train or improve its models, and are not made available for human review by the provider's personnel.

GalaxyGrails.io does not buy, sell, or rent personal information for monetary consideration. Our sharing of limited activity data with advertising partners, and your right to opt out of it, are described in Sections 4.1, 7.2, and 8.4.

3. How We Use Your Information​

GalaxyGrails.io uses collected information to:

  1. Operate and maintain the Services, including Pack Events, Account Funds features, vault storage, the Loyalty Program, and the live chat.
  2. Process payments and payouts, managed by Stripe using your stored billing details.
  3. Facilitate vault transfers of Items through PSA.
  4. Verify identity and prevent fraud, including KYC verification through Stripe Identity and security holds on certain transactions.
  5. Communicate with you about transactions, account updates, support issues, and (where you have opted in or are otherwise permitted) product announcements.
  6. Comply with legal requirements, including tax, AML, and recordkeeping laws.
  7. Improve the user experience, through analytics, A/B testing, and feature development.
  8. Moderate live chat and other public surfaces, including via automated profanity and link filtering, rate limiting, and admin-issued timeouts, bans, or message deletions, in order to keep the community safe and on-topic.
  9. Provide public event history, replays, fairness tools, and leaderboards, including pack-event pages, event replays, monthly points leaderboards, and fairness reports that may display your username, points balance, leaderboard rank, and pull history to other users and visitors on GalaxyGrails.io.
  10. Measure and deliver advertising, including measuring which advertising brings people to GalaxyGrails.io and reaching people who may be interested in the Services. This involves sharing limited activity data with advertising partners as described in Sections 2.3 and 4.1. You can opt out at any time — see Section 7.2.

We do not use your identity-verification data, biometric information, payment card details, vault account identifiers, or the contents of your support requests for advertising or profiling, and we do not sell personal information for money.

4. How We Share Information​

4.1 Service Providers and Advertising Partners​

Service providers process personal information only on our instructions and only for the purposes we specify. They may not use it for their own purposes. GalaxyGrails.io shares limited information with the following categories of service provider:

  • Stripe, Inc. — for payment processing, payouts, and fraud prevention. Stripe requires billing addresses for regulatory compliance.
  • PSA — for physical Item storage and vault transfers. PSA receives only the data necessary to facilitate transfers (e.g., name, PSA Vault account identifier, order identifier) and does not receive any financial or communication data. Once an Item is transferred into your own PSA Vault account, PSA's and Collectors' handling of your information is governed by the Collectors Privacy Policy rather than this Policy.
  • Hosting, Storage, and Infrastructure Providers — for secure site operation, storage of uploaded images and card scans, and performance and error monitoring.
  • Analytics Providers — for measuring how the Services are used. We use Google Analytics for this purpose; it receives device and usage information as described in Section 2.2.
  • Email Delivery and Email Marketing Providers — for sending transactional and (where you have opted in) marketing email. These providers receive your email address.
  • Customer Support Provider — for receiving and managing support requests, including any attachments you submit.
  • Automated Image Moderation Provider — for screening uploaded profile pictures. This provider receives the image only, and no other account data.
  • Randomness and Fairness Providers — for generating verifiable randomness used in the selection of Items. These providers process technical metadata only and do not receive your billing details, email address, or vault account identifier from GalaxyGrails.io.

All of the service providers above are under contractual obligations to process data only for the specified purposes and to maintain industry-standard security measures.

Advertising Partners are different, and we identify them separately because the distinction matters legally. An advertising partner is a third party, not a service provider: it receives information about your activity on GalaxyGrails.io and may use that information for its own purposes, not solely for ours.

  • Meta (Facebook) — we use the Meta Pixel to measure the effectiveness of our advertising and to reach people who may be interested in GalaxyGrails.io. The Pixel transmits information about your activity on our site to Meta, which may use it for ad measurement and audience building, including for its own purposes. The information involved is device and internet activity data — identifiers such as cookie IDs and device identifiers, and pages viewed and actions taken on GalaxyGrails.io. Under some U.S. state privacy laws this is considered "sharing" personal information for cross-context behavioral advertising, or "targeted advertising."

You can opt out of this sharing at any time — see Section 7.2 ("Your Privacy Choices"). Opting out prevents these technologies from loading at all.

Note that Google Analytics, listed above, is used as an analytics service provider rather than an advertising partner: we have disabled its advertising and ad-personalization features, so it is not used to build advertising audiences.

GalaxyGrails.io may disclose data:

  • To comply with applicable laws, subpoenas, or government requests;
  • To enforce our Terms of Service and prevent fraud or abuse;
  • To protect the rights, property, or safety of GalaxyGrails.io or its users.

4.3 Business Transfers​

In case of a merger, acquisition, or asset sale, user data may transfer as part of the transaction. Any successor entity will remain bound by this Privacy Policy.

4.4 Referred Users​

If you refer another user through our referral program, your referral dashboard displays limited information about users who signed up through your referral link — their username, the date they joined, and the commissions their qualifying activity has generated for you — so you can track your referral earnings. Likewise, if you sign up through someone else's referral link, that referrer can see this limited information about your account.

GalaxyGrails.io does not sell personal information for money. We do share limited activity data with advertising partners for cross-context behavioral advertising as described in Section 4.1, which some state laws classify as "sharing" or "targeted advertising." You can opt out — see Section 7.2.

5. Data Security​

GalaxyGrails.io employs robust technical, administrative, and physical safeguards, including:

  • Encryption of data in transit and at rest;
  • Tokenization of payment information by Stripe (GalaxyGrails.io never stores full card data);
  • Encrypted storage of billing addresses and vault account identifiers;
  • Role-based access control and security monitoring;
  • Ongoing security monitoring and review.

While no online system is completely secure, GalaxyGrails.io follows industry best practices to minimize risk.

6. Data Retention​

GalaxyGrails.io retains personal information only as long as necessary to:

  • Provide and maintain your account and Services;
  • Satisfy legal and financial recordkeeping obligations;
  • Prevent fraud or abuse;
  • Resolve disputes and enforce agreements.

Where a retention period applies and expires, data is securely deleted or anonymized.

Profile picture uploads. An image awaiting automated screening is held privately and is not visible to other users. Approved images become your profile picture and are retained until you replace or remove them, or your account is erased. Rejected and canceled uploads are deleted.

Live chat. The visible chat window shows only the most recent messages, but messages you post are also written to an internal archive used for moderation, dispute resolution, fraud prevention, and product analytics. Archived messages are retained for up to two (2) years from the date they are posted and are then deleted, except where a longer retention is required by law or by an active dispute or investigation. Messages removed by a moderator remain in the archive with a record of the removal. If your account is erased, your username is detached from your archived messages, but the message text itself is retained — see Section 7.7.

7. Your Rights and Choices​

7.1 Email Preferences​

Every marketing email links to an email preference center where you can control what we send you. You can adjust individual topics — product updates, show alerts, and lifecycle messages — or unsubscribe from all marketing email at once. You may optionally tell us why you unsubscribed; that is never required.

The link in an email works without signing in, so an unsubscribe link remains usable long after the message was sent. You can also unsubscribe by contacting [email protected].

Even if you opt out of marketing email, we may still send transactional communications regarding your account, purchases, vault transfers, security codes, or support requests. These are not marketing and cannot be unsubscribed from while your account is open.

GalaxyGrails.io uses the following categories of cookies:

  • Essential / Strictly Necessary: Required for the Services to function and cannot be disabled. These include your session and authentication cookies, and a trusted-device cookie set for up to 30 days when you choose to remember a device for two-factor authentication.
  • Functional: Enable features like saved preferences, including a referral cookie that records the referral code you arrived with (up to 7 days) so we can credit the referring user if you sign up, and a marketing-attribution cookie that records the campaign source you first arrived from (up to 30 days). Disabling these may impact some functionality.
  • Analytics / Performance: Collect usage data to improve the Services. These can be disabled in your browser settings.
  • Marketing / Advertising: Set by our advertising partners to measure advertising effectiveness and to reach people who may be interested in the Services. These are the technologies described in Section 4.1 under "Advertising Partners."

Your Privacy Choices — opting out of targeted advertising. You may opt out of the sharing of your personal information for targeted advertising at any time, at no cost, and without any effect on your access to the Services:

  • Use the Your Privacy Choices page. Your choice is stored on the device and browser you use to make it, so repeat it on each browser you use, and again if you clear your cookies.
  • Or send a request to [email protected] with the subject line "Do Not Sell or Share My Personal Information."
  • Or send an opt-out preference signal such as Global Privacy Control — see Section 7.5. We honor these automatically, so no further action is needed.

You may also control these technologies through your browser settings, and through the advertising controls that Google and Meta provide directly.

7.3 Public Profile Visibility​

Your profile is public by default. You can turn on private profile in your account settings at any time to hide your collection value, card count, points balance, and leaderboard rank from other users, and to remove yourself from the public monthly leaderboard. Note that a private profile does not hide your username where it forms part of a public or shared record — live chat, mentions, recent-pull feeds, break queues, card ownership history, and event fairness reports. See the Account & Security guide for the full breakdown.

7.4 Do Not Track​

As of the Effective Date, there is no commonly accepted standard response to Do Not Track (DNT) signals. GalaxyGrails.io does not currently respond to DNT signals.

7.5 Global Privacy Control (GPC)​

GalaxyGrails.io honors opt-out preference signals, including Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a request to opt out of the sharing of your personal information for targeted advertising, and we apply it automatically to that browser without requiring you to do anything else. Because the signal is browser-based, it applies to the browser that sends it rather than to your account as a whole.

For more information, visit globalprivacycontrol.org.

7.6 State-Specific Rights​

Depending on your state of residence, you may have additional rights to access, correct, delete, or appeal regarding your personal information. See Section 8 ("U.S. State Privacy Rights") below for the full list and instructions on how to exercise these rights. For account closure specifically, see Section 7.7 below or the Account Management guide.

7.7 Account Closure and Right to Erasure​

You may request closure of your account and deletion of your personal information at any time by emailing [email protected] with the subject line "Account Closure Request" or "Data Deletion Request." Before we can process the request, you must withdraw your Account Funds balance in full, accept the buyback or request a vault transfer of any cards remaining in vault custody under your account, allow any in-flight vault transfer or withdrawal to complete, and resolve any pending disputes.

Once these prerequisites are complete, an authorized GalaxyGrails.io administrator will process the erasure. We will:

  • Remove or scramble identifying personal information associated with your account (including your name, email, username, password hash, profile picture, referral code, and identity-verification session identifier);
  • Cancel any profile picture still awaiting moderation and delete the uploaded file;
  • Clear your marketing preferences and suppress your profile with our email marketing provider, so you are removed from future sends;
  • Revoke all active sessions and refresh tokens; and
  • Mark your account as deleted on our systems.

Retained records. Certain information is retained for legal, financial, anti-fraud, and tax compliance purposes even after an erasure, including: financial transactions (deposits, withdrawals, buybacks, refunds, disputes, balance ledger entries), pull and event participation history, vault transfer records, chat messages and chat moderation logs, identity-verification status, and Stripe customer/account identifiers. These records are retained under a legal-obligation basis for the periods required by applicable law (typically 5–7 years for tax records, longer where required by AML or anti-fraud rules). Where retention is required, the underlying user identifier remains stable so the record can still be reconciled, but personally-identifying fields are scrubbed.

Limits on erasure in free-text content. Some retained records contain text that we do not rewrite. Your archived chat messages are retained with your username removed, but the message text itself is preserved as posted. Transaction descriptions and messages posted by other users may also refer to you by name. We do not scan or edit the contents of these records as part of an erasure request. If you believe a specific retained record contains personal information that should be removed, contact [email protected] and we will review it individually.

Stripe Identity data. Identity verification documents (government ID, selfie, biometric data) are processed and retained by Stripe Identity, not by GalaxyGrails.io, and are governed by Stripe's data-handling practices. To request deletion of verification data held by Stripe, you may contact Stripe directly at [email protected] in addition to your request to us.

8. U.S. State Privacy Rights​

The following disclosures apply to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

8.1 Categories of Personal Information Collected​

See Section 2 ("Information We Collect") for a full description. Categories include: identifiers (name, email, address, account credentials); commercial information (transaction, purchase, points, and leaderboard history); device and internet activity information; financial information (processed by Stripe); biometric and identity-verification information (processed by Stripe Identity); sensitive personal information as defined by California law (e.g., account login credentials and payment-card information, processed in connection with operating the Services and not used for any other purpose); and user-generated content (live chat messages and moderation history).

Personal information is retained for the periods described in Section 6 and Section 8.3, disclosed for a business purpose to the categories of service providers listed in Section 4.1, and shared for cross-context behavioral advertising as described in Section 8.4.

8.2 Purposes for Collection​

See Section 3 ("How We Use Your Information") for the business and operational purposes for which we collect personal information.

8.3 Retention​

GalaxyGrails.io retains personal information for the period necessary to fulfill the purposes described in this Policy, unless a longer period is required by law. We may be required to retain certain data after our relationship with you ends to satisfy legal or regulatory obligations.

8.4 Sale and Targeted Advertising​

GalaxyGrails.io does not sell personal information for monetary consideration.

GalaxyGrails.io does share personal information for cross-context behavioral advertising (referred to in some state laws as targeted advertising). The categories shared are device and internet activity information — identifiers such as cookie IDs and device identifiers, and information about pages viewed and actions taken on GalaxyGrails.io. The categories of recipients are our advertising partners, identified in Section 4.1. We do not share sensitive personal information, identity-verification or biometric data, payment card details, or support-request contents for this purpose.

You have the right to opt out of this sharing, and we will not discriminate against you for exercising it. See Section 7.2 ("Your Privacy Choices") for the ways to opt out, including the Your Privacy Choices page and Global Privacy Control.

We do not knowingly sell or share the personal information of consumers under 16 years of age. The Services are limited to users 18 and older.

8.5 Your State Law Rights​

You may have the right to:

  • Access / Know: Confirm whether we process your personal information and request access to specific pieces we hold about you.
  • Correct: Request correction of inaccurate personal information.
  • Delete: Request deletion of personal information we have collected from you. Note that exercising this right may affect our ability to provide certain Services.
  • Portability: Request a copy of the personal information you provided to us in a portable and, where technically feasible, readily usable format.
  • Opt-Out of Sale / Sharing / Targeted Advertising: Direct us to stop sharing your personal information for cross-context behavioral or targeted advertising. Use the Your Privacy Choices page, send a Global Privacy Control signal, or email us — see Section 7.2. We do not sell personal information for money, so no opt-out is needed for that.
  • Appeal: If your request is denied, you may appeal by contacting [email protected] and including "Privacy Request Appeal" in the subject line.

We will not discriminate against you for exercising any of the above rights.

8.6 How to Exercise Your Rights​

Submit a request by emailing [email protected] with the subject line "Privacy Rights Request." We may require you to provide your name, contact information, and other details to verify your identity before fulfilling a request. We do not require identity verification for requests to opt out of the sharing of personal information for targeted advertising — those are honored as described in Section 7.2.

9. Children's Privacy​

GalaxyGrails.io is intended solely for users 18 years of age or older. If you are under 18, you may not use the Services. We do not knowingly collect personal information from individuals under 18. If you believe a minor has submitted personal information to us, please contact [email protected] and we will promptly delete it.

10. Notice of Monitoring​

GalaxyGrails.io and its service providers may monitor activity on the Services for security, fraud prevention, and operational purposes. This may include logging pages visited, features used, items clicked, session duration, and other interactions. Cookies and similar technologies described in this Policy may also capture this information. By using the Services, you acknowledge and consent to this monitoring. If you do not consent, please discontinue use of the Services.

GalaxyGrails.io may link to third-party services such as Stripe and PSA. These websites operate independently and are subject to their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of any third-party site.

12. Updates to This Policy​

GalaxyGrails.io may update this Privacy Policy from time to time and will post any revisions on this page. The Effective Date at the top of this Policy reflects the most recent update. If material changes occur, GalaxyGrails.io will use reasonable efforts to notify users via email or a notice on the website. Continued use of the Services after an update constitutes your acceptance of the revised Policy.

13. Contact Us​

Email: [email protected]
Mail: GalaxyGrails.io LLC
16192 Coastal Highway
Lewes, DE US