Privacy Policy

At a glance

• We collect what we need to run your account. That is your sign-in details, what you buy, list and hold, your shipping details when you ship, payment records, and technical data such as your IP address and browser.
• We never see or store your full card number. Card details go from your browser to our payment processor.
• We do not sell your personal information. We do not share it so that other companies can show you ads on other sites. Google Ads is our only advertising partner: we measure successful card payments, except payments for shipping alone. No other advertising partner's cookies, pixels or scripts run.
• We count visits with Google Analytics. It does not run if you opt out, if your browser sends Global Privacy Control, or while you are signed in to an account that opted out. In the European Economic Area, the United Kingdom and Switzerland it runs only after you press Accept.
• We may send you news and offers. You can opt out at any time. No tracking pixels in our emails.
• We do not use your personal information to train AI models.
• Some things are public. Your handle appears on pages you choose to share. Your handle, activity score, rank and collector level also appear in the rankings for signed-in collectors. A card you list for sale shows as "From a collector," never with your name. Section 4 says what is public and how to change your handle.
• You can ask for a copy of your information, a correction, or a deletion, and you can opt out of sale and sharing. We take these requests from every collector, wherever you live. Use the contact form and choose "Privacy request." Section 10 explains how.
• If you ship a card, your name, address and phone number go to the partners who hold and ship it. Section 6 explains who they are in plain words.

1. About this policy

1.1 Who we are. This policy covers Grailday at grailday.com (our "site"). Our mailing address is Grailday, 30 N Gould St #54815, Sheridan, WY 82801, USA. "We" and "us" mean Grailday. We decide why and how the personal information in this policy is used. In privacy law, that makes us the "controller" or the "business."

1.2 What it covers. Every page of the site: packs, the Market, your store credit, your Vault, your account, the sign-in box, the checkout box, the Market and the policy pages. It also covers the emails we send, the contact form, our support phone line, the referral links and ad links that lead to the site, and the internal console our team uses to look after your account.

1.3 What it does not cover.

• Other companies' own sites and pages that you reach from ours (section 16).
• What our partners do with information after we pass it on (section 6.7).
• Our team, job applicants and business contacts. They have their own notices.
• Pages we run on other platforms, such as social media pages. Those platforms' rules apply there.

1.4 How this policy fits with our other pages. The Terms point to this policy for how we handle your information. The Cookie Policy lists every cookie and browser-storage entry. The Refund Policy, Shipping Policy and Pack Terms cover money and shipping. If two of these pages differ about personal information, this policy controls. If they differ about which cookies we use, the Cookie Policy controls.

1.5 This is a notice, not a consent form. We do not treat your use of the site as your agreement to a use of your information that the law says needs your consent. Where the law asks for your consent, we ask for it on its own. The cookie prompt in section 7.3 is one example. There is no box to tick for this policy. We ask you to read it.

1.6 Dates. The date at the top is the day we last changed this policy. We review it at least once every 12 months.

2. What we collect

We collect what a part of the site needs. The lists below say what, and when.

2.1 When you sign in

• Your sign-in details. You sign in through our sign-in provider, with a one-time code sent to your email or phone, or with a sign-in provider. The provider confirms to us the email address you used. If you chose a sign-in provider, it is the email address of that account, and we use nothing else from it. If you signed in by phone, we may have no email address for you. In that case we make a stand-in address that we never send mail to. You can add a real email address on your Account page.
• Your phone number stays with the provider. If you sign in by phone, our sign-in provider keeps the number.
• An account ID and a sign-in label. The provider gives us an ID for your account. We also keep a label that says how you signed in, such as email, phone or a sign-in provider.
• A second account identifier. Our sign-in provider also creates an account record for you. It holds nothing, and we don't use it for payments. We keep its identifier with your account record.
• The Terms you agreed to. When you first sign up, we record which version of the Terms applied and the time. When you pay for an order or make a card payment, we record the version again with your IP address (2.4).
• Where you signed up. The country and state or region your IP address indicates.
• When you last signed in.

We do not use passwords, and we do not ask for your date of birth.

2.2 What you set up in your account

• Your public handle (section 4).
• An email address, if you add one.
• Purchase controls and account closures you choose in Account. We keep a record of each so we can apply it. See 5.8.
• Your privacy choices. If you opt out while signed in, we save the choice on your account.

2.3 Packs, cards and your store credit

• The packs you open and the cards you get. For each card: its name, grade and details, and the offer price locked when you opened it.
• What you sell to Grailday, what you buy on the Market or in our shop, and what you ship.
• Cards you list for sale. If you list a card from your packs on the Market, we keep the card, your asking price, when the listing starts and ends, and, when it sells, what you were paid after our fee.
• Your store credit: credit from card payments, offer money, sale proceeds and promo credit, and each change to them.
• Your activity score.
• Your Vault record. It says which cards are held for you. The partners hold the real cards. We keep the record that links each card to your account.
• A referral code, if you use one. When you press Redeem we record the code, your account, the time and your IP address.
• What you do after you pay. For card disputes, we note the first time in a session that you view an opened pack, each time you view your Vault (at most once an hour in a session), once for each card that you sell to Grailday, and once for each shipment that you ask for. Each note has the time, your IP address and your browser. See 2.4.

2.4 Payments

• Card details go to the processor, not to us. You type your card into a form that belongs to our payment processor ("the processor"). We never see or store your full card number or security code. Depending on your card or payment method, the processor's form may also ask for your name, postal code, country or other details. The processor collects those. The form can also offer Apple Pay or Google Pay and the processor's one-click service, which have their own accounts, terms and privacy notices.
• Saved cards. When you type a card into our card form and press Pay, the processor saves it for your next payment and shows it to you again, as the line under the Pay button says. You can remove it in the card form. The processor holds the saved card, not us. We keep only the reference to your customer record there, which is made the first time you pay.
• What we keep for each payment. The amount, the time, the processor's reference for it, what you bought, the version and text of the Terms and Refund Policy you saw, the exact line shown beside the pay button, your store credit and card shares, the card brand, the last four digits, the card type, whether a phone-based payment method was used, a card fingerprint (a code that tells us two payments used the same card, without the number), the text on your statement, and the processor's receipt number when it has one.
• Dispute evidence. For every payment we also keep your IP address, browser, language, your signed-in session, and the approximate place your connection came from (country, region, city, time zone and network provider). We keep the activity notes from 2.3 as well. If you or your bank question a payment, the card networks ask for these facts. In your account records we do not keep your billing address, your card's security-code or postcode checks, or a device fingerprint. If a payment is disputed, we read them from the processor at that time and they go into the evidence for that dispute (6.4).
• Your billing name. If you give a name to the processor's own payment form, we may copy it onto your customer record at the processor, once, when that record has no name.
• What we send the processor is in section 6.2.

2.5 Shipping

• The name, address and phone number you type on the shipping form, including the state, province or region. We do not ask for an email address for a shipment, and we never send your email address to the shipping partner.
• Which cards are in the parcel, the price quote, the carrier and service, the tracking number, and the status of the shipment.
• If you ship to someone else, you give us their details. Give us only details you have the right to give.

2.6 Messages and support

• The contact form. Your name, email address, topic and message, the IP address and browser it came from, and your account if you were signed in. We keep our replies.
• Privacy requests. What you tell us, how we confirmed it was you, and what we did.
• Phone calls. Our support line may be answered by our team or by a company that works for us. If you call, we may note the call and what you tell us, and the call may be recorded.

2.7 Technical data and marketing source

• Your connection. Your IP address and browser details. We record these for each sign-in, and our servers log the pages requested and errors.
• Approximate place only. The country and region your IP address indicates. We never take precise location, such as GPS or nearby Wi-Fi.
• Where you came from. If you arrive from a link or ad that carries campaign tags or an ad click ID, a cookie remembers them, along with the page you landed on and the site you came from. We call it the where-you-came-from cookie. When you sign up, we copy what it holds into your account record, with the IP address and browser you signed up with and whether you had opted out. Inside our own systems we note five moments against that record, with the amount where one applies: sign-up,a card payment, your first pack, an accepted offer and a shipment. We use this to learn which links and ads bring collectors. We use Google's ad click IDs and their capture time for ad measurement (section 7.3). In the European Economic Area, the United Kingdom and Switzerland, we set the cookie, and copy its tags to your account, only after you press Accept on the cookie prompt. The IP address and browser you signed up with are still kept in your account record. The Cookie Policy says exactly what the cookie holds.
• Cookies, browser storage and analytics. Section 7 and the Cookie Policy.
• Your answer on the cookie prompt. In the European Economic Area, the United Kingdom and Switzerland, we count the answer: which button, which version of the prompt, the country the request came from, and the time. We do not keep your IP address, your device details or your account with that count.

2.8 Our emails to you

We keep a copy of each email we send you, with the time and whether it was delivered or bounced, when the email provider tells us.

2.9 What we do not collect

• No password. No date of birth, except the one that comes back with an ID check result.
• No full card number and no card security code.
• No precise location.
• No photo of you, no scan of your ID and no face data.
• No health, race, religion, sexual life, union membership or similar information.
• No contacts, camera, microphone or files from your device.

2.10 If you do not give us the information

• You cannot open an account without a sign-in method.
• You cannot ship a card without a name, address and phone number for the shipment.
• You cannot pay without giving the processor the details it asks for.
• You can look at packs and the policy pages without an account.
• If you block optional cookies, the site still works. If you block the cookies it needs, you cannot sign in (see the Cookie Policy).

3. Where else information comes from

Besides you and your browser, we get information from these sources.

• Our sign-in provider. The email address you signed in with, how you signed in, your account ID and the second account identifier described in 2.1.
• The payment processor. Whether a payment worked, the card brand, last four digits, card type and fingerprint, any name you gave its form, its receipt number, refunds, and notices of disputes, with the reason the bank gave.
• Our shipping and card partners. The check of your address, price quotes, tracking numbers, delivery status, and the status of the cards held for you.
• Google Analytics. Reports about visits to the site. Google gives us summaries, not lists of people.
• Our team. Notes our staff add when they help you, such as a ticket or a record of a dispute.
• Other collectors or creators. If you use a creator's referral code, we learn which code you used.

We do not buy lists or profiles about you from data sellers.

4. What other people can see

4.1 Your handle, activity score and the signed-in rankings. Every account gets a public handle the first time one is needed. We make it from two words and four digits. The rankings are available only to signed-in collectors. It shows the top 100 handles for the week and month, with activity score, rank and lifetime collector level. Signed-out visitors and search engines cannot open it. It never shows your name, email address or account ID. You can change your handle in Account to a name of 3 to 20 letters, digits or underscores that nobody else uses. Pick a name that does not identify you. Only active accounts are ranked.

4.2 Share pages. When you press Share on a card you got, we make a public page for it. Its address has a unique code. The page shows the card, the pack it came from, when it was opened and your handle ("A Grailday collector" if you have none). It never shows your name, email address or account ID. Anyone who has the link can open it. It asks search engines not to list it. It stays after you sell the card to Grailday or ship it. To have a share page removed, send a "Privacy request" through the contact form.

4.3 Cards you list on the Market. A card you list shows on the Market for anyone to see, with its photos, grade and your price, and the line "From a collector." It never shows your name, handle, email address or account ID. The buyer sees the card, not you. A listing stays public until the card sells, you cancel the listing, or it ends (if the card's own deadline ends it, or if you sell the card to Grailday or ship it).

4.4 Latest opens. The strips on the home page and pack pages show recent real openings. They show the card and the pack, never who opened it.

4.5 Nothing else. Other collectors cannot see your store credit, address, email address or purchases. They cannot see your cards, except a card you list or share.

5. How we use it

5.1 What we use it for.

• To sign you in, keep you signed in and run your account.
• To take payments, keep your store credit, send receipts, make refunds, and answer card disputes.
• To open packs, show you the card, and keep your Vault, accepted offers, Market and shop purchases.
• To run your Market listings, pay your sale proceeds into your store credit, and tell you when a listing sells.
• To ship your cards, which means passing your details to the partners and carriers.
• To run activity scores, handles, collector levels, the signed-in rankings and referral codes.
• When you are signed in, your home page orders games, packs, Market cards and recent opens by the games you bought on Grailday, using only your own purchases on Grailday. We buy nothing from anyone and share nothing with anyone for this ordering. We do not use it for ads or for any decision with legal or similarly significant effects. If you want the standard order, ask support through the contact form.
• To keep the site safe: to spot fraud, bots, abuse and stolen cards, to limit repeated requests, and to look into security problems.
• To follow the law and card-network rules, and to keep records for tax and accounting.
• To answer your messages and your privacy requests.
• To send emails about your account: a welcome note, receipts, refund notices, notices of Market and shop purchases, a notice when a card you listed sells, shipping notices, a notice 24 hours before a offer window closes, notices about purchase limits, pauses and account closure, closing and card disputes, a note that we received your message, and replies to your messages.
• To count visits, learn which links and ads bring collectors, find problems and improve the site.
• To run our business: to check our records against our partners' and the processor's, to settle what we owe our card partners, and to produce reports.
• To protect our rights, enforce our Terms, and take part in legal claims.

5.2 Only what we need. We collect and keep only what the uses above need. We do not use your information for a purpose very different from these without telling you first. Where the law needs your consent for a new use, we ask.

5.3 Law, tax and payment rules. We may use and keep your information to meet laws on payments, tax and sanctions, and the rules of card networks and banks.

5.4 Automated decisions.

• Pack results. The system of our card partner allocates which card a pack holds. We do not choose it, and we do not change it based on who you are. The Card tiers page and the Pack Terms explain how it works.
• Fraud and abuse rules. Some rules run on their own. They can decline a payment, or hold a request or a shipment for a person to review.
• People decide holds, bans and closures. Our team puts an account on hold, bans it or closes it. No system does it alone.
• If a rule stops you. If you think an automatic rule stopped something by mistake, send us a message through the contact form. A person will take a second look.
• The only profiling we do is this home ordering, based on your own purchases on Grailday (5.1).

5.5 AI. We do not use your personal information to train AI models, and we do not give it to others to train theirs. No AI system decides on its own what happens to your account or your money. If we use an AI tool to suggest an action, a person approves it. Our team may also use AI tools to help look after the site.

5.6 De-identified information. We may make and use information that no longer identifies you, and combine it with other collectors' information to look at trends. We keep it de-identified. We do not try to identify you from it. We require anyone we give it to do the same.

5.7 Marketing. We may send you news and offers by email. You can opt out at any time. We send marketing texts only if you agree to get them. We buy ads on other sites, but we do not upload your information to any ad company to find or target you.

5.8 Limits, pauses and closing. We keep a record of purchase limits, pauses and account closures you set. We use it to apply them and for nothing else. We do not share it with anyone outside the companies in section 6 that help us run the site.

6. Who we share it with

6.1 We do not sell it. We do not sell your personal information, whether for money or for any other value. We do not share it with other companies so that they can show you ads on other sites. Privacy laws call that "sharing," "cross-context behavioral advertising" or "targeted advertising." Section 11 gives the details for the last 12 months.

6.2 Companies that help us run Grailday. Each gets only what it needs for its job.

6.3 What those companies may do with it. Some of these companies act only on our instructions. Others, such as the payment processor, also use part of the information for their own purposes under their own privacy notices: for fraud prevention, legal duties and improving their services. Google does so as its page says. For the privacy notice of the payment processor or any other company in the table, send a "Privacy request" through the contact form and we will send you its link.

6.4 Law, safety and claims. We share information when the law requires it, for example with a court, a regulator, a tax authority or the police. We also share it when we think it is needed to stop fraud or a security attack, to protect someone's safety, to protect our rights or property, to enforce our Terms, or to answer a claim. In a card dispute, we share evidence with the processor, your bank and the card network: the payment facts in 2.4, the activity notes in 2.3, copies of our emails to you, the name, email address and billing address the processor reports for the payment and, for a shipment, its address, carrier and tracking number. When the law allows it, we try to tell you first.

6.5 If the business changes hands. If we merge with another company, are bought, sell some or all of our assets, or go through a reorganization or bankruptcy, your information may move to the new owner. We will tell you before your information is held under different privacy terms.

6.6 Group companies. Grailday is run by one company. We do not pass your information to other companies in a group for their own use.

6.7 What our partners keep. The partners who hold and ship cards run their own systems. They keep what we give them, such as the address a shipment went to, and they use it under their own notices and for their own legal duties. Their own notices, not this one, say what they do with it. To find out who holds your shipping details and how to reach them, send a "Privacy request" through the contact form.

6.8 Public places and other collectors. What other people can see is in section 4. We do not tell a buyer who a seller is, or a seller who a buyer is.

6.9 At your direction. If you ask us to send your information to someone, for example through an agent you have authorized (10.6), we will, once we have confirmed it is you.

7. Cookies, analytics and similar tools

7.1 Cookies. We set a few cookies to run the site. They keep you signed in, protect forms and payments, remember settings and remember which link brought you here. A cookie is a small file your browser keeps for a site. "Browser storage" is a similar space your browser gives a site. A pixel or beacon is a tiny request a page makes so that a visit can be counted. Cookies we set ourselves are first-party cookies. Cookies set by tools from other companies on our pages, such as the payment processor's or Google's, are third-party cookies in the way privacy laws use the term. Some last only until you close the tab (session cookies); others last a set time (persistent cookies). The Cookie Policy lists every cookie and every browser-storage entry, who sets it and how long it lasts. It shows them in tables built from the site's own list of what the site sets, so the list stays in step with the site. This section gives the privacy side.

Cookies

Browser storage

7.2 Kinds.

• Needed to run the site. Sign-in, form protection, the return from a payment page. We set these without asking.
• Remember something you did. Your opt-out, a creator code you followed, your answer on the cookie prompt, a banner you closed, your sound setting.
• Where you came from. The where-you-came-from cookie (2.7). In the European Economic Area, the United Kingdom and Switzerland, we set it only after you press Accept.
• Counts visits. Google Analytics (7.3).

7.3 Google Analytics. We use it to count visits, to see which pages people use and to learn which of our ads and links bring people here. It sets the cookies the Cookie Policy lists under Analytics and Advertising. When a page with the tag loads, Google receives:

• the page you opened, as an address without its query part, except for campaign tags and Google's own ad click IDs (the address of a pack or card page includes its reference number);
• the page you came from (for a page on our site, only our site's address);
• the link or ad that brought you;
• your browser and device details;
• your IP address, from which it works out your approximate location; and
• a unique ID kept in its cookies.

Google receives product names, prices and order references for pack and Market purchases. For ad measurement, we report successful card payments and the amount charged, except payments for shipping alone. We also send Google's click IDs and their capture time. With your ad consent, we send a one-way code made from your email and, if you gave us a phone number, a code made from that number. These codes do not make the information anonymous. We do not send your plain email, plain phone number, name or account ID in these events. We have turned off Google signals and ad personalization for this property. We treat Google as our service provider for this use. Google uses what it collects as its own policy describes: How Google uses information from sites or apps that use our services.

Google Analytics does not run:

• for a browser that sends Global Privacy Control;
• for a browser where you opted out on the choices page;
• while you are signed in to an account that opted out, in any browser;
• on the sign-in pages, the choices page, the pages where you set account limits or close your account, and the shipping pages; and
• on our staff pages.

It does run on most other pages, including the account, store credit and Vault pages you see when you are signed in.

The cookie prompt. In the European Economic Area, the United Kingdom and Switzerland, or when we cannot tell where you are, a small prompt asks you first. Google Analytics loads only after you press Accept, and Google loads nothing before that. If you press Reject, it stays off, and we delete any Google Analytics cookies your browser holds. The prompt never blocks the site. The footer button "Cookie settings" opens it again, so you can change your answer at any time. Visitors in Guernsey, Jersey and the Isle of Man are treated like visitors in the United Kingdom. We count each answer (2.7).

7.4 The visit counter. The service that runs our site adds a small counter to our pages. It measures how many visits a page gets and how fast pages load. It sets no cookie and writes nothing to your browser's storage. It runs for every visitor, including those who opted out, because it does not follow individuals.

7.5 Fraud and bot checks. Fraud and bot checks run on payment and some forms.

7.6 Sign-in. Our sign-in provider's code loads when you start to sign in. It keeps your sign-in with the provider in your browser. Fraud and bot checks run on payment and some forms.

7.7 Do Not Track. Browsers' "Do Not Track" signal has no agreed standard, so we do not act on it. We do act on Global Privacy Control.

7.8 Global Privacy Control and the opt-out. If your browser sends the Global Privacy Control signal, we treat it as an opt-out for that browser, with nothing more to do. If you are signed in when it arrives, we also save the opt-out on your account. On the choices page you can opt out by hand. It is one decision: Google Analytics and Google Ads stop in that browser. If you are signed in when you choose, the choice is saved on your account and applies in every browser where you sign in. The choice does not stop the cookies the site needs, the visit counter, the processor's fraud checks, or the where-you-came-from cookie. That cookie keeps only the campaign tags or ad click ID of the link you arrived on, the first page you opened, the name of the site you came from and the time. It is read by us alone, and goes to no one. In the European Economic Area, the United Kingdom and Switzerland it waits for Accept.

7.9 Our emails. Our emails carry no tracking pixel and no click-tracking links. The pictures in them load from our own site.

7.10 What we do not use. No social-media plug-ins. No session-replay tool. No chat widget. No device fingerprinting for ads. No advertising IDs. We have no mobile app.

8. How long we keep it

8.1 How we decide. We keep information for as long as we need it for the reason we collected it. Then we look at the law (tax, accounting, card-network and consumer rules), how long a bank can raise a dispute, whether the information is needed to keep the site safe, whether we must keep your choices (such as a closed account) in force, and whether you asked us to delete it.

8.2 The periods.

8.3 The ledger never changes. Our record of money moving in and out of your store credit is a ledger. Entries are added. They are never edited. We keep them for the period in the table above. When you ask us to delete your information, we take your identity off the surrounding records and keep the entries (9.4).

8.4 Anonymous data. Information that no longer identifies anyone can be kept as long as we like.

9. Closing your account and deleting your information

9.1 Two different things. Closing your account stops you signing in. Deleting your information removes your personal details from our records. Closing does not delete anything by itself.

9.2 Closing. Use "Close my account" in Account settings. It closes your account for good and ends every session. You cannot sign in afterwards. Your cards stay in your Vault. To have one shipped, use the contact form. You can also choose a timed account closure in Account. A closed account stays closed for at least 180 days. It cannot end early. After it ends you can sign in again, but the Market and the rankings wait until you ask through the contact form and we confirm it is you. Account controls stay in force. We keep your records as section 8 says.

9.3 Your store credit, promo credit and activity score.

• Your store credit has no cash value and we do not pay it out.
• Unspent credit from card payments can go back to your payment method if you ask through the contact form within 30 days of the payment. The Refund Policy says more.
• Offer money and sale proceeds stay in your store credit. Promo credit is never refunded. Activity units have no cash value.
• If you close your account, your store credit stays on it, and the 30-day refund rule above still applies.
• If we close your account and it is not your fault, we give you 14 days' notice. We refund unspent credit from card payments to your card. Offer money stays on the account, and you can use it if you ask us to reopen the account.
• If we close your account for fraud or for breaking the Terms, we may keep your store credit after taking what you owe us.
• If we ever shut Grailday down, we will give notice, a way to ship your cards home, and a refund of unspent credit from card payments to your card.
• In every case, your cards stay in your Vault.

9.4 Deleting your information. Send a "Privacy request" through the contact form and say you want your information deleted. We confirm it is you (10.4). Then:

• We can delete when there is no open card dispute, your Vault holds no card, and your store credit is zero. If any of these is not true, we tell you what is left, so you can accept a Grailday offer for it or ship your cards, use or ask for a refund of your store credit, and ask us again. If you still want your information deleted while you hold cards, you can give them up in writing ("I give up these cards"), and a member of our management must approve it.
• We replace your email address with a stand-in address, blank any date of birth, redact your shipping addresses and phone numbers, redact your messages to us (name, email address, text, IP address and browser), remove the IP addresses and browser details from your marketing-source record, end all your sessions, and give your account a new generated handle.
• We keep the ledger, purchases, cards and approval records. They carry your account ID but no longer your name, email address or address.
• We also keep, for the periods in section 8, the payment evidence in 2.4, the activity notes in 2.3 and the copies of the emails we sent you. These still carry your account ID, and the evidence includes your IP address and browser. They stay because a bank can raise a card dispute months later (9.5). When their period ends, we remove the details that identify you.
• We ask the partners who hold your shipping details to delete or anonymize them, our sign-in provider to delete your account with it, and our payment processor to review what it holds about you, saved cards included. They decide what they must keep. We tell you what each says.
• Time: see 10.5.

9.5 What we may keep. Even after deletion, we keep what the law or a card network requires, what we need for a dispute or a legal claim, what we need to stop fraud, the ledger (8.3), and the record of a limit, pause or closure. We keep these for the shortest time that fits the reason. Deleted data can stay in backups until they expire (8.2).

9.6 What you can do yourself. On your Account page you can change your handle, add an email address if you signed up without one, set account limits or close your account. On the choices page you can opt out. There is no download button or delete button yet. For a copy or a deletion, send a request (section 10).

10. Your choices and your rights

10.1 What you can do yourself.

• Change your handle, add an email address if you signed up without one, set account limits or close your account, on your Account page.
• Opt out of Google Analytics and of sale and sharing, on Do Not Sell or Share My Personal Information, or by sending Global Privacy Control.
• In the European Economic Area, the United Kingdom and Switzerland, change your answer on the cookie prompt with "Cookie settings" in the footer.
• Block or delete cookies in your browser (see the Cookie Policy).
• Use Google's own opt-out for Analytics, the Google Analytics opt-out add-on, in browsers that support it.
• Cancel a Market listing, and ask us to remove a share page (4.2).

10.2 Your rights. Depending on where you live, the law may give you these rights. We give them to every collector, wherever you live, so far as we can.

• Know and access. To be told what we hold about you, to get a copy and, where the law gives that right, to be told which companies received it.
• Correct. To have wrong information fixed.
• Delete. To have your information deleted (9.4).
• Portability. To get your information in a file you can reuse.
• Opt out of sale, sharing and targeted advertising (we do none, and the opt-out is open anyway).
• Limit the use of sensitive information (we use none beyond what the law permits, so there is nothing to limit).
• Object, restrict, and revoke consent, for visitors in the European Economic Area, the United Kingdom and Switzerland (section 13).
• Not be treated worse for using these rights (10.8).
• Appeal a refusal (10.7).

10.3 How to ask.

• Contact form. The contact form, topic "Privacy request." This is our main route. If you are signed in, the form links your message to your account, which helps us confirm it is you.
• Phone. Our support line. Its number is on the Contact page. It is not toll-free. If we cannot take your request over the phone, we will help you send it through the contact form.

Tell us what you want (a copy, a correction, a deletion, an opt-out, a removal) and, for a correction, what is wrong. We do not need you to quote a law.

10.4 How we confirm it is you. We do not act on a request for a copy or a deletion until we are reasonably sure it comes from the account holder. We reply to the email address on your account, and ask you to answer from it. If you sent the form while signed in, we use that too. If you signed in by phone and have no email on your account, send the form while you are signed in. We link it to your account, and your sign-in was itself confirmed by a code sent to your phone. You can also add an email address on your Account page. We ask only for what we need to confirm it is you. We do not ask for a copy of your ID unless there is no other way, and we delete it after we have checked. An opt-out and a share-page removal do not need this check.

10.5 How fast.

• We answer within the time the law allows: 45 days, plus one extension of 45 more, under most U.S. state privacy laws; one month, plus up to two more months, in the European Economic Area and the United Kingdom; and 30 days, with notice if we need longer, in Switzerland. If we need more time, we tell you why and how long.
• An opt-out made on the choices page, or with Global Privacy Control, applies at once. We have nothing to stop selling or sharing.
• We send a copy as a file you can open on a computer, and we send it securely.

10.6 Authorized agents. You can let someone act for you. They must show your written permission, signed by you, or a power of attorney. We will still confirm with you directly that you gave it. A parent or guardian may act for a child, but the site is for adults only (section 15).

10.7 If we say no, and appeals. We tell you why, in writing. This can happen if we cannot confirm it is you, if the law lets or makes us keep the information, if the request would harm someone else's rights, or if the request is clearly repeated or unreasonable. Under many state privacy laws you can appeal. To appeal, send another "Privacy request" through the contact form and write "Appeal" at the top. Someone other than the person who decided the first request looks at it, where we can. We answer within the time the law allows. If we turn down your appeal, we tell you how to complain to a state attorney general, and in the European Economic Area, the United Kingdom and Switzerland to your data protection authority (13.8).

10.8 We do not treat you worse for using your rights. We will not deny you service, change what you pay, give you a lower quality of service, or suggest we might, because you used a right. The one exception: if a request makes it impossible to serve you (for example, deleting the record of your Vault while you still hold cards), we will tell you what we cannot do.

10.9 It is free. Requests cost nothing. If a request in the European Economic Area, the United Kingdom or Switzerland is clearly baseless or excessive, we may charge a fair fee or refuse, and we will tell you.

11. Notice under the CCPA and CPRA

Some U.S. state privacy laws, such as the CCPA and the CPRA, ask us to say more. This section is for residents of the states those laws cover. It also acts as our notice at collection: it tells you what categories of personal information we collect, why, and how long we keep it, at or before the time we collect it. The sign-in page and the footer of the site link to this policy.

11.1 What we collected in the last 12 months. In the 12 months before the date at the top, we collected the categories below. We also say where each came from, why we use it, and who got it.

We collected no personal information from anyone we know to be under 18.

11.2 Retention. Section 8 says how long we keep each kind.

11.3 Sold or shared. In the last 12 months we have not sold personal information, and we have not shared it for cross-context behavioral advertising. We know of no sale or sharing of the personal information of anyone under 16. Google Analytics measures our own site and our own ads. We treat Google as our service provider for this, and we have turned off Google signals and ad personalization.

11.4 Sensitive personal information. We collect none. We therefore do not use it to infer traits about you, and the right to limit it does not apply.

11.5 Your rights under these laws. You can ask us to:

• tell you which categories of personal information we collected about you, where it came from, why we use it, the categories of companies we gave it to, and the specific pieces we hold;
• delete your personal information;
• correct inaccurate personal information;
• stop selling or sharing it (we do neither);
• limit the use of sensitive personal information (not applicable); and
• not treat you worse for using a right (10.8).

You can also use an authorized agent (10.6). Section 10 explains how to ask, how we confirm it is you, how fast we reply, and how to appeal.

11.6 Do Not Sell or Share. The page is called Do Not Sell or Share My Personal Information. The footer links to it for visitors connecting from the one US state whose law asks for it, and anyone can open it from this policy. We also treat a Global Privacy Control signal as a valid request to opt out, for that browser and, when you are signed in, for your account. We do not ask you to make an account to opt out.

11.7 Free pack and activity score. A creator's referral code can give you one free pack, as promo credit for that pack's price. Our collectors also build an activity score on their purchases. You do not need a referral code to buy anything, and using one does not change the price of anything else. We do not charge different prices, or give a different quality of service, based on the personal information you give us. Using a referral code means we record the code, your account, the time and your IP address. We do not put a value on that information. Activity units have no cash value. If you want us to forget the code you used, send a "Privacy request" through the contact form.

11.8 Under 16. We do not sell or share the personal information of anyone under 16. The site is for adults only.

11.9 De-identified information. We keep de-identified information de-identified and do not try to re-identify it (5.6).

11.10 Shine the Light. A state law known as "Shine the Light" lets residents ask which personal information a company gave to other companies for their direct marketing. We do not give personal information to other companies for their direct marketing, so there is nothing to report. You can ask through the contact form.

11.11 Do Not Track. See 7.7.

11.12 Questions. Send a "Privacy request" through the contact form.

12. Other U.S. state laws and other countries

12.1 Who this is for. Many U.S. state privacy laws give residents rights over their personal information, and more are passed over time. We do not list them here, because the list changes. We give the rights in section 10 to every collector, wherever you live, so you do not need to check whether a law covers you. The rest of this section applies to you if one does.

12.2 What you can do. Ask to know what we hold and to get a copy, to correct it, to delete it, to get it in a file you can reuse, and to opt out of the sale of your personal information, targeted advertising and profiling that has significant effects. We do not sell, we do not run targeted advertising, and we do not profile you in that way. The opt-out is open anyway (11.6).

12.3 Sensitive data. Some state laws ask for your consent before a business uses sensitive data. We collect none.

12.4 Appeals. If we refuse your request, you can appeal (10.7). If we turn down the appeal, you can complain to a state attorney general.

12.5 Laws about selling details. Some state laws let residents tell a business not to sell certain details about them. We do not sell them. You can still send a "Privacy request" through the contact form.

12.6 Other countries. Grailday is open to people in every country. The rights in section 10 are yours wherever you live: to see what we hold about you, to have it corrected, to revoke a consent you gave, and to ask a question or make a complaint about how we handle your information. Send a "Privacy request" through the contact form. If we cannot settle it, you can complain to the privacy regulator in your country. Section 13.9 says where your information goes.

13. European Economic Area, United Kingdom and Switzerland

13.1 Why this section is here. Grailday is open to people in every country, and we do not block any region. If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation, the UK General Data Protection Regulation and the Swiss Federal Act on Data Protection may give you the rights below.

13.2 Who is responsible. Grailday, 30 N Gould St #54815, Sheridan, WY 82801, USA, is the controller of your personal information.

13.3 Our representative and data protection contact. Send everything about your rights through the contact form (10.3). If we appoint a representative or a data protection officer for your region, we will list their contact details here.

13.4 Why we use your information, and the legal basis.

Where we rely on our legitimate interest, we have weighed it against your rights. You can ask us for details, and you can object (13.6).

13.5 Consent. Where we rely on your consent, you can revoke it at any time, as easily as you gave it. Open "Cookie settings" in the footer and change your answer. Revoking consent does not undo what we did while the consent was valid.

13.6 Your rights. You can ask us to:

• show you what we hold about you and give you a copy;
• correct it;
• delete it (9.4);
• restrict how we use it while a question is settled;
• give it to you, or to another company if you ask, in a common file format (portability), where we hold it by contract or consent;
• stop using it where we rely on legitimate interests (object); and
• not be subject to a decision based only on automated processing that has legal or similar effects. We make none (5.4).

Use the process in section 10. In the European Economic Area and the United Kingdom we answer within one month (in Switzerland, 30 days). If the request is complex or we have many, we can take up to two more months, and we will tell you within the first month.

13.7 Special categories. We do not collect health, race, religion, political opinion, sex life or union membership information. We do not collect face data.

13.8 Complaints. You can complain to your data protection authority. In the European Economic Area, find yours on the European Data Protection Board's list. In the United Kingdom, it is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would like to fix the problem first, so please write to us before you complain.

13.9 Where your information goes. We run Grailday from the United States, and our providers handle information in the United States and in other countries. When information from the European Economic Area, the United Kingdom or Switzerland goes to a country that has not been found to give an equal level of protection, we use a safeguard the law accepts. That is the Data Privacy Framework, with its UK extension and Swiss-U.S. framework, where the company is certified under it, or standard contractual clauses with the UK addendum and Swiss changes. You can ask us through the contact form which safeguard applies to a company.

13.10 Switzerland. For people in Switzerland, this section applies in the same way. We use the words "data protection authority" in 13.8 to mean the Swiss Commissioner.

14. Keeping it safe

14.1 What we do. We use safeguards appropriate to the risk to protect your information.

14.2 No system is perfectly safe. We work to protect your information, but no website, network or storage is perfectly secure. We cannot promise that nobody will ever get in.

14.3 Your part.

• Keep the email, phone or sign-in provider account you sign in with safe. Anyone who controls it can sign in as you.
• Do not share your sign-in codes.
• Sign out on a shared device.
• Do not put your name or contact details in your handle.
• If you think someone got into your account, tell us at once through the contact form.

14.4 If something goes wrong. If a security problem puts your information at risk, we will tell the people and regulators that the law requires us to tell, without unreasonable delay. Where European or UK law applies, we tell the data protection authority as the law requires. We tell affected people when the risk to them is high. Our notice will say what happened, what information was involved, what we are doing about it and what you can do.

15. Age

Grailday is for adults. You must be 18 or older to use it. Our sign-in does not ask for your date of birth, so we rely on your agreement to the Terms. We do not knowingly collect information from anyone under 18. If you are a parent or guardian and think a child has an account, send a "Privacy request" through the contact form. We will put the account on hold while we look into it, and remove what the law allows us to remove.

16. Links to other sites

Grailday links to pages run by other companies: the payment processor's own payment page, the sign-in pages of a sign-in provider, a carrier's tracking page, and Google's explanation of how it uses data. When you follow a link, you leave Grailday. The other company's notice applies there. We do not run those pages and cannot answer for them.

17. Reading this policy another way

If you need this policy in a different format, or have trouble reading it, send us a message through the contact form. Our Accessibility page says more about what we do for people who use assistive tools.

18. Changes to this policy

18.1 Small changes. We update this page and the date at the top.

18.2 Material changes. If we make a change that matters, such as a new kind of information, a new use, or a new kind of company getting it, it takes effect 14 days after we post it on this page. We tell you about changes here, not by email.

18.3 If a change needs your consent, we ask for it. We do not treat your silence as consent to a materially different use.

18.4 Which version. The date at the top shows which version you are reading.

19. Contact

For anything in this policy, send a message through the contact form and choose "Privacy request." You can also call the support line whose number is on the Contact page (not toll-free). Our mailing address is Grailday, 30 N Gould St #54815, Sheridan, WY 82801, USA.