Privacy Policy
What we collect when you use Grailday, why, who else sees it and the choices you have. Last updated September 29, 2026.
Who we are
This policy covers Grailday at grailday.com. Grailday is operated by PlayStack Labs Inc., 30 N Gould St #54815, Sheridan, WY 82801. "We" and "us" mean PlayStack Labs Inc..
What we collect
- Your email address. You sign in with it: we send a one-time sign-in link to it instead of using a password.
- Your date of birth. You give it when you sign up, so we can check you meet the minimum age.
- Where you connect from. Your IP address and the state and country it points to. We check where you are and your age when you sign up, and again each time you add money, open a pack or ship a card. We also note the IP address and browser used for each sign-in.
- Your shipping name and address, when you ship a card home.
- Your activity. The packs you open, the cards you get, what you sell back or ship, the money you add and any limits you set.
- Messages you send us through the contact form: your name, email address, topic and message, the IP address it came from, and your account if you were signed in.
Payments
Payments are handled by our payment processor. We never see or store your full card number. For each payment we keep the amount, the time and the processor's reference for it.
How we use it
- To sign you in and run your account, your Balance, your packs and your collection.
- To apply the law and our rules: age and location checks, deposit limits, cool-offs and self-exclusion.
- To ship your cards.
- To keep the site safe: spotting fraud and abuse, and limiting repeated requests.
- To answer your messages.
- To keep accurate records of every payment and balance change.
We don't sell your personal information and we don't use it for advertising. We email you only about your account: sign-in links and notices about cards in your collection. We don't send marketing email.
Who we share it with
Only the service providers that help us run Grailday, each with only what it needs:
- Our payment processor: your account ID with us and the amounts you pay.
- The partners that store and ship cards, and the carrier that delivers yours: your shipping name and address.
- Our sales tax service: your shipping address, to work out the sales tax on shipping.
- Our location check service: your IP address, to confirm where you're connecting from.
- Our email delivery provider: your email address and the email we send you.
- The cloud provider that runs the site and stores its data.
We also share information if the law requires it.
Cookies and browser storage
We use a few cookies to run the site, and none for advertising or analytics.
| Cookie | What it does | How long |
|---|---|---|
| rd_session | Keeps you signed in. | 30 days, renewed while you use the site. Ends when you log out. |
| rd_csrf | Stops other sites from sending forms from your account. | Until you close your browser. |
| rd_ref | Remembers a creator's referral link. | 30 days. |
| rd_contact | Stops other sites from sending the contact form for you. | 2 hours. |
Your browser also stores two small settings: that you closed the banner at the top of the page, and your balance for the menu while the tab is open. Blocking cookies in your browser signs you out, because you need the sign-in cookie to use your account.
How long we keep it
- We keep your account, activity and payment records while your account is open, and afterwards for as long as we need them for accounting, tax, fraud prevention and the law. Our record of money moving in and out of your Balance is a ledger: entries are added, never edited or deleted.
- Sign-in links expire after 15 minutes and work only once.
- We keep messages you send us so we can follow up on them.
- Our servers keep short-lived technical logs to keep the site running and secure.
Your choices
- Set deposit limits, take a cool-off or self-exclude from your Account page. Responsible Play explains each one.
- To close your account for good, choose permanent self-exclusion on your Account page. Terms explains what happens to your cards and money first.
- To ask for a copy of your information, to correct it, or to ask us to delete it, send a request through the contact form and choose "Privacy request". We reply to the email address on your account. Some records, like payment records, we must keep even after a deletion request.
Age
Grailday is for adults. Sign-up checks your age before an account is created, and we don't knowingly collect information from anyone under 18.
Security
You sign in with one-time links, not passwords. We store only scrambled (hashed) versions of sign-in links and session keys, and your sign-in cookie is only ever sent over an encrypted connection.
Changes to this policy
When we change this policy, we update this page and the date at the top.
Questions
Questions about your privacy? Send us a message through the contact form. Grailday is operated by PlayStack Labs Inc., 30 N Gould St #54815, Sheridan, WY 82801.