Privacy Policy

We collect the minimum we need to run a secure digital-goods platform. It arrives in four ways.

A. Information you give us directly

• Account data. When you sign in through a third-party provider (such as Google), we receive the basic profile information that provider shares — typically your email address, name, and profile picture.
• Customer support. If you email us, we keep your message, your email address, and whatever details you include, so we can actually resolve the problem.

B. Information we collect automatically

• Collection address. So you can hold and open packs, the Service provisions a personal collection account for you through our partner Privy. We store that account’s public address and link it to your account.
• Device and technical data. Like most websites, we record your IP address, browser type, operating system, device identifiers, and the pages or drops you view.
• Cookies and local storage. We use standard cookies and local storage to keep you signed in, remember your preferences (such as light or dark theme), and understand how the platform is used.
• Drop-link visits. When you open a public drop link, we log the visit — including any campaign tags carried in the URL — to our own database, so we can see which links bring people to a drop. This logging runs on public drop pages only.
• Analytics. We use Vercel Web Analytics on our websites to understand aggregate traffic and performance.
• File downloads. When a drop includes downloadable files and you download the files you own, we record that a download happened, which file, and when. We do this to confirm delivery, to support you if a download fails, and to protect Creators’ work against abuse of the download links.

C. Information from our payment processor

When you pay by card, Stripe processes the transaction. PackX never receives or stores your card number, expiry date, security code, or even the last four digits. Stripe collects your payment details, billing address, and any identity or fraud-check information under its own privacy policy. What comes back to us is limited transaction metadata — whether the payment succeeded, the amount and currency, and Stripe’s identifiers for the payment — which we use to confirm your purchase, deliver your packs, and reconcile Creator payouts.

D. Information from Creators

If you sell on PackX, you connect your own Stripe account through Stripe Connect. Stripe — not PackX — collects and verifies the information required to pay you, which typically includes your legal name, date of birth, government identification, bank or debit-card details, and tax information. We never see or store your bank details or your government ID.

What we do store is the connection and what we need to route your money: your Stripe account identifier, the country you registered the account in, whether charges and payouts are enabled, what Stripe still needs from you (so we can prompt you to finish), and a record of each payout we send.

Where Stripe cannot reach a Creator’s country, we may pay that Creator through a separate transfer service instead. In that case we hold only the records that arrangement requires, and the Creator provides their own banking details directly to that service, not to us.

• Running the Service: managing your account, authenticating logins, processing purchases, executing your randomized reveals, and delivering the files you bought.
• Support: answering questions, fixing bugs, and handling refund requests.
• Fraud prevention and security: detecting and blocking bot traffic, abusive chargebacks, manipulation of drops, and other illegal or abusive activity.
• Tax and compliance: because PackX is the Merchant of Record for card purchases, we use location data to calculate applicable sales and consumption taxes and to keep the financial records the law requires.
• Communication: sending transaction receipts, essential platform notices, and changes to our terms. We do not sell your email address to advertisers and we will not spam you.

We do not sell your personal data. We share it only to make the platform work, or when the law requires it.

• Service providers who act on our behalf, under contract and confidentiality: Privy (login and collection accounts), Stripe (card payments and Creator payouts), Supabase (database and file storage), and Vercel (hosting and analytics).
• Creators. When you buy from a drop, the Creator sees sales and revenue information about their own drop. Creators do not receive your name, email address, or billing details from us.
• Legal and law enforcement. We may disclose data where we have a good-faith belief it is reasonably necessary to comply with a valid legal obligation (a court order, subpoena, or tax audit), to enforce our Terms of Service, or to protect the rights and safety of PackX and its users.

PackX records ownership of packs and Rewards in a public, permanent record system that no single company — including PackX — operates or can edit.

• It is public. When you buy or reveal a Reward, your collection account’s public address, the details of the item, and the transfer record become part of that public record and are visible to anyone.
• It is permanent. Records written there cannot be edited or deleted by PackX — or by anyone. If you ask us to delete your personal data, we will delete your platform account data from our active systems, except the records we are required to keep for tax, accounting, fraud-prevention, and other legal purposes (see §7). Your historical ownership records will remain publicly visible regardless. This is a property of the record system, not a choice we make.

The Service is intended only for people 18 or older. We do not knowingly collect or keep personal data from anyone under 18.

If we learn that someone under 18 has created an account, we will close the account and delete the personal data we hold, except anything we must retain for legal or financial records. Two honest limits on that:

• We cannot delete the collection account. The collection account created through Privy is under its holder’s sole control — it is provisioned for you, but we do not control it and cannot access, close, or empty it. We can close your PackX account; we cannot remove the collection account or anything already written to the public ownership record.
• Purchases. If packs were bought from an account we close for this reason, contact us at privacy@packx.io and we will review the purchase for a refund.

Depending on where you live — including the European Union, the United Kingdom, California, and Canada — you have statutory rights over your personal data. These generally include the right to:

• Access: get a copy of the personal data we hold about you.
• Correct: have inaccurate or incomplete information fixed.
• Delete: have your personal data erased from our active systems, subject to the public-record limits in §4 and our legal record-keeping obligations.
• Object or restrict: object to processing we carry out on the basis of legitimate interests.
• Portability: receive your account data in a portable form.

To exercise any of these, email privacy@packx.io. We will verify your identity first and respond within the legally required period (typically 30 days or less).

• Security. We use industry-standard administrative, physical, and technical safeguards to protect your data. No method of transmission or storage is perfectly secure, and you remain responsible for keeping your own sign-in credentials (such as your Google account) safe.
• International transfers. PackX is based in British Columbia, Canada, and our service providers may store or process data there, in the United States, or elsewhere. Where required, we rely on appropriate safeguards such as standard contractual clauses so your data keeps equivalent protection.
• Retention. We keep personal data for as long as your account is active and as long as needed to provide the Service, resolve disputes, prevent fraud, and satisfy tax, accounting, and audit obligations — after which we delete or anonymize it.

We may update this policy as our technology, features, or legal obligations change. When we do, we will update the “last updated” date above, and for material changes we will take reasonable steps to notify you on the platform before they take effect.

Questions, concerns, or requests about your personal data:

• Email: privacy@packx.io