Legal

Privacy

What we keep.

We collect what we need to take a reservation, ship it, and refund it. Session replay and ad pixels wait until you choose Allow.

Last updated: October 30, 2026Terms · Refunds · Pre-order terms

Change log — October 30, 2026: Orders now note the page you landed on, the site that sent you, campaign tags in the link, and, after you choose Allow, Google's ad click id.

Change log — October 23, 2026: We added a recently shipped list to our home and product pages. It shows a product, a US state, and days since shipping, never names or order details.

Change log — October 22, 2026: Added the ts_resume cookie used by cart-recovery links.

Change log — October 22, 2026: We added Shippo, which we use to buy shipping labels and track packages, to the list of companies that process your data.

Change log — October 22, 2026: We updated our notice at collection to say that the arbitration agreement in our Terms covers you only if the version of the Terms you agreed to includes one.

Change log — October 21, 2026: We described the cart record and partner invites, which run only when we turn them on, and corrected what a partner sees on credited orders.

Who this policy is about

In this policy, "we" means TCG Slayer, a trade name of Sandbox Strategies LLC. Mail reaches us at 13130 56th Ct N #608, Clearwater, FL 33760. Privacy requests go to support@tcgslayer.io.

This policy covers the public shop, checkout, order emails, the contact form, the on-site chat, page measurements, error reports, and the next-drop email list. It is written for shoppers in the United States, including rights that look like the California Consumer Privacy Act and the California Privacy Rights Act: access, correction, deletion, and a way to opt out of sale or sharing. Other states have similar rights. We honor a request from any US shopper the same way. We are not describing a program for people outside the United States.

This page is also our notice at collection. If the version of our Terms you agreed to at checkout or sign-up includes an arbitration agreement and class action waiver, they cover disputes with us, as described under "Disputes and arbitration" below.

Recording, tracking, and your consent

Some tools on this site receive what happens in your browser while it happens: the pages you view, where you click and scroll, and what you type into the chat. California's Invasion of Privacy Act and similar laws in other states cover some of that as recording, wiretapping, or tracing a communication. So we ask first, and we name who receives it below.

These load only after you choose Allow in the cookie banner:

  • Microsoft Clarity session replay and heatmaps. Clarity records page views, clicks, taps, scrolling, and pointer movement so we can see where the site is hard to use, and it sends that to Microsoft as you browse.
  • The Meta Pixel, the TikTok Pixel, and the Google tag (Google Ads and Google Analytics), for each one we have turned on. Your browser sends them the page address, your IP address, browser and device details, their own cookies, and events such as a product view, a cart, or a purchase and its value.
  • The same events sent from our server to Meta, TikTok, or Google, for each one we have turned on. A server event can include a hashed (scrambled) email or phone, the order value, and an event id. We send one only when that browser or order has an Allow on record and no opt-out.
  • When cart-add counting is on, our own record of items you add to your cart, described under "What we collect, and why." It stays with us and is not sent to Microsoft, Meta, TikTok, or Google.

By choosing Allow, you agree that Microsoft, Meta, TikTok, and Google may receive this information as described here. Until you choose Allow, none of these load. Decline keeps them off, and this browser is not asked again for a year. A browser that sends Global Privacy Control keeps them off and never shows the banner. You can turn them off later under "Your privacy choices" below. When you choose Allow, Decline, or opt out, we record the choice, the time, whether Global Privacy Control was on, and the random browser id described under ts_anon, so we can honor it.

These load without that choice, because the site needs them or because you start them yourself:

  • Vercel hosting, Web Analytics, and Speed Insights, which set no cookies and are described below.
  • Sentry error reports, when we have turned Sentry on. Session replay in Sentry is off.
  • The Trustpilot review widget. Your browser loads it from Trustpilot to show our reviews, so Trustpilot receives your IP address, the page address, and browser details.
  • Stripe, on checkout pages, to take the payment.
  • OpenAI, only after you choose "Start chat — I agree my messages go to OpenAI" in the chat and then send a message. Choosing it is your agreement that your messages go to OpenAI as described under "On-site chat and AI processing." Until you choose it, nothing you type in the chat is sent.

What we collect, and why

Checkout asks for, and the order stores:

  • Email, so we can send the receipt and find the order.
  • Name, phone, and shipping address, so a person can ship the package.
  • Discord handle, which is optional. The field can be left blank. If you type one, we store it on the order.
  • The collections and quantities, the price, shipping, tax, and the total.
  • A public order reference and a secret used only on your confirmation link.

Payment adds, when Stripe sends it:

  • Card brand and last four digits. We do not keep the full card number or the security code.
  • The payment reference, so we can refund the same charge.
  • The email and name Stripe has for the payer. If they differ from what you typed, we store both and keep a note of the difference.

We also handle:

  • Where you came from. Each order stores the page you first landed on, the website that sent you (its address only, not the full page), and any campaign tags in that link, such as utm_source or utm_campaign, so we can see which links and ads lead to orders. If you chose Allow in the cookie banner and your browser has not opted out, the order also stores the ad click id Google adds to its ad links (gclid, gbraid, or wbraid). We keep these with the order and do not send them to Google ourselves. Google receives a click id only through the Google tag, which loads after you choose Allow.
  • An account, if you create one. We store your email, how you sign in (password, Google, or Discord), and when you created the account and last signed in. If you use a password, our sign-in provider stores only a scrambled (hashed) version, never the password itself. If you sign in with Google or Discord, we receive your email and an account ID from that service, not your password there. Orders placed with that email show up in your account.
  • A sign-in session cookie, set only after you sign in, so you stay signed in.
  • Your IP address, to limit repeated checkout, signup, contact-form, and error-alert attempts. We do not save the IP on your order, and we do not put it in an error alert. A next-drop signup, a first-party analytics event, and a partner click store a keyed hash of the address, not the address. If that key is unavailable, those rows store no hash, and the signup, the event, and the redirect still go through.
  • A next-drop email, only if you submit the form. We store the address, the words you agreed to, where the form was (the shop page or the confirmation page), the time, and the order id only when that email matches that order.
  • A partner code, if you arrived through a partner's link. We store it on the order. If you create an account after arriving that way, we also store it on your account, and it stays there so later orders are credited to that partner. The partner sees each credited order by order number, product and quantity, status, and the amount credited to the partner, not your name, email, address, or card details. When Collector Rewards is open, the partner or member credited for an order can also see some of these details and a date for that order, but never your name, email, address, or card details.
  • When cart-add counting is on, we record items you add to your cart, only after you choose Allow in the cookie banner, and not if your browser sends Global Privacy Control or you opted out under "Your privacy choices": the product, the quantity, the time, your account id if you are signed in or the ts_cart id if you are not, and the partner whose link brought you, if any. We use this to count how partner links perform. We do not send it to an advertising company. After 13 months we combine these records into daily totals by product and partner, with no account id or ts_cart id, and delete the originals. A partner or member sees how many items were added to cart through their link, not who added them.
  • When partner invites are on and a partner creates an invite link with your email, we store that email for 30 days so the partner can be credited if you join, then delete it. We do not email you about the invite.
  • A contact-form message, if you send one: your name, email, an optional order reference, and the message. We email it through Resend. We do not save it on your order.

People who fulfill orders can see your contact details, shipping address, and card brand and last four. They cannot see the full card number. Notes and tracking numbers stay on the order so we can ship it.

How we use your information

Recently shipped. Our home and product pages may show recent shipments as a product, a US state, and how many days ago it shipped, such as "Shipped to Texas · 2 days ago." We never show names, cities, or order details, and we name a state only when enough orders shipped there that no single buyer stands out. To keep your orders out of this list, email support@tcgslayer.io.

What we do not collect

We do not store the full card number or the security code. We do not save your card for reuse. We do not run a wishlist or a public order lookup by reference. We do not buy marketing lists. We do not sell personal information for money. Sharing for advertising happens only after you choose Allow, as described under "Recording, tracking, and your consent."

Where it is stored, and who processes it

Order data is stored with our database provider, Supabase, in the United States (region us-east-1). Stripe, Vercel, Resend, Sentry, and Shippo are US-based processors. They handle data because the shop uses them. Microsoft, Meta, TikTok, and Google receive data only after you choose Allow:

  • Stripe processes your card. We do not save the card for reuse. Refunds go back to that card. We pass your email into checkout.
  • Supabase holds the shop records in the United States, including accounts, orders, products, and next-drop signups. Our server talks to it. Your browser does not.
  • Vercel hosts the site and receives the request, including the IP address, in order to serve the page. Vercel Web Analytics records page views. It does not use third-party cookies. A visitor is identified by a hash of the request, and that session is discarded after 24 hours. A page view can include the page address, the query string, the referring page, approximate location, device, operating system, and browser. Confirmation and partner tokens are removed from the page address before a page view or a speed measurement is sent. Vercel says this is not tied to a person or an IP address. Vercel Speed Insights records how fast a page loads. A measurement can include the page address, network speed, browser, device, operating system, country, and the performance numbers. Vercel says that measurement is anonymous and is not used to rebuild your session or identify you.
  • Microsoft Clarity records session replay and heatmaps to improve the site, only after you choose Allow. It uses cookies. Name, email, address, and phone fields are masked, and the contact form and the chat are masked. It does not load on staff pages, the order confirmation page, the partner page, or any page whose address contains a confirmation or partner token. Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement.
  • Sentry records application errors so we can fix the shop. It only runs when we have turned it on. A report can include the page address, the error message, and device or browser details. Confirmation and partner tokens are removed from the page address before a report is sent. Name, email, address, phone, cookies, and form bodies are not sent. Session replay is off. Sentry's privacy policy: https://sentry.io/privacy/.
  • Meta, TikTok, and Google receive ad and measurement events only after you choose Allow, as described under "Recording, tracking, and your consent." They use that data under their own policies, which can include showing you ads on other sites. Meta: https://www.facebook.com/privacy/policy/. TikTok: https://www.tiktok.com/legal/privacy-policy-us. Google: https://policies.google.com/privacy.
  • Trustpilot shows our reviews in a widget your browser loads from Trustpilot. Trustpilot receives your IP address, the page address, and browser details. Trustpilot's privacy policy: https://legal.trustpilot.com/for-everyone/end-user-privacy-terms.
  • Resend sends order email when it is turned on: one confirmation after payment, and one shipped note when we save a tracking number. The message includes the order reference, the lines, the total, and the ship-to address. Resend also sends a contact-form message to our support inbox. The address shown on the site is support@tcgslayer.io. If a different inbox is configured for the form, the message goes there instead. If those emails are not turned on, they are skipped. Stripe may still send its own receipt.
  • Shippo buys our shipping labels and tracks packages. When we buy a label, we send Shippo the order reference, the name, shipping address, and phone number on the order (if you gave one), and the package's weight and size. If we insure a package, we also send the insured value, a general description of its contents, such as "Trading cards," and whether a signature is required. Shippo passes what the label needs to the carrier we choose, such as USPS or UPS, which delivers the package, and sends us the carrier's tracking updates. We do not send Shippo your card. Shippo's privacy policy: https://goshippo.com/privacy.
  • Discord may receive a server-error alert. The alert says a server error happened and includes an error id. It does not include your name, email, shipping address, order, or card.
  • OpenAI processes on-site chat messages as described under "On-site chat and AI processing."

Order mail may come from TCG Slayer <orders@tcgslayer.io>. That address is not the support inbox. Write support@tcgslayer.io. A receipt replies to that same support address.

On-site chat and AI processing

Our on-site chat is an AI assistant. It is not a person. It answers from information on our site. It cannot look up your order in this chat.

Your agreement first. The chat opens with a "Start chat — I agree my messages go to OpenAI" button. Until you choose it, the chat sends nothing, and our server refuses any chat message that does not carry that agreement. This browser remembers the choice, so the chat does not ask again until we change what it says. If you would rather not use the AI chat, email support@tcgslayer.io.

What is sent to OpenAI. We use OpenAI, using GPT-5 nano (primary) and GPT-5 mini (fallback), as our AI processor to generate chat answers. We send OpenAI the messages you type that pass the safety check described below, and the site information needed to answer — for example, the page you are chatting from and the product or policy information your question is about. If the first model cannot answer, the second model may process the same message to try to answer it. We send these messages to OpenAI with storage turned off (store: false) for the answer.

Safety check before sending. Before a message is sent to OpenAI, we run an automated check for card-like numbers and certain other sensitive patterns. If the check flags your message, we discard that message and do not send it to OpenAI. That check looks for patterns; it cannot catch every kind of sensitive information. Please do not put full card numbers, security codes, passwords, or other sensitive information in the chat. We do not store your full card number or security code.

How OpenAI handles chat data. OpenAI does not use data sent to its API to train or improve its models by default. OpenAI may keep API inputs and outputs in abuse-monitoring logs for up to 30 days to provide the service and identify abuse, and may keep them longer where the law requires it or to protect its services. TCG Slayer has not been approved for OpenAI Zero Data Retention, and we do not claim it.

What we keep from this chat. In this version of the chat, we do not keep a server-side record of your chat messages. There is no chat transcript stored by TCG Slayer for a team member to review later. The chat stays in the page you have open. That is different from OpenAI's own abuse-monitoring logs described above, which run on OpenAI's retention clock.

Help from a person. If you need a person, use the Email support option. That opens your own email app with a message to support@tcgslayer.io. We only see what you choose to send in that email, and we handle that email like other support email under this policy. We do not send this chat to Discord in this version.

Deleting chat records. Because we do not keep a server-side chat transcript in this version, there is no stored chat transcript for us to delete. If you emailed us for help, you can ask us to delete that email thread by emailing support@tcgslayer.io, subject to the order-record, open-request, and legal-hold limits described in this policy. Asking us to delete records does not change OpenAI's own retention clock for logs it has already created.

Cookies and storage on your device

  • ts_aff. Set for 30 days when you arrive from a partner link we recognize, so we can attribute the order. A code we do not recognize does not replace a cookie we already accepted.
  • ts_cart. When cart-add counting is on, a random id with no personal data in it, set for 30 days the first time you add an item to your cart while signed out, and only after you choose Allow in the cookie banner. It ties your cart adds to one browser so we can count them. Signed-in cart adds use your account id instead.
  • ts_resume. Set for one hour when you open a cart-recovery link we emailed you, so checkout can reopen your saved cart. It is needed for that link to work, so it is set whatever you choose on the cookie banner.
  • ts_utm. Set for 30 days with the campaign fields from that same visit, so a list signup can store them. The signup form does not send those fields. A later page does not replace a campaign we already stored. A new partner link does.
  • tcg_gate. Set only when a preview password is on, and only after you enter it. It lasts 30 days. The public shop does not set it when the preview password is off.
  • tcg_staff. Set only after staff sign in. It expires after 12 hours. Shoppers do not get this cookie.
  • tcg_chat_consent, saved in this browser rather than as a cookie, after you choose Start chat in the chat. It remembers that choice. It holds no message text.
  • tcg_cart_v1, saved in this browser rather than as a cookie. It keeps the collection and quantity in the cart. It does not hold your name or address.
  • Microsoft Clarity cookies, on the public shop in production, only after you choose Allow, for the session replay and heatmaps above. Staff pages do not load Clarity.
  • ts_anon. A random id with no personal data in it, set for one year. It records your choice in the cookie-consent banner and ties first-party page events to one browser.
  • ts_ads. Set for one year when you choose Allow or Decline in the cookie-consent banner, to remember the choice. Only Allow turns on Clarity, the advertising pixels, and, when cart-add counting is on, the cart record described above.
  • ts_ads_text. Set for one year when you choose Allow, to record which version of the cookie-consent banner you saw. An Allow counts only if it matches the current banner. If it doesn't, we ask again with Clarity, the advertising pixels, and the cart record off.
  • ts_sale_share. Set for one year when you opt out under "Your privacy choices" or your browser sends Global Privacy Control. It keeps Clarity, the advertising pixels, and the cart record off.
  • Meta, TikTok, and Google cookies, such as _fbp, _ttp, and _gcl_au, only after you choose Allow and only for the pixels we have turned on.

The site shows a cookie-consent banner. Microsoft Clarity and the advertising pixels stay off until you choose Allow there. Decline is one click too: it keeps them off, and this browser is not asked again for a year. A browser that sends the Global Privacy Control signal keeps them off too. Stripe's own checkout page may set cookies on Stripe's domain. We do not control those. The other cookies above are for checkout, a preview gate, staff sign-in, an affiliate link, counting cart adds after you choose Allow, or your consent choice.

Do Not Track. Some browsers send an older "Do Not Track" signal. There is no shared standard for what it means, so the site does not change what it does when it receives one. Global Privacy Control is different: we treat it as an opt-out, as described above. Until you choose Allow, no company on our list follows your visit for advertising either way.

Your privacy choices

We do not sell personal information for money. If you choose Allow, Meta, TikTok, and Google receive the information described under "Recording, tracking, and your consent," and California law may treat that as "sharing" for cross-context behavioral advertising. This section is our Do Not Sell or Share My Personal Information page, and the footer links here as Your privacy choices. Use the button below to opt out in this browser. A browser that sends Global Privacy Control is opted out automatically. Opting out turns off Microsoft Clarity and the advertising pixels, revokes the Google consent signals, and stops server events for that browser. When cart-add counting is on, opting out also turns off the cart record for that browser. We do not knowingly sell or share the personal information of anyone under 16.

You can ask us to:

  • Access the personal information we have about you.
  • Correct it.
  • Delete it, except for pieces we still need to finish, refund, or keep for a legal reason.
  • Opt out of sharing. You can also use the button above, or Global Privacy Control.
  • Limit the use of sensitive personal information. The only sensitive information we hold is your account sign-in, and we use it only to sign you in, so there is nothing more to limit.

Email support@tcgslayer.io from the address on the order, or name that address in the message. You can also use the contact form. Say which request you want. We may ask you to confirm you are the person on the order before we act. We will not charge you a different price because you asked. We will answer within the time your state's law gives us.

An agent may write for you. We may still ask you to confirm the request. We do not have a separate agent portal.

Deleting your account

To delete your TCG Slayer account, email support@tcgslayer.io from the address on the account. We may ask you to confirm it is you. Deleting the account removes your sign-in and account profile. Your order records stay for as long as we need them to ship, refund, and answer you, and up to 7 years for tax and accounting, as described under "How long we keep it." An open order still ships or refunds as normal. Deleting your account does not unsubscribe a separate next-drop signup. Use the opt-out link in that email or ask us in the same message.

Next-drop email

The signup says, and we store, these exact words: "One email when the next drop opens. Nothing else." We send that only if you submit the form. Order confirmation and the shipped note are about your order. They are not the marketing list.

Every marketing email will include a way to opt out. You can also email support@tcgslayer.io at any time and we will take you off the list.

Children

The shop is not directed at children under 13. We do not knowingly collect personal information from a child under 13. Checkout does not ask for an age. If you believe we have information from a child under 13, email support@tcgslayer.ioand we will delete it.

How long we keep it

We keep the order for as long as we need it to ship, refund, and answer you, and for up to 7 years for tax and accounting purposes, then we delete it. Next-drop addresses stay until you opt out or we delete them.

When cart-add counting is on, raw cart records are kept for 13 months, then combined into daily totals with no account id or ts_cart id. Invite emails are deleted 30 days after the invite is created.

Security

You enter card numbers on Stripe's page. We do not open the order database in your browser. We do not state a security certification on this page.

Disputes and arbitration

Our Terms include an arbitration agreement. Unless you opt out within 30 days, as the Terms explain, a dispute between you and us about this policy or how we collect, use, record, or share information goes to individual arbitration instead of court. That includes claims under privacy, wiretapping, eavesdropping, and pen register laws, such as the California Invasion of Privacy Act. You and we each give up the right to a jury trial and to bring or join a class action. Small claims court stays open to both of us. The full rules, including how to opt out, are in the Terms.

Changes

If this policy changes, the "Last updated" line on this page changes with it. Before we add a company that records your visit or receives data for advertising, we name it on this page before it loads. If a change is material, we also say so at the top of this page for at least 30 days.

Contact

support@tcgslayer.io. TCG Slayer, 13130 56th Ct N #608, Clearwater, FL 33760. You can also use the contact page.