Privacy Policy

1. Who this covers

This policy explains what Sealed Collectibles, Inc. ("Sealed", "we") collects about you when you use sealed.live, why, who receives it, how long it is kept, and what you can ask us to do about it. It applies to visitors and to members. It also covers the one thing we keep about people who are neither: the eBay username of a seller we buy a card from, recorded with that order and erased when eBay tells us the seller's eBay account has been deleted. It is part of the Terms of Service.

Sealed is for adults. You must be 18 or older to hold an account. If the date of birth given at sign-up shows that the person is under 18, the account is locked out of everything on the site and is not used for anything. The sign-in record our identity provider holds for it (the email address, any name and, where it was entered on the sign-up form, the date of birth) is kept today; to have it deleted, write to us (section 7.3).

2. What we collect, and where it comes from

2.1 Things you give us

• Sign-in details, held by our identity provider, Clerk: your email address, your name if you provide one, your password or the Google account you sign in with, and the devices and IP addresses you sign in from. Sealed's database does not store your email address; Sealed reads it from Clerk when it needs to send you something, to set up withdrawals with Stripe (section 2.4), or to prepare the sweepstakes contact list (section 4). If you tick "Remember me" when you sign in, your browser keeps your email address so the form is filled in next time (section 5).
• Your date of birth, given at sign-up to confirm you are 18 or older. It is stored with your identity record and used only to decide that once; the result is then locked.
• Your profile: a username, an avatar chosen from a set we provide (not an uploaded photograph), your privacy settings, and anything you choose to show, such as what you collect, your showcase and the cards you are looking for.
• What you write on the site: public chat messages, direct messages to friends, listing descriptions, trade notes and offers, and support tickets.
• Reports you make: if you report a member, a message, a listing or a trade, we keep who made the report, what it was about, the reason chosen, any note you add, and a short excerpt of what was reported.
• Your consents: whether and when you agreed to the Terms and the Official Rules, and whether you opted in to marketing email. Each decision is recorded with a date and the version you saw, and changing your mind is recorded as a new decision rather than by erasing the old one.
• A shipping address, when you ask for a card to be shipped to you or order something from the shop: your name, street address, city, state, ZIP code and, if you choose to give one, a phone number. It is stored on that request or order and passed to whoever ships it (section 4).

2.2 Things we record as you use the site

• Your balances and every movement of them: Seal purchases, spends, holds, credits and vouchers; Cash earned from sales, converted, or withdrawn. These are append-only ledgers and are the record of your money on the site. Postage paid for a shipment is recorded separately, in dollars, because it is neither Seals nor Cash.
• Your activity: packs bought and opened, including the seeds and counters that decided each pull; free packs claimed; the cards in your vault and what happens to them; listings, bids, purchases, trades, breaks, exchanges, shipments and shop orders; the missions you complete and the levels and experience points you earn; the notifications we send you; and pulls or breaks you choose to share by link.
• Sweepstakes entries: one record for each Seal purchase that earns entries, with the amount and the deposit it came from.
• Referrals: your referral code, a daily count of visits to your link (a number only), and, for a member who signs up through a link, which code they arrived on. We do not record IP addresses, browser fingerprints or user-agent strings for referral visits.
• Sign-in signals: each time you sign in, our identity provider tells us which browser or app install it was (an opaque id), the kind of device and browser, and the city and country, and we keep those together with a salted hash of the network address, not the address itself, for 180 days. We use them to notice when two accounts are being used from the same place, which a person then looks at. They are also used automatically in one case: the free welcome pack is refused to an account whose browser or network address matches another account that has recently claimed one. Nothing else is decided by them automatically, and neither account is marked.
• Friends and blocks: who you have added, and who you have blocked or been blocked by.
• Support: your tickets, the messages in them, and any remedy we applied to your account.
• Reports about you: if another member reports you or something you wrote, we keep the report, including a short excerpt of what was reported (up to 280 characters), even if the original is later deleted.

2.3 Things collected automatically

• Cookies and browser storage, listed in section 5.
• Server logs: our hosting provider keeps standard request logs, which include IP addresses, the pages requested and the time, for a limited period, for security and to keep the site running. Sealed's own code never stores your IP address; the one thing it keeps derived from it is the salted hash described under sign-in signals. It is stored as a hash rather than as the address itself, but anyone holding the salt could match it back to an address, so we treat it as personal information.
• Picture requests: card pictures and other public images are loaded by your browser directly from our file storage at Supabase, which therefore receives your IP address with each request.
• Payment and payout details are collected by Stripe, not by us (section 2.4).

2.4 Things collected by others on our behalf

• Stripe collects your card details when you buy Seals or pay the postage and handling for a shipment. Sealed never receives them; we receive confirmation that a payment was made, the amount, and Stripe's identifiers for it.
• Stripe Connect collects your identity documents, tax information and bank account when you set up withdrawals. We give Stripe your email address when we create your payout account. Sealed never sees or stores what Stripe collects; we store Stripe's identifier for your payout account and whether it is ready to receive money.
• Stripe Identity collects your identity document and a selfie when you make a single Seal purchase of $500 or more and have not already been verified. Stripe collects the document images, the facial images, the name, address, ID number and date of birth on the document, and fraud signals about the device used, and uses them to run the check and to detect fraud. Stripe may separately ask you whether it may use your images to improve its own verification technology; that is between you and Stripe. Sealed never sees the document or anything read from it; we store Stripe's session id, the status of the check, the times it changed, and, if it did not pass, Stripe's reason code. You agree to the check by ticking a box before it starts, and we record when. As soon as a check is finished, whether it passed or not, we have Stripe delete the document images, the facial images and everything read from them; Stripe keeps only the outcome. A check you start but never submit collects nothing.
• Clerk collects sign-in security information, including the IP addresses and devices you sign in from and any bot-detection signals. When you sign up, Clerk's form runs a bot check provided by Cloudflare Turnstile.

2.5 What we do not collect

We do not run advertising or analytics trackers. There is no Google Analytics, no advertising pixel, no session-recording tool and no third-party advertising or tracking cookie on the site. We do not buy information about you from data brokers. We do not collect precise location. We do not use your information to build profiles for advertising.

2.6 Sensitive information

Two kinds of information we handle count as "sensitive" under some state privacy laws:

• Your government ID and facial images, collected for us by Stripe Identity (section 2.4), used only to verify that you are who you say you are before a large purchase and to prevent fraud. Sealed itself keeps only the result.
• The contents of your direct messages. They are delivered to the friend you send them to. Sealed's staff tools do not show them, except where a message has been reported (section 2.2), in which case staff see the excerpt kept with the report in order to decide on it. That is the only purpose: safety and moderation.

Your date of birth is used only to confirm that you are 18 or older (section 2.1).

Biometric information. Comparing your selfie with the photo on your ID produces a scan of face geometry, which the laws of Illinois, Texas, Washington and some other places treat as a biometric identifier. This is our policy for it:

• Who holds it. Stripe creates and holds it on our behalf. Sealed never receives it.
• Consent. It is collected only after you agree, in writing, by ticking the box on the identity check, and we record that you did.
• Use. It is used only to verify that you are who you say you are and to prevent fraud. We do not sell, lease or trade it, or otherwise profit from it, and we do not disclose it to anyone other than Stripe unless the law requires us to.
• Destruction. It is permanently destroyed when the purpose for collecting it is met, which is when your check is finished, whether it passed or not. In any case it is destroyed no later than three years after your last interaction with Sealed.
• Care. It is stored and protected with the same care, or more, as other confidential information.

3. Why we use it

We use the information above to:

• run your account and let you use the site: open packs, keep your vault, buy, sell, bid, trade, join breaks, have cards shipped to you, order from the shop;
• keep the ledgers that record your Seals, Cash and entries, and prove any pull to you or to anyone else through the published verification method;
• process payments and payouts through Stripe, including the identity checks and tax reporting Stripe performs;
• run the sweepstakes: count entries, give each entrant's email address and entry count to Sweeppea for the drawing, and contact a winner;
• send you messages about your account: a reply to a support ticket, a card replacement, a withdrawal, a shop order that has shipped, a change to the Terms;
• send you marketing email only if you opted in, which you can withdraw at any time in Settings;
• prevent fraud and abuse: multiple accounts, repeat claims of the welcome pack, self-referral, interference with a pull, money moved between accounts, chargebacks;
• review reports and keep members safe, including reading a reported message;
• keep the site secure and working;
• comply with the law, including sweepstakes, tax and consumer-protection obligations, and respond to lawful requests.

4. Who receives it

We share information only as follows. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in California law.

• Service providers that process information for us under contract: Clerk (identity and sign-in, including Cloudflare Turnstile's bot check at sign-up), Stripe (payments, postage charges, payouts, identity checks, tax forms), Supabase (our database and the file storage your browser loads pictures from), Vercel (hosting and server logs), and Resend (sending email: support replies, shop shipping notices, and alerts to our own staff). Each may use the information only to provide its service to us.
• eBay and the seller who ships your card. Cards are bought for shipment from sellers on eBay. To price the postage, we give eBay your ZIP code. When the order is placed, from Sealed's own eBay account, eBay and the seller receive your name, shipping address and, if you gave one, your phone number, because the seller mails the card to you directly.
• Printful, which makes and ships some of the merchandise in the shop, receives your name, shipping address and, if you gave one, your phone number, to quote the postage and to mail your order.
• The supplier of an accessory you order from the shop, such as sleeves or toploaders, receives your name and shipping address and, if you gave one, your phone number, so that it can mail the order to you.
• Sweeppea, the sweepstakes platform that hosts the Official Rules and the free method of entry and on which the drawing is held, receives the email address of every member who earned entries in a sweepstakes period and the number of entries they earned, so that those entries and the free entries are drawn together. If you are drawn as a winner, we will need your name and contact details to award the prize, and the law may require your name to be published in a winners list. Sweeppea handles what it receives under its own privacy policy.
• The card pricing provider receives card certification numbers, never anything about you.
• Other members see your username, avatar, level and border wherever you act on the site, and whatever you choose to make public on your profile. Your level rises with your activity, including the Seals you spend on packs, the marketplace and auctions and the missions you complete, so it reflects in broad terms how active you have been. Your balances, your vault (unless you show it), your entries and the details of your purchases are never shown to other members.
• Law enforcement, regulators and courts when the law requires it, or to protect Sealed, its members or the public from fraud or harm.
• A successor to the business, if Sealed is sold or merged, in which case this policy continues to apply to what was transferred.

5. Cookies and browser storage

Sealed uses only cookies and browser storage that the site needs to work or that remember a choice you made. None of them tracks you or is used for advertising, which is why there is no cookie consent banner.

Browser storage (kept in your browser, not sent to us):

Because no tracking cookies are used, a Global Privacy Control signal from your browser changes nothing; you are already opted out of everything it covers. We honor the signal in the sense that we sell and share nothing it could apply to.

6. How long we keep it

• Ledgers, entries, pulls and their seeds, and every transaction record, including postage charges, are kept for as long as your account exists and afterwards for as long as the law requires for financial, tax and sweepstakes records, and at least seven years, because they are the proof of what happened to money and to cards.
• Sweepstakes entry records are kept after a period closes, so that a drawing can be audited.
• Your profile, friends, blocks, notifications and preferences are kept while your account exists. Closing your account does not delete them (section 7.1 says what closing does); deletion is by request (section 7.2).
• Chat and direct messages are kept for as long as the room or conversation exists; a removed message is hidden from everyone but kept in the record for as long as the room or conversation exists.
• Reports, including who made them, what they were about, the reason, and the excerpt of what was reported, are kept while the accounts involved exist and afterwards for as long as we need them to explain a decision, so that a pattern of behavior can be recognized and a decision can be explained.
• Shipping addresses are kept with the shipment request or shop order they were given for, so that a parcel can be traced and a problem settled, for as long as the transaction record of that shipment or order is kept.
• The result of an identity check (Stripe's session id, the status and any reason code) is kept for as long as your account exists and afterwards for as long as the financial records it supports; what Stripe collected is kept under Stripe's policy.
• Sign-in signals are deleted automatically 180 days after they were recorded.
• Records of messages from our identity provider, which note what kind of event arrived and what we did with it and hold nothing about you, are kept for as long as they are useful for diagnosing problems with signing in.
• Support tickets are kept for as long as your account exists, so that a later question about the same card, pull or payment can be answered.
• Consent records are kept for as long as we need to show what you agreed to.
• Referral visit counts hold no personal information and are kept as statistics.
• A seller's eBay username is kept with the order it belongs to and erased when eBay tells us the seller's eBay account has been deleted.
• Server logs are kept by our hosting providers for their standard periods, which are no longer than 30 days.
• Information held by Stripe and Clerk is kept under their own policies.

7. Your choices and rights

7.1 Things you can do yourself. In Settings you can change your username, avatar, profile privacy and marketing email preference. You can see every movement of your Seals, Cash and entries in your account. You can verify any pull on the Verify page.

You can also close your account in Settings. Closing cancels your open listings, auctions without bids, trade offers and unpaid shipment requests, sells every card left in your vault to Sealed for Cash, brings your Seals to zero, retires your referral codes, and makes your profile private. Your Cash stays so that you can withdraw it, and you can still sign in to do so. Closing an account does not delete your information: your sign-in record at Clerk (including your email address and name), your profile row, and the records in section 6 are kept, and your username stays reserved for good so that nobody else can take it and past sales keep showing who made them.

7.2 Rights you can ask us to honor. Whether or not a particular state's law applies to you, you may ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your personal information, subject to what we must keep (section 6). Ask us as described in 7.3; closing your account does not do this by itself;
• confirm that we do not sell or share your personal information, which we do not, so there is nothing to opt out of;
• limit the use of sensitive information (section 2.6). We use it only to verify your identity and to review reports, which are the purposes the law allows without an opt-out;
• not be treated differently for exercising any of these rights.

7.3 How to ask. Write to privacy@sealed.live from the email address on your account, or open a support ticket and say it is a privacy request. We will confirm your identity through your account before acting, respond within 45 days, and tell you if we need longer. You may authorize someone to ask on your behalf; we will still confirm with you. If we refuse a request, we will say why, and you may appeal by replying to our response; we will answer the appeal within 45 days.

7.4 California. If you are a California resident, the rights above are your rights under the California Consumer Privacy Act. The "Do Not Sell or Share My Personal Information" link in the footer leads to a page that states, because it is true, that Sealed does not sell or share personal information as that law defines those terms. We have not sold or shared personal information in the preceding twelve months. The categories of personal information we have collected in the preceding twelve months are those in section 2; the sources, purposes and recipients are in sections 2 through 4.

7.5 Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and other states with comprehensive privacy laws have similar rights and the same process applies.

8. Security

Sealed is built so that the parts holding money and identity are the hardest to reach. Sign-in is handled by Clerk, payments and payouts by Stripe, and neither your password nor your card or bank details ever pass through Sealed. Our database is reached only from our servers; your browser loads only public pictures from our file storage. Every write to a balance or a card happens inside the database under rules that cannot be bypassed from the application. Every pull is decided on the server and recorded so it can be checked. No method of transmission or storage is perfectly secure, and we cannot promise that yours will never be breached; if a breach affects you we will tell you as the law requires.

9. Where your information is

Sealed's servers and database are in the United States. Our service providers may process information in other countries under their own safeguards. Sealed is offered to residents of the United States only.

10. Changes

We may change this policy. We will post the new version with its date and, for a material change, tell you by email or on the site before it takes effect. Using the site after a change takes effect means you accept it.

11. Contact

Sealed Collectibles, Inc., 5794 Bird Rd, Unit 577, Miami, Florida 33155. Privacy requests: privacy@sealed.live. Everything else: sealed.live/support.