Privacy Policy

1. Information we collect

Information you give us

• Account details: email address, username, password (stored only as a one-way hash), date of birth and state of residence.
• Delivery details: full name, street address and phone number for physical deliveries.
• Identity verification: the information and documents you submit to our verification partner (see Section 4). We receive the result (approved or not) and limited details such as your name and date of birth; we do not store copies of your identity documents.
• Messages you send us, including support requests.

Information collected automatically

• Location: the country and state derived from your network address each time you use the Service, which we must record to enforce where the Service is available.
• Device and usage data: IP address, browser type, pages viewed, the boxes you open, battles you join, items you sell back or exchange, and timestamps.
• Cookies and similar technologies (see Section 7).

Information from others

• Payment confirmations from our payment processor, including the last four digits and expiry of your card and whether a charge succeeded. We never see or store your full card number.
• Verification results from our identity-verification partner.
• Shipping status from the carriers we use.

2. How we use information

We use personal information to:

• create and run your account and show you your inventory, balances and history;
• process payments and deliver items you ask us to deliver;
• apply the value guarantee and keep an accurate, verifiable record of every opening, as required by our provably fair system;
• confirm you are old enough and in a location where the Service is available, and keep an audit record of eligibility checks for our payment processors and regulators;
• detect and prevent fraud, multiple accounts, location spoofing and abuse;
• provide customer support and respond to your requests;
• send service emails such as verification codes, receipts, delivery updates and changes to our terms;
• send marketing emails about new boxes and promotions, if you opt in (you can unsubscribe at any time);
• comply with legal obligations and enforce our Terms;
• understand how the Service is used so we can improve it.

3. Legal bases

Where the law requires a legal basis, we process your information to perform our contract with you (running your account and delivering items), to comply with legal obligations (age and location checks, tax and accounting records), for our legitimate interests (security, fraud prevention, improving the Service) and, for marketing, with your consent.

4. Who we share information with

We share personal information only with:

• Service providers who act on our instructions: our payment processor, identity-verification partner, email delivery provider, cloud hosting providers, shipping carriers and analytics tools. Each is bound by contract to protect your information and use it only to provide its service to us.
• Suppliers and fulfilment partners, who receive your name and delivery address so they can ship your item.
• Authorities and others when required by law, for example in response to a valid legal request, to protect the rights or safety of Boxster or others, or to investigate fraud.
• A successor in a merger, acquisition or sale of assets, in which case this policy continues to apply.

We do not sell your personal information and we do not share it with third parties for their own marketing.

Other users can see your username, your loyalty level and the items you have pulled (on live feeds, leaderboards and your public player page). They cannot see your email, real name, balances, location or delivery details. Choose a username that does not reveal more about you than you want public.

5. How long we keep information

We keep your account information while your account is open. Records of openings, payments, eligibility checks and verification results are kept for seven years after the relevant event, because our payment processors and applicable tax, consumer-protection and anti-fraud laws require it, even if you close your account. Support messages are kept for three years. Location and device logs are kept for 13 months. We delete or anonymise information when it is no longer needed.

6. Your choices and rights

• Access, correction and deletion. You can see and update most of your information in your profile. You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing privacy@boxster.io. We will verify your identity first. We may keep information we are required to retain (Section 5) and will tell you if so.
• Marketing. Unsubscribe using the link in any marketing email or in your account settings. Service emails (codes, receipts, delivery updates) cannot be switched off while your account is open.
• Cookies. See Section 7.
• State privacy rights. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws may have additional rights, including the right to know what we collect, to delete it, to correct it, to opt out of "sales" and "sharing" (we do none), and not to be discriminated against for exercising these rights. Use the contact in Section 10; you may also use an authorised agent. We will respond within the time the applicable law allows (usually 45 days). We do not use or disclose sensitive personal information for purposes other than those permitted by law.
• Do Not Track and opt-out signals. We honour Global Privacy Control signals as an opt-out of any sale or sharing; since we do none, there is nothing further to apply.

7. Cookies

We use a small number of cookies and browser storage:

• Essential (always on): your sign-in session, security tokens, your location result and your consent choices. The Service does not work without these.
• Preferences: things like favourite boxes and whether you have seen the welcome message, stored in your browser only.
• Analytics (only if you accept): aggregated usage statistics that help us see which pages and boxes are popular. These do not identify you to us by name.

We do not use advertising or cross-site tracking cookies. You can clear cookies in your browser at any time; doing so signs you out.

8. Security

We protect your information with encryption in transit (TLS) and at rest, hashed passwords, access controls and logging. Card details are handled entirely by our payment processor, which is PCI DSS certified. No system is perfectly secure, so please use a strong, unique password and tell us immediately if you suspect unauthorised access.

9. Children

The Service is for adults only. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email privacy@boxster.io and we will close it and delete the information.

10. Contact us

Boxflow LLC, 8 The Green, STE R, Dover, DE 19901, USA. Email privacy@boxster.io for anything about this policy or your information.

11. Changes to this policy

We will post any changes here and update the effective date. If a change materially reduces your rights we will tell you by email or a notice on the Service before it takes effect.