Privacy

What we collect

Your Discord account. Your Discord ID, username, display name, avatar and the email address on your Discord account, when you sign in with Discord.

What you enter for a drop. Name, email, phone number and shipping address; your payment card’s number, security code (CVV), expiry and cardholder name; and, when a retailer needs them, your retailer account email and password, your email app password, your Amazon two-factor authenticator key and your Amazon account type.

Fees and payments. The fees for your checkouts, what they were based on, and whether they’re paid. Card payments for fees are handled by Stripe; we see the payment status and invoice, not your full card number for that payment.

Account activity. Your agreement to the terms, warnings and bans, the notifications we send you, and a log of sensitive actions such as when saved card or login details are viewed or exported.

Why we use it

• To run checkouts on your retailer accounts with your details when a drop goes live.
• To send you checkout results, fees, reminders and receipts by Discord message and email.
• To bill and collect service fees, and to enforce the fee, warning and ban rules in our terms.
• To spot duplicate entries and misuse, and to keep a record of who viewed sensitive details.

We don’t sell your information, and we don’t use it for advertising.

Who can see it

Saved card numbers, security codes, passwords and authenticator keys are kept in a restricted vault. Only PhoenixVault admins can open them, only after passing a second verification step, and every time they do is logged. Admins view or export them to run your checkouts.

We share information only with the services needed to run PhoenixVault:

• The retailers (such as Target, Amazon and Pokémon Center), when a checkout is placed on your account.
• Checkout software we operate to run those checkouts.
• Supabase (our database and sign-in) and Vercel (hosting the website).
• Stripe, to invoice and collect fees.
• Discord and Google (Gmail), to deliver messages and emails.

We may also disclose information if the law requires it.

How long we keep it

• Entries, including their card and login details, are kept until the entry is deleted, so we can run it again for later restocks. Deleting an entry deletes its card and login details too. You can delete an entry yourself until it checks out, and again once its fee is paid.
• Fee and payment records are kept for our accounting, even after the entry is deleted.
• The log of sensitive actions is kept as a security record.

Your choices

• Delete any entry from your dashboard until it checks out. Once it checks out, you can delete it after its fee is paid.
• To see what we hold about you, correct it, or delete your account, email phoenixvaulttcg@gmail.com from the email on your Discord account.
• Turn off DMs from server members in Discord to stop Discord messages. Fee emails still go out.

Keeping it safe

No service can promise perfect security. We limit who can open your saved details, require a second verification step to do it, and log every view and export. If you think your details have been misused, change your retailer and email passwords, contact your card issuer, and email us.

Children

PhoenixVault ACO is not for anyone under 18.

Changes

If this policy changes, we’ll update the date above. See also our terms. Questions: phoenixvaulttcg@gmail.com.