Privacy Policy

Operator of UnpackCard: To be confirmed.

Questions about your data go to the address on the Contact page. We handle personal data under Malaysia's Personal Data Protection Act 2010.

When you buy a sealed product, checkout asks for:

• Your name, email address and phone number, to take your order and send you order updates.
• Your shipping address, if you choose delivery, to deliver your order.
• Your orders and whether they were paid, to fulfil them and keep our records correct.
• A one-way hash of your IP address, kept with each order, to limit repeated attempts.
• Payment details go straight to our payment provider. We receive only the result and a reference, never your banking or card details.

Opening packs needs an account, set out below. It does not ask for your name, phone number or address. We do not sell your personal data.

You need an account to open packs. You log in or sign up with your email address and a 6-digit code we email you, or with Continue with Google. There is no password. For your account we keep:

• Your email address, to log you in and to send you codes and security emails.
• If you use Continue with Google, the id of your Google account and the email address Google gives us. We do not ask Google for your name or photo.
• If you made your account with a password before we changed to emailed codes, an old one-way hash of it (argon2id) may still be kept. It is no longer used to log you in, and we never stored the password itself.
• That you confirmed you are 18 or older and agreed to the terms, with the terms version and the time.
• A referral code, if you enter one.
• For each login: when it started and when it was last used, one-way hashes of its login token and of this browser's device id, your IP address with the last part removed, and your browser's user agent. We use these to keep you logged in, to tell you about a login from a new device, and to keep your account safe.
• A record of security events on your account, such as a login from a new device. For a login from a new device, the record also keeps that login's browser user agent and your IP address with the last part removed.
• One-way hashes of your network address and your email address, to limit repeated attempts.
• If an email to you bounces or is reported as spam, your email address, on a do-not-email list, to stop our account emails going to it.

We email your account only about logging in: the code we send each time you log in or sign up, and security notices, such as a login from a new device. We do not send marketing emails.

When you are logged in, the home page store works with our server. We store this against your account:

• Your credit records: each time credit was added to or taken from your account, with the amount, the reason and the time. This includes the one-time play credit a new account is given. We keep them to work out your balance, to charge each pack once and to put a mistake right.
• Your pack purchases: which pack, how many, the price and the time, and a random key your browser sends with each purchase and sale so that a repeated request is not charged or paid twice. We keep them to charge each pack once, to give the credit back if a pack does not open, and to keep our records correct.
• The cards you pull, with the value shown for each when you pulled it, the pack style each was bought on, and whether each is still in your vault or sold. We keep them to show your collection and to pay the right credit when you sell a card.
• The cards you sell: which card, the credit paid and the time. We keep them so that a sale is paid once and your balance stays correct.

These records are kept as set out under How long we keep it.

• Our payment provider, to take payments and prevent fraud.
• Our courier, which receives your name, address and phone number to deliver your parcel.
• Supabase, which stores our database, including your account, your pack credit and your cards, on servers outside Malaysia, and Vercel, which hosts the site. Our host receives your IP address and standard request details whenever you load a page, and may keep them in its logs.
• Resend, which sends our account emails. It receives your email address and the email we send you.
• Cloudflare Turnstile, which checks that a person, not a bot, is asking for a code to log in or sign up with an email address. It receives your IP address and details about your browser.
• Google, only if you choose Continue with Google. Google logs you in and tells us the id of your Google account and its email address.
• Many card images and set logos load directly from images.pokemontcg.io, part of the Pokemon TCG API, and some card images load from images.scrydex.com (Scrydex), so those services receive your IP address when they load.

When you are logged in, your browser asks our server to open each pack. Our server draws the cards, takes the credit and saves the cards to your account in one step. When you sell a card, our server pays the credit and records the sale. These records are listed under Your pack credit and cards.

Each time the store opens, your browser asks our server whether you are logged in and, if you are, for your balance and cards.

To show an estimate in your local currency, your browser also asks our server, which looks at the country your request comes from. We do not store it.

We keep order and payment records for as long as Malaysian tax and company law requires, which is currently seven years. Visit counts are kept as set out under Counting visits below.

We keep your account, with its login methods, devices and security events, while it is open. A login ends after 30 days without a visit, after 90 days at most, or when you log out. Logging out deletes its record at once; otherwise it is deleted about 30 days after it ends. The security event for a login from a new device keeps that login's browser user agent and shortened IP address for as long as your account is open, even after the login itself is deleted. A sign-up or log-in request, with its code, expires after 10 minutes and is then deleted by a daily clean-up.

An email address that bounced or was reported as spam stays on our do-not-email list with no end date, to keep our account emails from going to it.

We keep your credit records, pack purchases and cards while your account is open. They have no end date.

To have your account deleted, ask through the Contact page. We then delete its email address, Google link, password, logins and devices, and any referral code you entered. Its security events and the record of your 18+ and terms tick stay, with no email address or name linked to them. Its credit records, pack purchases and cards also stay, with no email address or name linked to them, as our record of credit given, charged and paid. An email address on the do-not-email list stays on that list.

Your settings, your binders and any pack credit saved before you made an account are kept in your browser's local storage. They stay on your device and are not sent to us. Your pack credit and cards while you are logged in are not kept here but on our server, as set out under Your pack credit and cards. You can delete what is kept here at any time by clearing this site's data in your browser settings.

unboxed:account:v2

Pack credit history from the old pack pages, which now go to the store: the starting credit, top-ups, pack spends, rewards and check-ins.

unboxed:binder:v1

The cards in your binders.

unboxed:binder-seen:v1

Which binder cards, pages and rewards you have already been shown.

unboxed:sound

Whether sound is on or off.

unboxed:music-wanted

Whether background music is on.

unboxed:theme:v1

Whether you chose the light or the dark theme.

unboxed:rip-hint-seen:v1

That you have seen the tip for opening a pack.

unboxed:session:v1

Whether this browser is signed in. It holds no name, email or password.

unpackcard:auth:last-method:v1

Which way you last logged in on this browser (email or Google), to mark it in the sign-in window. It holds no email address.

unpackcard:auth:flow:v1

While a code is on its way to you: your email address with most of it hidden and when the code expires, so you can get back to the code box. It is kept for this tab only and is gone when you close it.

unboxed:age-consent:v1

That you confirmed you are 18 or older and agreed to the terms, with the date and the terms version.

unboxed:preview-state:v1

Only if you use the device preview tool: which devices it shows.

The home page store also saves the following. Each is described by what it holds.

Store progress

Pack credit, cards, pull history, missions and levels that the home page store saved in this browser before you made an account. While you are logged in, your pack credit and cards are kept on our server instead.

Pack count

How many packs you last chose to open at once.

Pack style

Which pack style (Normal, High, Max or Ultra) you picked. While you are logged in, it is also sent with each purchase and kept with the cards it drew.

Store version

Which version of the store you see, in a cookie and a matching entry, kept for one year. Unless your browser sends Global Privacy Control or Do Not Track, it also keeps a log of up to 50 recent store steps, such as starting an opening or selling a card, on your device only.

Local currency

Your local-currency estimate, so it is not looked up again. It is cleared when you close the tab.

Logging in uses three cookies, set by our site only. They are sent only over a secure connection, and the page's own scripts cannot read them.

__Host-upc_session

Keeps you logged in. It holds a random token, and we keep only a one-way hash of it. It lasts up to 90 days and ends when you log out.

__Host-upc_device

A random id for this browser, kept for one year, so we can tell when you log in from a new device. We keep only a one-way hash of it.

__Host-upc_flow

Links a sign-up or log-in by emailed code, or a Google login, in progress to this browser, for 10 minutes.

We count visits and a few actions against a random visitor id stored in a cookie, to see whether people come back. It isn't linked to your name, email or IP address, and the data stays in our own database.

upc_vid

A random identifier for your browser, kept for one year.

What we count

A visit (once a day), opening a pack, viewing your binder, a check-in.

How long

365 days, then deleted.

Opting out

If your browser sends Global Privacy Control or Do Not Track, we do not count you.

We run tests to see which way of showing our shop works better. Two cookies store a unique visitor id and which version you see, both lasting one year.

upc_vid

Described under Counting visits.

upc_ab_landing

Which home page version you see, kept for one year.

We count only which version was seen and whether a card page was opened. No personal details are recorded. Counts are deleted after 180 days.

You can ask to see the personal data we hold about you, to correct it, to receive a copy of it, or to stop us using it for a purpose you agreed to. You can also ask us to delete your account, as set out under How long we keep it. Ask through the Contact page. If we ever have a data breach that puts you at risk, we will tell you.