Privacy Policy

Account data: email address, password (stored only as a salted hash), display name, and optional profile details such as avatar, bio and favorite brand.

Order and shipping data: recipient name, street address, city, state, postal code, country and phone number for prize claims and store orders.

Payment data: card and billing details are collected and processed directly by our payment processor (Stripe). We never receive or store your full card number. We keep only the processor's transaction identifiers, amount, currency, status and the last four digits where provided.

Communications: the content of support emails, restock-alert signups, newsletter subscriptions and anything you post publicly, such as a Community Box name or description.

When you use the services we record activity needed to run them and keep them fair: box openings and their outcomes, token transactions and balances, battle participation, inventory and claim history, daily rewards and streaks, and referral activity. We also log technical data such as IP address, browser and device type, operating system, pages viewed, referring page, timestamps, and error diagnostics.

We use strictly necessary cookies and local browser storage to keep you signed in, remember preferences such as sound settings, and protect against fraud and abuse. We do not sell data to advertisers and do not run third-party advertising trackers. Blocking essential cookies will prevent sign-in from working.

To create and secure your account; to process payments, token purchases, subscriptions and refunds; to run box openings, battles and rewards; to fulfil prize claims and store orders and provide tracking; to respond to support requests; to send transactional messages such as receipts, shipping updates and restock alerts you asked for; to send marketing email only if you opted in; to detect and prevent fraud, chargeback abuse, multi-accounting and exploitation; to analyse and improve the services; and to comply with tax, accounting and other legal obligations.

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (running your account and orders), legitimate interests (security, fraud prevention, service improvement), consent (marketing email, optional profile content), and legal obligation (tax and record-keeping).

Some information is public by design: your display name, avatar, bio, membership badge, leaderboard position, recent pulls shown in the live feed, Community Boxes you publish, and battles you take part in. Your email address, shipping address, phone number, payment details and token balance are never shown to other users. Remove or change anything you would rather not display in your account settings.

We share personal information only with providers that help us operate, and only as needed: our payment processor (Stripe) for payments and subscriptions; our hosting and database provider for storing account and order records; email delivery providers for transactional and opt-in email; and shipping carriers for delivering your prizes and orders. We may also disclose information when required by law, subpoena or court order, to enforce our Terms, to protect our rights, property or safety or those of others, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

We do not sell or share your personal information for money or for cross-context behavioral advertising as those terms are defined under California law.

We protect data with encryption in transit (HTTPS), encryption at rest, row-level database access controls that limit each account to its own records, hashed passwords, and restricted administrative access. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any regulator as required by law.

We keep account data while your account is open. Transaction, order, token and tax records are kept for at least 7 years after the transaction, as required for accounting, chargeback and legal purposes. Support emails are kept up to 3 years. Technical logs are kept up to 12 months. When you ask us to delete your account we remove or anonymize your profile, shipping details and marketing contact information, and retain only the financial records the law requires.

You may request access to a copy of your data, correction of inaccurate data, deletion of your account, restriction of or objection to certain processing, and portability of your data. You may withdraw marketing consent at any time using the unsubscribe link or by emailing us. We will not discriminate against you for exercising any privacy right.

California residents (CCPA/CPRA), EU and UK residents (GDPR) and residents of other states with privacy laws may exercise the rights described above, may designate an authorized agent, and may appeal a refusal by replying to our response. EU and UK residents may also complain to their local supervisory authority.

To make a request, email info@birdiebros.store from the address on your account. We verify requests through your account email and respond within 45 days (30 days for GDPR requests), and will tell you if we need more time.

The services are for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and its data. A parent or guardian who believes a minor has created an account should email info@birdiebros.store.

We operate in the United States, and our providers may process data in the United States and other countries. If you access the services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from your own. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

Our pages may link to sites we do not control, such as carrier tracking pages or manufacturer sites. This policy does not cover them; read their privacy policies before providing information.

We may update this policy; the effective date at the top always reflects the current version, and we will announce material changes on the site or by email. Questions, requests and complaints go to info@birdiebros.store, and we reply within one business day.