Our privacy commitment: Crack Packs does not sell or rent personal information and does not provide it to third parties for their own independent marketing. We collect and retain only the information reasonably needed to run accounts, verification, payments, orders, shipping, seller tools, support, fraud prevention, and legal compliance.
Information we collect
Depending on how you use the service, we may collect:
- Account information such as email, name, birth date, phone, address, Crack Packs User ID, role, and account status.
- Authentication and security information such as passkey public-credential data, session records, protected IP hashes, rate-limit events, and security logs.
- Seller and employee eligibility information such as legal-profile fields, Stripe Identity session references, verification status, and internal approval history.
- Marketplace information such as listings, inventory, bids, purchases, streams, thumbnails, show schedules, shipping profiles, messages, and support requests.
- Commerce information such as order history, Stripe customer and payment references, payment-method brand and last four digits where provided by Stripe, refunds, subscription status, credit balances, shipment details, carrier service, and tracking events.
Information we do not store
Crack Packs does not store full payment-card numbers, card security codes, or full identity-document images. Stripe handles payment credentials and Stripe Identity document capture. Crack Packs generally receives only provider references, limited payment-method details, and the status needed to determine account eligibility or complete a transaction.
How we use information
We use information to create and authenticate accounts; verify account eligibility; prevent duplicate, fraudulent, or abusive activity; process payments and subscriptions; calculate credits and rebates; reserve inventory; operate listings, auctions, and streams; calculate shipping; fulfill and track orders; issue approved refunds; operate referrals and rewards; provide support; send transactional messages; maintain records; improve reliability; enforce policies; and comply with law.
Service providers and permitted disclosures
We disclose limited information only as needed to operate the service, complete a user-requested transaction, protect the platform, or comply with law. Providers may include Cloudflare for hosting, security, databases, streaming, and email routing; Stripe for payments, billing, fraud controls, tax features when enabled, refunds, and identity verification; EasyPost and carriers for rates, labels, delivery, and tracking; and transactional email providers for account and order messages. We may also disclose information to professional advisers, payment or fraud investigators, courts, regulators, or law enforcement when reasonably necessary or legally required.
Seller, buyer, and public information
Information intentionally published in a seller store, listing, live-show page, profile, review, or public message can be viewed by other users and may be indexed or reshared. Do not publish private contact, payment, identity-document, or sensitive personal information in public fields. Order addresses and private account details are not intended to be public.
Retention
We keep information only for as long as reasonably needed for the purpose collected, including account operation, order fulfillment, accounting, tax, payout, chargeback, fraud prevention, safety, support, legal, and dispute requirements. Identity-verification status and provider references may be retained to prevent duplicate seller identities and document prior access decisions. When records are no longer reasonably needed, we delete, de-identify, or securely dispose of them where practical and permitted.
Security
Measures may include encrypted transport, secret storage, signed provider webhooks, passkeys, verified accounts, restricted owner tools, role checks, rate limits, access logging, and provider security controls. No internet or storage system can guarantee absolute security. Report a suspected account or data-security issue promptly to support@crackpacks.com.
Cookies and browser storage
The site uses browser storage and may use cookies for signed-in sessions, security state, account mode, referral or offer attribution, and preferences. Cloudflare and Stripe may use cookies or similar technology for security, fraud prevention, checkout, identity verification, and service operation. Blocking required storage may prevent login, verification, or payment.
Optional aggregate usage measurement
Aggregate navigation measurement is off until you enable it in the notification preferences on this browser. Supported events contain only a supported page name, viewport-width group, workflow name, and stage name. They do not include account identifiers, card names, searches, decklists, addresses, payment amounts, or message contents. Do Not Track and Global Privacy Control take precedence over this preference. Turning the preference off stops new events from this browser; it cannot identify and remove one person's contribution from an existing aggregate count.
The same opt-in also permits coarse search-quality counts: a supported game/category, whether displayed results were empty or available, a filter change after empty results, and whether the entry looked like browsing, ordinary terms or a product code. The search phrase or code itself is never sent by this measurement. Counts describe client-reported displayed results, not unique people, complete catalog demand or a proven reason someone did not buy.
The service stores daily aggregate counts, not a per-person journey or conversion rate. A separate short-lived, secret-salted request hash uses the current minute and connection information to limit abusive submissions; raw IP addresses and user-agent text are not stored in that measurement table. On later accepted measurement requests, request-limit rows older than ten minutes and daily counts older than thirty days are removed. This cleanup is request-driven, so an idle service may retain older rows until another request arrives. Payment-stage events remain client reports, not independent proof that a payment settled.
Returning to an interrupted task
Following a normal sign-in link can save an allowlisted local task URL and scroll position in this tab, usable for up to fifteen minutes. The saved URL may include the search or selected listing needed to return to that task. This return record stays in session storage, is not an account-synchronized deck backup, and does not contain payment tokens, account credentials, or decklist contents. It is cleared when the return is consumed, when an expired record is next read, or when the account signs out.
Deck Builder and Card Swap
Plain language: you can search cards and use Deck Builder without an account. A card search sends the card name or printed code, game, search field, selected language, and filters to the connected card service. Choosing Analyze deck sends the deck text currently in the editor plus the game, format, language, and analysis choices needed to prepare that one report. It does not automatically save the deck to an account, publish it, or send your local collection, saved decks, playtest notes, or in-tab draft recovery copy.
Deck text, deck names, folders, categories, collection rows, and optional notes stay in this browser unless you explicitly choose to analyze, download, or import data. The in-tab recovery copy exists only for the active browser session and can be cleared from the Deck Builder. Card-search history, saved decks, collections, and optional local tools have their own clear or erase controls. Card catalog requests are used to return the result you asked for, not to advertise to you or rank your account.
Local card collection
Saving a card collection is an explicit choice. Card names, printing codes, quantities, declared languages, locks and optional notes stay in unencrypted storage shared by this browser profile. They are not uploaded to the card catalog, used for advertising or sent to server ranking. Other users of this profile and same-origin scripts may access them. Collection matches are declarations, not verified ownership, reserved inventory or marketplace availability.
Collection draft undo/redo keeps up to fifty changes in this tab's memory, within a 1 MB text budget. Source notes are self-declared text, not authenticated receipts or provenance. Undo changes only the draft, even after a save; another save is needed to change stored collection quantities. Page closure, reload, game changes and external saved-data changes clear that undo history. The current unsaved collection/deck editors are outside saved-data erasure.
Original-data downloads include all saved games and require a separate privacy confirmation. Workspace backups include saved decks and collections; plain exports are unencrypted, while the encrypted option requires a passphrase that Crack Packs cannot recover. The typed local deck-data eraser removes saved decks, collection and swap history, not playtest records or sessions. Failed removal is reported without restoring deleted bytes. Deletion cannot recall an existing download or guarantee forensic removal.
Local sideboard observations
Recording an observed board movement is an explicit local action. The selected game, format, deck label, matchup label, date, position, and IN/OUT card quantities stay in unencrypted storage shared by this browser profile. They are not uploaded with Deck Doctor analysis, synchronized to an account, used for advertising, marketplace ranking, or automated recommendations. Saved plan notes and match outcomes are separate records and are not copied into these observations. Anyone using the same browser profile or same-origin scripts may access them; clearing the local observation control or browser site data may remove them.
Imported sideboard notes
Headed sideboard notes are reviewed only in the current page. They are not uploaded, account-synchronized, or automatically saved. Choosing to load a reviewed draft fills the planner fields; a separate save action is required to store a local plan, and a separate preview and apply action is required to edit a deck. Imported text is not used for advertising, marketplace ranking, recommendations, or competitive profiling.
Personal matchup matrix
Personal matchup outcomes are saved only when you explicitly record them. The local browser record contains the game, format, optional event label, test set, tournament stage, round number, deck-variant label, optional opponent label, play/draw/unknown position, and outcome. Optional opponent-version and format-revision labels are kept in a separate local browser record and are used only for an on-device descriptive comparison when you select them. Blank optional labels and round numbers remain visibly not specified or unknown; Crack Packs does not infer an event, stage, round, revision, archetype, or identity. This unencrypted browser-profile storage is not uploaded with Deck Doctor analysis, synchronized to an account, used for advertising, marketplace ranking, recommendations, or player profiling. Context filters operate only on records already stored in this browser. The default CSV export removes raw record IDs, custom opponent labels, and revision labels; including custom opponent labels requires a separate explicit checkbox. Clearing the matrix control or browser site data may remove it.
Subjective matchup expectations
Subjective expectations are saved only by an explicit save action in separate, unencrypted browser-profile storage. Records contain the selected game and format, deck and matchup labels, expectation date, personal assessment, unverified basis, rationale, and a local record identifier. They are not observed results and never contribute to the observed matchup matrix, rates, comparisons, or CSV exports. They are not uploaded with Deck Doctor analysis or synchronized to an account. Anyone sharing the browser profile, or same-origin scripts, may access them. Each record can be deleted individually, or all expectations can be removed with their own clear control without deleting observed outcomes. Limits are 500 expectations and 256 KB; browser eviction or clearing site data may also remove them.
Local opponent strategy tags
Opponent strategy tags are optional, private notes stored only after an explicit save action in unencrypted browser-profile storage. A tag record contains the current game, format, deck-variant label, optional opponent label, play/draw/unknown position, and user-entered tag words. Correcting a tag creates a new local revision for the same exact context; the earlier note is excluded from the current tag view. Tags are not automatic classifications, observed results, public taxonomy labels, or recommendations. They do not affect the matchup matrix, rates, comparisons, CSV export, Deck Doctor analysis, or account data. Clearing tag records or browser site data may remove them.
Private deck archetype labels
Deck archetype labels are optional local declarations saved only by an explicit action. A record contains game, format, deck label, the selected private-label type, label text, and a revision link when corrected. “Unknown / experimental” is a valid explicit choice and is not replaced automatically. These labels are not uploaded, synchronized, used for advertising, or treated as provider, event, community, or metagame classifications. They do not change card analysis, playtest outcomes, matchup calculations, or recommendations. Clearing local labels or browser site data may remove them.
Sample-hand rehearsal
Sample-hand rehearsal reads the deck text currently open in Deck Builder only when you choose to draw. It creates a temporary reproducible draw in page memory using the displayed seed and shuffle method. An optional pasted candidate deck is read only when you request a same-seed comparison. Manual setup context, keep or mulligan choice, solo-rehearsal choice, turn notes, and recorded session-review summaries are temporary page-memory data. Sample hands, seeds, pasted candidate list, notes, session review, and reset actions are not uploaded, saved to an account, used for advertising, or synchronized to another device. You may explicitly download a JSON rehearsal copy; it can contain visible card names and notes, is not encrypted, and is your responsibility to protect. Resetting the rehearsal or reloading the page discards the temporary hand and notes without changing your deck text. This is not a rules engine, gameplay simulation, prediction, or tournament evidence.
Local swap decision history
Saving Deck Builder swap decisions is optional and off until enabled. New applied, rejected and discarded decisions retain card identities, original row quantities, supplied printing metadata, local timestamps and intent notes in unencrypted storage shared by this browser profile. It is not account-isolated and does not upload or synchronize this history. People using the same profile can access it. The complete unchanged deck, comments, account IDs and analysis settings are not saved in this history; intent notes and card identities may still identify you. Limits are 200 decisions and 1 MB; oldest entries may be removed to fit those bounds. Browser eviction or clearing site data can also remove saved history.
Disabling saving does not delete earlier records. Use the individual or all-history deletion controls, or the local deck-data eraser, to remove them. History exports and original-data downloads require separate confirmation and are unencrypted. Existing deck-workspace and playtest backups do not include swap history. Page closure clears transient history fields, pending writes and current-tab decisions but leaves deliberately saved records. Deletion cannot recall downloaded files, other profiles or devices and is not a forensic-erasure guarantee. Failed multi-store deletion is reported as incomplete without restoring deleted bytes.
Private playtest notebook images
Optional match images and captions are kept only in unencrypted storage in this browser profile, not uploaded or included in ordinary notebook exports, reports or encrypted backups. Other people with access to the same browser profile may access this data. Each image needs a preview review and a declaration that you have permission to store its visible information, including agreement from identifiable people shown. The site does not verify that declaration or automatically redact visible names, faces, chat, card ownership or contact information.
PNG or JPEG inputs are converted to a fresh bounded PNG; original file bytes, filenames and embedded metadata are not retained by the notebook. This may resize the image and is not an original-file evidence archive. Limits are three images per match, 24 total and 2 MiB of encoded attachment storage, subject to the browser's shared quota. Browser eviction, private browsing or clearing site data may remove them. Individual downloads require a separate confirmation and are not encrypted; protect those external copies. Image deletion, match deletion and the notebook's scoped erase tool remove local images, but cannot recall downloaded files, other devices or other browser profiles. Failed multi-store deletion is reported as incomplete rather than guaranteed atomic or forensic erasure.
Your choices and privacy rights
You may request access, correction, deletion, or an export of appropriate account information by emailing support. Depending on where you live, additional rights may apply. We may need to verify the requester and may retain records required for completed transactions, taxes, payouts, security, fraud prevention, disputes, or law. Marketing opt-outs do not stop necessary account, security, billing, order, or verification messages.
Children and international users
The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Information may be processed in the United States and other locations used by our providers. Mandatory privacy rights that apply in a user's location remain applicable.
Changes and contact
We may update this Policy prospectively and will change the effective date when material revisions are posted. Questions and privacy requests may be sent to support@crackpacks.com.