Privacy Policy.

Colress TCG ("we", "us") runs colresstcg.com, including Colress Market. This policy covers the whole site. We don't sell your personal information, and we don't use it for advertising.

your account

Your email, or the account ID from the sign-in service you choose (such as Google), the name and handle you set, your profile and email settings.

identity check

Whether you passed, the date, and the check's reference number. The ID photos and selfie go to our identity partner, not to us (see below).

wallet and payments

Your wallet's public address and the payments it makes on the market. We store an encrypted share of your wallet key that can't move funds by itself.

orders and shipping

What you buy and sell, prices, shipping addresses (encrypted), tracking numbers and order history.

what you post

Listings, photos (we remove location and camera data from every photo), messages, offers, reviews and reports.

device and use

Your IP address, browser type and the pages and actions on your account, used for security, rate limits and fixing problems.

cookies

One cookie that keeps you signed in, plus small settings saved in your browser. No advertising or tracking cookies.

When you claim a free card or buy a single lot, we collect your name, mailing address and email, and your X handle only if you give it. If you choose to appear on a public wall, we show the nickname you type, your state and which card you got, nothing else.

We use it to mail your card or order and to keep free cards to one per person. To do that we keep scrambled one-way fingerprints of your address, email and handle (they can't be turned back into the originals) for up to a year, set a first-party cookie holding a random number to spot repeat claims from the same browser, and count claims per internet connection for one day, stored only as a scrambled number. Your address is encrypted when it arrives. A free card's address is deleted 60 days after it's mailed; a lot order's details are deleted 60 days after checkout. You must be 13 or older, or a parent or guardian claiming for a child.

• To run your account, show your listings and storefront, and process orders, shipping, refunds and disputes.
• To check identity and keep scams, fraud, fake accounts and banned items off the market.
• To check listings: automated tools, including an AI service provider, compare a listing's photos with what it says (the item, whether it's sealed, its condition, a slab's label, the lab tag) and suggest fixes. They never remove a listing or decide a dispute; anything they flag goes to a person on our team. The provider may not use them to train its models.
• To send sign-in codes, order updates and, if you choose, other market emails. You can turn off anything that isn't about an order or your account.
• To answer you, enforce our Terms and meet legal duties such as tax and record keeping.

We use Stripe to verify your identity. Stripe collects your name, email, phone number, address, facial images, identity document images and ID numbers, and uses advanced technology, such as comparing your selfie to your ID photo, to check that you are who you say you are. Stripe asks for your consent on its own page before the check begins.

We receive only the result, the date and a reference number. We never receive or keep your ID images, your selfie or any measurement of your face. Stripe keeps that data under its own retention rules. You can learn more about Stripe and read its privacy policy at stripe.com/privacy, and ask Stripe to delete your verification data at support.stripe.com.

If the law where you live gives you the right to verify another way, email support@colresstcg.com and we will arrange one.

• The other person on your order. The seller sees the buyer's name and shipping address for that order only. Both see each other's handle, the order record and messages.
• Everyone. Your handle, storefront, listings, reviews, Bond score and sales record are public.
• Service providers who run parts of the site for us under contract: hosting and databases, photo storage, email delivery, identity checks, listing checks, card payments for adding money, and shipping labels and carriers. They may use the data only to provide that service.
• Payment providers you choose. When you add money with a card, that provider collects your card and identity details under its own privacy policy. We don't receive your card number.
• The law. When required by law or a valid legal request, or to protect people from fraud or harm.
• A new owner. If the business is sold or merged, under this policy.

Market payments are made in stablecoins on the Solana blockchain. The wallet addresses, amounts and times of those payments are public and permanent by the nature of the network, and nobody, including us, can delete them. We don't publish who owns an address, but anyone who knows your address can see its payments.

• Account and profile data: while your account is open.
• Orders, payments, disputes and the identity check result: up to seven years after the order, for tax, fraud and legal records.
• Shipping addresses on orders: encrypted with the order record, and shown only to the two people on that order.
• Security logs: as long as they are needed to keep accounts and the market safe.

Email support@colresstcg.com from the address on your account to see a copy of your data, correct it, delete it or close your account. We answer within 45 days and may need to confirm it's you. If we say no, you can appeal by replying to that email.

Depending on where you live (including California, Colorado, Connecticut, Texas, Virginia and other states with privacy laws), you may have rights to know, access, correct, delete and port your data, and to opt out of its sale, sharing for targeted ads and profiling. We don't sell or share personal information for advertising, and we don't make decisions with legal effects by automated means alone: a person reviews holds and disputes. We won't treat you differently for using these rights.

The site uses HTTPS everywhere. Card details are typed only on the card provider's own secure, PCI-compliant page; they never touch our servers. Shipping addresses and wallet key shares are encrypted, sign-ins use secure, HTTP-only cookies and one-time codes, and every change to an order is logged. No system is perfect; if we learn of a breach that affects your data, we will tell you as the law requires.

The market is for people 18 and older. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email support@colresstcg.com and we will delete it.

The date at the top shows when this policy last changed. For a material change we email account holders before it takes effect.

Privacy questions and requests: support@colresstcg.com.