Privacy Policy

What this policy covers

Recursion Cards LLC is a South Carolina limited liability company. We sell trading card game singles and sealed product out of our own stock.

This policy covers recursioncards.com, the account you can create here, the requests you send our support team, and our newsletter.

We sell and ship within the United States only.

What this policy does not cover

• Orders placed on eBay. eBay runs that checkout, takes that payment, and handles any dispute under eBay's own privacy policy. Order details reach us from eBay after the sale, and this policy covers what we do with them from then on.
• Other companies' sites. Where we link out, and where a service provider runs its own site, their policies govern what happens there.
• Staff accounts. The people who work the shop have their own admin sign-in.

What we collect

What you give us

Account. Creating an account takes an email address and a password. Our authentication provider, Supabase, hashes the password, and it is never visible to us. We keep the date you confirmed your email address and the date you last signed in. If you add an authenticator app, we hold the enrolment it registered.

Profile. Your profile can hold a first and last name, a display name, a shipping address, a billing address, a phone number and a time zone. All of it is optional. You can change or clear any of it from your account pages.

Saved addresses. The address book keeps a label you choose, a name, the street lines, city, state, postal code and country, and which address is your default.

Support requests. A request holds the email address on your account, the topic you picked, your subject, your message and any photos you attach. A name and an order number are optional. We keep the whole thread: your messages, our replies, and a line recording each time the request changed hands or status.

Newsletter signups. If you ask for the newsletter we keep the address you gave us, the date you asked, and which form you used: the one in the site footer, or the page reached by the QR code printed on a packing slip. You do not need an account to join, and joining does not create one. We email a confirmation link, and the address is not subscribed until you open it.

Selling us cards. An offer to sell us a collection reaches us as a support request and is held like any other.

What eBay sends us

When you buy from us on eBay, eBay passes on what we need to pack, ship and account for the order: your name, the shipping address, the items, the order total, and the buyer contact details eBay chooses to share. We use it to pack and ship the order, and to keep the business records tax law requires. We read orders from eBay. We do not send eBay customer information.

What we collect automatically

Server logs. Our host, Vercel, records ordinary request information: IP address, the page requested, the time, the browser's user-agent string, and any errors. These logs are how we keep the site up and investigate abuse.

Rate limiting and security tokens. We use Upstash, a key-value store, to count requests from an IP address over short windows, and to hold short-lived tokens that prove a password-reset link was really opened. These entries delete themselves, usually within minutes.

Bot protection. Google reCAPTCHA checks sign-in, registration, password reset and the affiliate enquiry form. It looks at the request and at how the page was used to judge whether it came from a person or a script. reCAPTCHA is Google's service and is subject to Google's own privacy policy and terms.

Page and performance measurement. We use Vercel Analytics, which counts which pages are visited and how the site performs. Vercel is our host and already sees the address, the path and the browser in its server logs. It builds no cross-site profile and feeds no advertising auction.

No advertising or cross-site measurement tag runs on this site today. There is no Meta pixel, no Google Ads tag, and no analytics product that shares with an advertising network.

How we use it

• To run your account. Signing you in, confirming your email address, and resetting your password.
• To fulfill eBay orders. Buying the postage, printing the label, telling you it has shipped, and answering questions about what you bought.
• To answer you. Working the support requests you file, and keeping the record of what was asked and what was agreed.
• To keep the site secure. Rate limiting, bot protection, and investigating abuse.
• To meet legal obligations. Tax, accounting, and responding to lawful requests.
• To improve the site. Page and performance measurement.
• To send you our newsletter, if you asked for it. New singles and sealed as they are listed.

We do not use your information for anything else. We do not profile you for advertising, and we do not use what you browse or what you have bought to decide what you are shown or what the newsletter sends you. Everyone on the list gets the same email.

The newsletter goes only to people who asked for it. We do not add customers because they bought something, we do not add eBay buyers, and we do not buy or import lists. Every issue carries an unsubscribe link. When you unsubscribe we stop, and we never start again on our own. The only thing that can put you back on the list is you, from Preferences in your account.

Advertising

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as California law defines those terms. We have not done so in the past twelve months. We do not rent, trade or license customer lists to anyone, and we do not disclose personal information to third parties for their own direct marketing.

We may add advertising tags from Meta or Google. If we do, the tag will be named in the table below in the same change that adds it, and Your Privacy Choices will turn it off for the browser you are using.

We read the Global Privacy Control signal your browser sends, on the server and in the page. A browser sending it is opted out without touching anything, and the signal wins even over a switch you previously turned off.

Who we share information with

We use a small number of service providers to run parts of the business. Each may use your information only to provide its service to us, under its contract with us. This is the whole list.

Beyond that list, we disclose personal information when the law requires it: a subpoena, a court order, or another lawful request. We also disclose it where we believe in good faith that disclosure is necessary to protect our rights, our customers, or the public. If the business is ever sold or merged, customer records may transfer with it, and this policy continues to apply until you are told about a new one.

Cookies and what is stored in your browser

We use very few of these, and none of them are for advertising.

• Sign-in cookies (Supabase) keep you signed in. The account area cannot work without them. Script in the page cannot read them, and signing out clears them.
• Security cookies are short-lived values that protect the sign-in and password-reset flows: which address a verification email may be resent to (twenty-four hours), and a one-time proof that a password-reset link was really opened (fifteen minutes).
• Advertising choice records whether this browser has opted out of advertising and cross-site measurement. It is one character long, opted out or opted in, with no identifier of any kind in it, and it lasts thirteen months. It is set only when you use the switch on Your Privacy Choices.
• Display preferences hold your light or dark choice. They stay in your own browser and are never used to identify you.
• reCAPTCHA may set Google's own cookies when it checks a form submission, under Google's policies.

None of this is advertising. We run no advertising cookies and we build no profile of you. One of the entries above is a third-party script that judges whether a page is being used by a person or by a script: Google's reCAPTCHA on the forms named above.

A Global Privacy Control signal from your browser is read on every request and treated as an opt-out of advertising and cross-site measurement. It overrides the switch on Your Privacy Choices in the one direction that protects you: a browser sending it stays opted out even if that switch was previously turned off.

Blocking essential cookies stops you signing in.

How long we keep it

• Account and profile. For as long as your account is open. Closing it from your account settings removes your profile and your saved addresses. Two things are not touched. Your support requests stay, held against the address they were filed under rather than the account, so a conversation about an order survives the account closing in the middle of it. The mailing list is held the same way, so closing the account does not unsubscribe you.
• Order and tax records. Seven years. Federal and South Carolina tax rules require us to keep business records for several years after the tax year they belong to, and seven is the longest of those windows. We keep these even after an account is closed.
• Support requests. Kept as the record of the conversation, including after you close your account. Ask us to erase one and we will, unless it is attached to an order we are required to keep.
• Newsletter signups. Until you unsubscribe. When you do, we keep the address marked as unsubscribed rather than deleting the row, so a later signup form or an imported list cannot put you back on. Ask us to erase the record entirely and we will.
• Server logs. A short operational window, then discarded by our host on its own schedule.
• Rate-limit counters and security tokens. Minutes. They expire on their own.
• Backups. Copies of deleted data can survive in encrypted database backups until those age out on our database provider's schedule.

How we protect it

• Traffic to the site is encrypted in transit, and so are our database connections.
• Passwords are hashed by Supabase. Nobody here can read yours.
• The cookie that holds your session cannot be read by script in the page.
• Database access is deny-by-default. Row-level security is enabled on our tables, so one customer's records are not reachable from another customer's session.
• The admin side of the site is a separate sign-in on an allow-list, and it requires an authenticator code as well as a password.
• Sign-in, registration and password reset are rate-limited and bot-protected.

No system is perfectly secure. If a breach ever affects your personal information we will notify you and the relevant authorities as the law requires.

Your privacy rights

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Depending on where you live, you may also have rights under state law.

California residents

Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to:

• Know what personal information we collect, use and disclose, and to receive a copy of it.
• Delete the personal information we hold, apart from records we are legally required to keep.
• Correct personal information that is inaccurate.
• Opt out of sale or sharing. We do not sell or share personal information. The switch at Your Privacy Choices is live, and we read Global Privacy Control on every request.
• Limit the use of sensitive personal information. The one category California treats as sensitive that we hold at all is your account log-in: the email address and the password that opens the account. We use it to sign you in and to keep the account secure, and never to infer anything about you, which is the use this right is about.
• Not be discriminated against for exercising any of these rights. We will not deny you service, charge a different price, or give you worse service because you asked.

What we collect falls into these California categories:

We collect all of it for the purposes listed under "How we use it", and we disclose it only to the service providers named above, for those purposes. We do not sell it and we do not share it for advertising.

We offer no financial incentive in exchange for personal information: no loyalty program, and no discount for your data. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their own direct marketing.

You may use an authorized agent. We will ask for proof of their authority and for enough information to verify your identity.

Everyone else

The rights above are written into California law. We extend the practical ones to every customer, in every state: see it, correct it, delete it, get a copy, and appeal a refusal.

We sell and ship only within the United States, so we do not offer GDPR or UK GDPR rights and do not hold ourselves out as offering our products to people in the EU, the EEA or the UK. If you are there and hold an account with us, ask us and we will handle your request the way we handle everyone else's.

How to make a request

Ask us on Contact us. Say what you want and give the email address on your account. You do not need an account to make a privacy request.

You can do some of it yourself. Your profile is editable from your account settings, the mailing list is a switch under Preferences, and closing the account is a control on that same page.

We may ask a question or two to confirm the request comes from you, and we will ask only for enough to match you to an account.

We respond within 45 days, which is what California law allows, and we apply that deadline to everyone. If we need the extension the law permits we will tell you before it runs out. There is no charge, unless a request is repetitive or excessive. If we decide one is, we will tell you why and what it would cost before we do anything.

If we turn a request down, you can appeal. Send a second request saying you are appealing and why. A refusal will always say which part of the request was refused and on what basis. We answer an appeal within 45 days.

Do Not Track

Browsers send a "Do Not Track" header inconsistently and no common standard says what a site should do with it, so we do not act on it. The signal we do act on is Global Privacy Control, described above.

Where your information is

We are a United States business and our service providers store data in the United States. If you use the site from outside the US, your information is transferred to and processed here, where privacy law is not the same as it is at home. Our providers may run infrastructure elsewhere for resilience. Where they do, the data-processing terms we hold with them govern it.

Children

This site is not for children. We do not knowingly collect personal information from anyone under 13, and the age rule for holding an account is in our Terms of Service. If you believe a child under 13 has given us personal information, tell us and we will delete it.

Changes to this policy

When this policy changes we update the "Last updated" date at the top of the page. If a change materially affects how we use your personal information, such as a new purpose or a new kind of recipient, we will email account holders before it takes effect. We will provide the previous version on request.

How to contact us

Privacy questions, requests, complaints and legal notices all go to Contact us.

Requests you have already sent are on Your requests when you are signed in.