Privacy Policy

1. Information we collect

• Account information: Your name, email address, email-verification status, and a securely hashed password when you register with email. We never store your plaintext password. If you use Google, Microsoft, or GitHub, we also receive the basic profile and authentication information that provider shares with us.
• Shipping information: The name and US shipping address you enter when claiming a slot.
• Order history: The case splits and figures you claim, amounts paid, claim and refund status, timestamps, and USPS tracking number.
• Payment records: Stripe transaction identifiers, payment amount, and payment or refund status. Stripe collects and processes your card or other payment details. SplitCrate never sees or stores your full card number.
• Session and security information: Information needed to keep you signed in and protect the service, such as a session identifier, IP address, browser or device user agent, and security logs.
• Messages you send us: If you contact support, we receive your email address and whatever information you include in the message.

2. How we use information

We use personal information to:

• create and secure your account;
• hold your figure slot and keep your claim status up to date;
• process payments, withdrawals, and refunds through Stripe;
• open, pack, and ship the correct figure to your address;
• send order confirmations, case updates, refund notices, and tracking emails;
• answer support requests and investigate delivery or payment problems;
• prevent fraud, abuse, and security incidents; and
• meet legal, tax, accounting, and consumer-protection obligations.

We do not use your information for targeted advertising or build advertising profiles about collectors.

4. Services that help us run SplitCrate

We share only the information each provider needs to do its job:

• Stripe processes payments and refunds. Stripe receives your payment details, and its privacy policy applies to that information.
• Resend sends transactional emails such as account verification, password resets, claim confirmations, refunds, case updates, and shipping notifications. It receives your email address and the contents of those messages. See Resend’s privacy policy.
• Cloudflare hosts the site, database, and product images and provides CDN, Turnstile bot detection, rate limiting, and other security services. Cloudflare may process standard request, IP, device, challenge, and security logs. See Cloudflare’s privacy policy.
• Google, Microsoft, or GitHub handles the sign-in method you select. We ask the provider for the basic account information needed to create your SplitCrate account: your name, email address, profile photo, and provider account identifier. The provider’s own privacy policy applies to its service.
• USPS receives the name, shipping address, and shipment details needed to deliver your package and provide tracking.

We may also disclose information when required by law, to protect collectors or the service from fraud or harm, or as part of a business transfer such as a merger or acquisition. We do not give third parties permission to use your information for their own advertising.

5. Where information is stored

Account, session, order, claim, and shipping information is stored in Cloudflare D1, a SQLite database running on Cloudflare’s network. Cloudflare automatically encrypts all D1 objects at rest and protects data in transit using TLS. This means shipping addresses stored in D1 are encrypted at rest.

Product images are stored in Cloudflare R2. These are catalog images, not your personal photos. A profile photo provided by your sign-in provider may be displayed from that provider’s image URL.

No online service can promise perfect security, but we use reasonable technical and organizational safeguards designed to protect your information and limit access to people and providers that need it.

6. How long we keep information

We keep your information while your account is active so you can see your order history and we can complete your case splits. If you ask us to delete your account, we will delete or de-identify your personal information from our active systems within 30 days.

We may keep limited records longer when reasonably necessary to complete an order, process a refund, prevent fraud, resolve a dispute, enforce our agreements, or meet tax, accounting, or legal requirements. Our service providers may retain information under their own legal obligations and retention policies.

7. Your choices and rights

You may ask to access, correct, or delete your personal information by emailing support@splitcrate.com. You may also ask for a portable copy of information connected to your account. We may need to verify your identity before completing a request so we do not give account information to the wrong person.

You can reset an email account password from the sign-in page. You can stop transactional emails by closing your account, but we may still send messages needed to finish an existing order, provide a refund, respond to you, or meet a legal obligation. You can disconnect SplitCrate from your Google, Microsoft, or GitHub account through that provider’s settings; doing so may prevent future sign-ins.

8. California privacy rights

California residents may have rights under the California Consumer Privacy Act, as amended (CCPA), including the right to know what personal information we collect and how we use it, access specific information, correct inaccurate information, request deletion, and receive equal service when exercising privacy rights. An authorized agent may submit a request for you, but we may ask for proof of authorization and identity verification.

SplitCrate does not sell personal information or share it for cross-context behavioral advertising, so there is no sale or advertising-based sharing to opt out of. We use sensitive information, such as account credentials and shipping details, only as reasonably necessary to provide and secure the service.

To make a California privacy request, email support@splitcrate.com with the subject “California Privacy Request.”

9. Children’s privacy

SplitCrate is for adults 18 and older. We do not knowingly collect personal information from children or allow minors to create accounts. If you believe a minor has given us personal information, email support@splitcrate.com and we will investigate and delete it.

10. Changes to this Policy

We may update this Policy as SplitCrate or privacy law changes. We will post the updated version here and change the “Last updated” date. If a change meaningfully affects how we use personal information, we will provide reasonable notice, such as an email or a notice on the site.