Privacy
Last updated October 7, 2026
We collect only what we need to take your order, ship it and keep the shop safe. We never sell your information.
What we collect
- When you order: name, email, shipping address and (if you give it) phone number, collected by Stripe in checkout, plus what you bought.
- Payment details: handled entirely by Stripe. Your card number never touches our servers.
- When you check out: your IP address and browser type, used to stop bots, card fraud and people hoarding cards. If our bot check is switched on, Cloudflare Turnstile also checks your browser.
- Your cart: saved in your own browser (local storage) so it's still there when you come back. We don't use advertising or tracking cookies.
- If you use the chat: your messages, the email address you leave (if you leave one), your IP address and browser type, kept so we can answer you and stop abuse. Anna, the chat's AI helper, runs on Anthropic's Claude, so what you write in the chat is sent to Anthropic to write her replies.
- Selling us cards: when you send a sell request we keep your name, email, city and your list (and the e-Transfer email if it's different) to quote and pay you, and with our business records after that. We also log your IP address and browser type with the request to stop abuse.
- The Wanted board: when you post there we keep the email of your account (never shown on the board), your display name, the city or region you give, your card list and note, and when you agreed to the board rules. When someone uses "Contact this collector", we keep their name, email, IP address and browser type, and their message, and we email the message to the poster with the sender's email as the reply-to address, so the poster can answer directly (the poster then sees the sender's email; the sender sees the poster's only if the poster replies). We only send these messages to posters who asked for them when posting, and no copy goes to the sender. We read a message only if someone reports it. Message texts are erased about 30 days after sending unless reported. A deleted post leaves the board at once; we keep a record of it (shown nowhere) to deal with abuse, and you can ask us to erase it.
Who helps us run the shop
- Stripe: payments
- Supabase: our database
- Vercel: website hosting
- Resend: order emails, chat notifications, sell requests and Wanted board messages
- Anthropic: Anna, the chat's AI helper
- TCGdex: card pictures on the Wanted board (your browser loads them from TCGdex)
- Cloudflare: bot check
- Canada Post: delivery (name and address on the envelope)
Some of these companies store data outside Canada, including in the United States.
How long we keep it
We keep order records for as long as Canadian tax law requires (up to 6 years). We delete the log of checkout attempts after 3 days. We delete chats 12 months after the last message.
Your rights
You can ask to see, correct or delete your information at any time by emailing us. We follow Canada's privacy law (PIPEDA).
Contact
PokemonPack, Kingston, Ontario, Canada · pokemaster@pokemonpack.com. We usually reply within one business day.