Privacy Policy

We collect information you provide to us directly, including:

• Account information: name, email address, and a hashed password when you create an account.
• Order information: billing and shipping address, items purchased, order totals, and fulfillment preferences (in-store pickup or shipping).
• Payment information: processed by our PCI-DSS compliant payment processor. We never see or store full card numbers, CVVs, or bank credentials on our servers.
• Loyalty program data: point balances, reward redemptions, and event participation.
• Communications: the contents of emails or voicemails you send us.

We also collect limited technical information automatically when you visit our site: IP address, browser and device type, referring URL, pages viewed, and timestamps. This is used to operate the site, prevent fraud, and improve performance.

We use the information we collect to:

• Process and fulfill orders, including in-store pickup and shipping.
• Communicate with you about your account, orders, and store events.
• Operate our loyalty program and apply reward vouchers.
• Prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations (e.g., sales tax, recordkeeping).
• Improve the security, reliability, and design of our services.

We do not sell your personal information. We share information only with service providers who need it to operate our business, under contractual confidentiality obligations:

• Payment processors for completing transactions.
• Shipping carriers for delivering ordered products to you.
• Hosting and infrastructure providers that run our website, database, and email systems.
• Law enforcement or regulators when legally required (subpoena, court order, or fraud investigation).

We use cookies and similar technologies that are strictly necessary to operate the site. We do not use third-party advertising cookies. The cookies we set are:

• Session cookies (access and refresh tokens): HttpOnly, used to keep you signed in. Cleared when you sign out.
• CSRF token (tccny_csrf): rolling 7-day cookie used to protect mutating requests from cross-site forgery.
• Cart cookie: remembers the contents of your cart between visits.
• Device id (tccny_did): a randomly generated HttpOnly cookie that lasts up to two years. We use it to recognize the browser you sign in from (not who you are) so we can record which devices have used a given account, detect session hijacking, and — if we need to ban a customer for fraud or abuse — block that specific browser in addition to the account. The value is meaningless on its own and is never shared with third parties.

We protect your information with industry-standard safeguards. Passwords are stored as one-way salted hashes (we never store plaintext). Authentication payloads are transmitted using end-to-end RSA-OAEP encryption so passwords never appear in plaintext on the wire, even within HTTPS. All connections use TLS, and we apply HSTS, CSP, and CSRF protections to mitigate common web attacks.

No system is perfectly secure. If you suspect unauthorized activity on your account, contact us immediately.

We keep account and order records for as long as needed to operate the business and to meet tax, accounting, and legal obligations. You can request deletion of your account at any time, subject to those legal retention requirements.

Depending on where you live, you may have the right to access, correct, or request deletion of your personal information, and to object to certain processing. To exercise any of these rights, email us at info@cardcollectiveny.com.

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our services after changes are posted means you accept the updated policy.

If you have questions about this policy, contact us at:

The Card Collective NY
178 W Main St
Patchogue, NY 11772
Email: info@cardcollectiveny.com
Phone: (631) 740-0723