Privacy Policy
Last updated: October 20, 2026
This Privacy Policy describes how live.cardboardmagic.io (the "Site"), operated by Cardboard Magic, Inc. ("we", "us"), collects, uses and discloses your personal information when you visit or buy from the Site, and the choices and rights you have.
Contact
If you have questions, want more information about our privacy practices, or would like to make a complaint, contact us by email at support@cardboardmagic.io or by mail at the address at the bottom of this page.
Information we collect
Information you give us
- Account and checkout details: username and email address, and for a full account your name, phone number and shipping address.
- Chat messages and the chat name you choose. Messages may be shown on the stream and in Twitch chat.
- Your profile picture, if you upload one.
- Messages you send us.
Information collected when you buy
Order contents, amounts, store credit, refunds, shipping and tracking details, and that you agreed to our Terms at checkout. Card and wallet details are entered into Stripe's payment form and go to Stripe, not to us; we receive a payment reference, the card brand and last digits, and fraud-screening results.
Information collected automatically
- Device and usage data: pages viewed, the link or site that referred you, approximate location from your IP address (country and region), and browser and device type.
- How you found us: campaign tags in the link you followed, ad click identifiers (from Facebook, Google or TikTok links), the referring website and the page you landed on, with the time. We keep this in our own cookie for 90 days and, when you check out, sign in or pick a chat name, save it with your profile and your first order, so we can see which channels bring customers.
- Cookies and similar technologies (see Cookies below).
How we use it
- To run the Site: process orders and payments, ship cards, provide store credit and refunds, run breaks, razzes, games, jackpots, the advent calendar and auctions, and show chat.
- To send receipts, shipping notices and account emails.
- To prevent fraud and abuse, and to handle disputes and chargebacks.
- To measure and improve the Site, and to understand which marketing works.
- Where allowed (see Your choices), to tell advertising platforms that a visit or purchase came from their ad, so we can measure our ads.
- To comply with the law and enforce our Terms of Service.
Who we share your data with
We use service providers who process data for us:
| Provider | What for | Data |
|---|---|---|
| Stripe | Payments, fraud screening and refunds | Payment details, email, order amounts, device data |
| Supabase | Database, sign-in and file storage | Account, order and chat data |
| Vercel | Hosting, and cookieless page statistics | Request data; page views without cookies |
| Google (Google Analytics) | Site analytics | Pages viewed, device, approximate location, cookie identifiers |
| Meta (only when we use it) | Advertising measurement | Page views; for purchases a one-way hash of your email and customer id, the ad click id, order value |
| Resend | Sending email | Email address and message content |
| Shippo and the carriers | Shipping labels and tracking | Name, address, phone and parcel details |
| Twitch | Live stream and chat bridge | Your chat name and the messages you send in chat |
We may also share information to comply with the law, to protect rights and safety, or as part of a business transfer. We do not sell personal information for money. Sharing data with advertising platforms for ad measurement may count as "selling" or "sharing" under some US state laws; you can opt out (see Your choices).
Cookies
| Cookie | Type | Lifetime | Purpose |
|---|---|---|---|
| Sign-in and cart cookies | Strictly necessary | Session to weeks | Keep you signed in, hold your cart and chat name |
| cml_consent, cml_region | Strictly necessary | 1 year / session | Remember your cookie choice and which rules apply where you are |
| cml_ft, cml_lt | Analytics (ours) | 90 days | The first and latest way you reached the Site |
| _ga, _ga_* | Analytics (Google) | Up to 2 years | Google Analytics |
| _fbp, _fbc | Advertising (Meta) | 90 days | Meta ad measurement, only when we use it |
Vercel's page statistics set no cookies.
Embedded content from other websites
The stream on the Site is embedded from Twitch. Embedded content behaves in the same way as if you had visited the other website: it may collect data about you, use cookies, and monitor your interaction with it, including when you have an account and are logged in to that website.
Your choices
- UK, EU/EEA, Switzerland and Québec: analytics and advertising cookies, and our own "how you found us" cookie, stay off until you choose Accept in our banner. You can change your choice any time with "Cookie choices" at the bottom of every page.
- Everywhere else, including the US: analytics and ad measurement are on by default. Use "Do Not Sell or Share My Personal Information" at the bottom of every page to turn advertising off in that browser.
- Global Privacy Control: if your browser sends this signal, we treat it as a request to opt out of selling or sharing and turn advertising off for that browser.
- Marketing emails, if we send any, include an unsubscribe link.
What rights you have over your data
You can ask for an exported copy of the personal data we hold about you, including data you gave us, and ask us to correct or erase it. This does not include data we must keep for administrative, legal or security purposes.
US state residents (for example California, Colorado, Connecticut and Virginia), as those laws provide: you can ask to know and access the personal information we hold, to correct it, to delete it, to get a portable copy, and to opt out of the sale or sharing of personal information and of targeted advertising. We will not discriminate against you for using these rights. You may use an authorized agent. If we deny a request, you can appeal by replying to our decision.
UK, EU/EEA and Swiss residents: we use your data to perform our contract with you (orders and accounts), for our legitimate interests (fraud prevention, security and improving the Site), to meet legal obligations (tax and accounting), and with your consent (analytics and advertising cookies). You can access, correct or erase your data, restrict or object to its use, ask for a portable copy, and withdraw consent at any time. Our providers may process data in the United States.
To make a request, email support@cardboardmagic.io. We confirm requests using the email on your account.
How long we keep your data
Order, payment and tax records are kept for as long as the law requires. Account data is kept while your account is active, and deleted or anonymised after a deletion request, except what we must keep. Our "how you found us" cookie lasts 90 days in your browser; the copy saved with your profile and first order stays with those records.
Security
We use access controls, encryption in transit, and Stripe for payments, so we never see full card numbers. No system is perfectly secure.
Minors
The Site is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has given us personal information, contact us at the address below to have it deleted.
Changes
We may update this Privacy Policy from time to time, for example to reflect changes to our practices or for other operational, legal or regulatory reasons. We post changes here and update the date at the top. If you would like to make a complaint, contact us using the details below. If you are not satisfied with our response, you have the right to complain to your local data protection authority.
Contact
Email support@cardboardmagic.io or write to: