This policy explains how MortalPins ("we", "us") handles personal information when you use mortalpins.com, shop, play the Nexus card game, or trade with other collectors. We collect only what we need to run those features.
What we collect
When you create an account
- Your email address, username and password (stored only as a secure hash).
- Optional details you add: a phone number and a profile photo.
- What you do on the site: artifacts you own and unlock, Power, rank, badges, rewards, likes, votes, trades and offers, card game progress, chronicle reading progress, and feedback you send.
- Messages you send to friends, and your friends list.
When you place an order
- Your order: items, totals, invoice number, status, tracking number and any promo or referral code.
- For guest checkout, your name and email, so we can send your receipt and let you look the order up.
- Your shipping address and card details go to our payment processor, Square, to take the payment and fulfil it. We keep Square's payment reference on the order; we do not store your card number.
- How you found us (for example a campaign link or a friend's referral code), saved with the order.
When you subscribe or contact us
- Your email address for the newsletter, and anything you write to us.
Automatically
- Standard technical data such as your browser, pages visited and approximate usage, through cookies (see below) and our server logs.
How we use it
- To run your account and the features you use: unlocking pins, the Archive, the card game, trading, messaging and rewards.
- To process orders, take payments, ship orders and send receipts, tracking updates and order emails.
- To send the notifications you choose in Settings, and the newsletter if you subscribe (every email has an unsubscribe link).
- To credit referral and promo rewards.
- To keep the site secure, prevent fraud and abuse, and understand what to improve.
We do not sell your personal information.
Who we share it with
Only with services that help us run MortalPins, and only what each needs:
- Square processes payments and receives your payment and shipping details.
- Google provides reCAPTCHA on sign-in (to block bots), our email delivery (Gmail), and, when enabled, Google Analytics.
- Our hosting provider stores the site and its database.
- Other collectors see your username, avatar, rank and leaderboard standing, artifacts you list for trade, and your collection page if you make it public. Your email is never shown.
- Authorities, if the law requires it.
Cookies
- Sign-in and security: keep you signed in and protect forms from forgery.
- Session: remembers your cart and checkout for up to an hour of inactivity.
- Referral: remembers a campaign or friend's link for 30 days, so the right person is credited.
- Analytics (only if you accept): Google Analytics measures visits and purchases in aggregate. Until you accept in the cookie banner, no analytics cookies are set and Google only receives anonymous, cookieless signals. You can change your choice any time with Cookie settings (also in the footer).
You can block or delete cookies in your browser, but signing in and checkout need them.
How long we keep it
Account data is kept while your account is open. Order records are kept as long as needed for accounting, tax and refunds. Newsletter emails are kept until you unsubscribe. When you ask us to delete your account, we delete or anonymise your personal data, except what we must keep by law.
Your choices and rights
- Update your profile, email, password and notifications in Settings.
- Ask for a copy of your data, or for your account and data to be deleted, by emailing mortalpinsis@gmail.com from the address on your account. We reply within 30 days.
- Make your collection page public or private from your Dashboard.
- Unsubscribe from the newsletter from any newsletter email.
Depending on where you live, you may have other rights, such as to access, correct or object to processing. Contact us and we will help.
Security
Passwords are hashed, the site uses HTTPS, payments are handled by Square, and sign-in can use two-factor authentication. No system is perfectly secure, so please use a unique password and turn on two-factor in Settings.
Children
MortalPins is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as MortalPins changes. We will update the date above, and tell account holders about significant changes.
Contact us
Questions or requests: mortalpinsis@gmail.com.