Privacy Policy

The Arsenal Zone is operated by Infinite Gaming Respawn ("we", "us"). This page explains what we collect when you use thearsenalzone.com, why, and what you can do about it. We have tried to describe what the site actually does rather than what a template says it might.

The short version

• We collect what we need to sell you cards and get them to you — nothing else.
• We do not run analytics, advertising, or tracking cookies of any kind, so there is no cookie banner.
• We never sell or rent your information.
• We never see your card number. Payment happens entirely at PayPal.

What we collect

If you buy something

• The email address you enter at checkout, so we can send your receipt and reach you about the order.
• Your shipping name and address, which PayPal passes to us after payment so we can post the parcel.
• The name and email address on your PayPal account, which PayPal returns with the payment.
• What you bought, what you paid, the shipping and sales tax applied, any discount code used, and the PayPal transaction reference.
• The tracking number once the parcel ships.

If you create an account

• Your email address and, if you give one, your name.
• A cryptographic hash of your password — never the password itself. We cannot read it or recover it for you.
• If you use "Continue with Google": your Google account identifier, email address, name and profile picture URL. We never receive your Google password.
• Whether you asked for marketing email.
• Cards you save to your favourites.
• The date you last signed in.

Automatically

• Standard web server logs, including your IP address and browser user-agent, kept for security and troubleshooting.
• A session cookie so your cart and sign-in survive between pages.
• A security cookie that protects forms against cross-site request forgery.
• A cookie remembering whether you chose the light or dark theme.

Those three cookies are strictly necessary or purely functional. We do not set analytics, advertising, or cross-site tracking cookies, and we do not embed any third-party tracking pixels.

Who else sees it

We share information only with the services required to run the shop:

• PayPal — processes payment and supplies the delivery address. Their handling of your data is governed by PayPal's own privacy policy.
• Google — only if you choose "Continue with Google". The site also loads its typefaces from Google Fonts, which means Google receives your IP address when a page loads.
• Amazon Web Services — hosts the site and sends our email (Amazon SES). Order confirmations, password resets, shipping notices and any marketing email pass through it.
• Shipping carriers — receive the name and address on your parcel.

We do not sell, rent, or trade your personal information to anyone, and we do not share it for anyone else's advertising.

Marketing email

We only send marketing email to people who explicitly asked for it by ticking the box when creating an account. Buying something does not put you on that list.

Every marketing email has a working unsubscribe link, and your mail app's own "unsubscribe" button works too. You can also turn it off any time from your account settings, or just email us. Unsubscribing is immediate and permanent unless you opt back in.

Order confirmations, shipping notices and password resets are not marketing — they are part of a transaction you started, so they are sent regardless of your marketing preference.

How long we keep it

• Orders are kept as business and tax records, including the shipping address and amounts.
• Accounts are kept until you close them.
• Sessions expire after 24 hours.
• Password reset links expire after one hour and are single-use.
• Stock holds placed during checkout lapse after 20 minutes.

Your choices

• See what we hold — your account page shows your details and order history. Email us for anything else.
• Correct it — update your name and email preference from your account settings.
• Close your account — there is a "Close my account" option in your account settings. It deletes your account, your saved cards and your email preferences immediately.
• Past orders survive account closure. We are required to keep records of completed sales, so those are unlinked from your account rather than deleted. They stop being associated with a login, and you will no longer be able to view them on the site.
• Unsubscribe — see above.

Security

The whole site is served over HTTPS. Passwords are stored using bcrypt. Card numbers never touch our servers — PayPal handles payment end to end. Sign-in and password-reset attempts are rate limited, and the admin area is restricted to named accounts.

No system is perfectly secure. If you believe your account has been accessed by someone else, change your password and email us straight away.

Children

This shop is intended for adults. It is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has given us personal information, email us and we will delete it.

Where we operate

We ship within the United States only, and the site is hosted in the United States. If you visit from elsewhere, your information is processed in the US.

Changes

If this policy changes we will update the date at the top of this page. For anything significant that affects how we use information we already hold, we will tell account holders by email.

Contact

Questions about this policy, or about information we hold on you:

Infinite Gaming Respawn
2819 Lee Ave
Sanford, NC 27332
United States
support@thearsenalzone.com
(919) 566-0006

Terms of Service · Shipping & returns · Contact