Privacy Policy

This policy explains what personal information SCORCH LLC (“Scorch”, “we”, “us”) collects when you use scorchpacks.com, what we do with it, who we share it with, and what choices you have.

It covers our website and app, our digital collectible card product, and our promotional sweepstakes. Our sweepstakes are also governed by the Official Rules, and your use of the service is governed by our Terms of Service.

We keep a version identifier on this policy. Where you have accepted a specific version of this policy or of another notice, we keep a record of which version you accepted.

Scorch is only for people who are 18 or older. We ask you to confirm your age when you create an account, and we keep a record of that confirmation.

We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. If you believe a person under 18 has given us information, contact us at privacy@scorchpacks.com and we will remove it.

3.1 Account and sign-in

• Your email address.
• Your username.

There is no password. You sign in with a one-time code sent to your email address, or with a passkey if you set one up. We do not store passwords, because there are none to store.

3.2 Your age and eligibility confirmation

When you create an account you confirm that you are at least 18 and a legal resident of one of the fifty United States or the District of Columbia. We store, as a single record:

• that you checked the box;
• the date and time you did;
• the IP address you did it from;
• an identifier for the exact wording you agreed to.

3.3 Telephone number and verification

If you choose to claim your free sweepstakes entry, you give us a mobile telephone number and we send you a one-time code to confirm it is yours. We record that the number was verified.

We do not accept certain internet-based (“VOIP”) numbers for this purpose. If your number is not accepted, we will tell you that we could not verify it and point you to the free entry by mail.

3.4 Marketing consent

Text-message marketing is a separate and optional choice from the phone verification above. If you opt in, we store:

• an identifier for the exact consent wording you agreed to;
• the date and time;
• the IP address;
• the telephone number the messages go to.

You can withdraw this consent at any time. Withdrawing it does not affect any sweepstakes entry you have already received.

3.5 Purchases and payment

Card packs are paid for through a third-party payment processor. We do not store your card number. We receive and keep a record of the transaction — what was bought, when, the amount, and whether it was refunded — but the card details themselves are handled by the processor under its own terms.

3.6 Your collection and in-product activity

We keep a record of the cards in your account: which cards you hold, when you obtained each one, how you obtained it, and the serial number of any numbered card.

Where you use a Recipe to combine cards, we keep a permanent record of that action: the cards consumed including their serial numbers, the time, what was produced, and the version of the Recipe used. Recipes permanently consume cards, so this record is how the change to your collection is accounted for and cannot be reconstructed later.

3.7 Usage records

We keep a time-stamped record of:

• Binder opens;
• card detail views;
• Recipes run;
• family completions;
• set completions.

These records are kept against an internal account identifier — never against your name, your email address or your telephone number. That is deliberate, and section 11 explains what it means when you ask us to delete your information.

They are also more than analytics. See section 5.

3.8 Sweepstakes entries and the entry record

We keep a record of the entries associated with your account and how each one arose.

If you enter free of charge by mail, the postcard you send carries your full name, email address, telephone number, state of residence and year of birth, and we keep the postcard or an image of it together with a log reconciling what we received against what was entered. That log also records items that arrived too late to be entered.

3.9 Winner verification and prize fulfilment

If you are selected, we will need more from you before a prize can be awarded: a signed eligibility affidavit and liability release, a publicity release except where that is not permitted, a delivery address, a telephone number if we do not already have one, and any tax documentation we are required to collect.

Some of that is sensitive, and we handle it separately. Tax documentation can include a taxpayer identification number. It is collected and held by a third-party tax-documentation and information-reporting service, not stored with your account records. We collect it only from a confirmed winner, only because prize awards have to be reported, and we do not ask any other entrant for it.

3.10 Support and feedback

If you send us feedback through the app, we keep what you wrote, any category you chose, and the fact that it came from your account. We do not ask for contact details in that form — we already know which account it came from. If you contact support, we keep that correspondence.

3.11 Device and technical information

When you use the service we receive ordinary technical information: IP address, browser and device type, and the pages or screens you loaded. If something goes wrong while you are using the service, we also receive an error report describing what failed and the technical state of the page at the time. Error reports are kept against the same internal account identifier as section 3.7, never against your name or contact details, and never include what you typed into a form. If you turn on push notifications, we store the subscription your browser gives us so that we can send them; that subscription stops working if you clear site data, reinstall, or withdraw permission.

We use personal information to:

• create and secure your account and sign you in;
• deliver the cards you buy and maintain your collection and its history;
• run our promotional sweepstakes — record entries, conduct drawings, verify and contact winners, and award prizes;
• confirm that entrants are eligible;
• send you the messages you have asked for, and service messages you have not opted out of, such as sign-in codes, purchase confirmations, and sweepstakes notices;
• provide support and handle refunds;
• detect and prevent fraud, automated entry, duplicate accounts and abuse;
• keep the records described in section 5;
• understand how the product is used and decide what to build; and
• comply with law.

We want to be direct about this, because it is unusual and it affects how long we keep things.

Our cards are a product you buy because you want the cards. The sweepstakes rides on top of them and no purchase is ever necessary to enter or win. We are required to be able to demonstrate that — that customers genuinely use what they bought, rather than buying only for a chance at a prize.

The records in section 3.7, together with the collection and Recipe records in section 3.6, are how we demonstrate it. They cannot be reconstructed after the fact, which is why we keep them rather than only counting them.

That means these records are retained for compliance purposes and not only for product analytics, and we keep them for five (5) years from creation.

If you enter by mail, the telephone number on your postcard is used solely to try to reach you if you are selected as a potential winner.

It is not used for marketing. We do not send automated calls or text messages to it. It is not added to any marketing list, and providing it does not opt you in to anything.

Some information is published, and you should know which:

• If you complete the Genesis set, your username and your completion number appear on a public completion wall.
• If you win a sweepstakes prize, we publish your first name, last initial, city and state, and we respond to written requests for the winner’s name as the Official Rules require.
• Accepting a prize also carries the publicity permission described in the Official Rules, which allows us to use your name, city and state, likeness, voice, statements and photographs or recordings of the award. Where the law does not allow us to require that, we do not.
• Aggregate, non-identifying information about card supply and how many accounts hold cards of a given type may be published. This does not identify individual account holders.

We do not publish your email address, telephone number, date or year of birth, street address, or purchase history.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not run third-party advertising trackers on the service.

We use cookies and similar storage for a small number of purposes:

• Strictly necessary — keeping you signed in, keeping your session secure, and remembering choices you have made in the interface.
• Fraud and abuse prevention — a third-party service that helps us tell people from automated scripts.
• Product measurement — understanding how the product is used, as described above.

We do not use advertising cookies. Your browser lets you block or delete cookies; if you block the strictly necessary ones, sign-in will not work.

We share personal information with service providers who process it on our behalf and only on our instructions. By category, these are:

• payment processing;
• tax form collection and information reporting;
• email delivery;
• text-message delivery;
• push notification delivery;
• hosting, storage and database services;
• error monitoring and service reliability;
• fraud, bot and abuse prevention;
• customer support tooling;
• mail handling and scanning for postal entries;
• prize sourcing and shipping;
• analytics and product measurement;
• professional advisers, including legal and accounting.

We also disclose information where the law requires it, in response to lawful requests, to protect our rights or someone’s safety, and in connection with a merger, financing or sale of the business — in which case the recipient remains bound by this policy or gives notice of a new one.

Sweepstakes entries are administered by us. We do not use a third-party sweepstakes administrator.

We keep personal information for as long as we need it for the purposes described here, and then delete it or sever its link to you.

• Account information — for as long as your account exists, and for 90 days after it is closed, after which it is deleted. Records held under the lines below, or required by tax law, are kept for the periods stated there instead.
• Usage, collection and Recipe records — five (5) years from creation, for the compliance reason in section 5.
• Sweepstakes entry records, including mail-in entries and the reconciliation log — four (4) years after the drawing.
• Winner documentation and tax records — for the period the law requires us to keep them. Tax documentation is held by the third-party service described in section 3.9, under that service’s retention arrangements.
• Consent records — age confirmation and marketing consent, for as long as we rely on them and afterwards for as long as we may need to show that consent was given.

What happens when you ask us to be deleted

Usage records are stored against an internal account identifier and never against your name or contact details (section 3.7). That design exists so that deletion can be real without destroying the compliance record.

When you ask us to delete your personal information, we do two things:

1. We delete the personal information in your account record — your email address, your username, your telephone number, and the other identifying details described in section 3.
2. We sever the link between you and the usage records. The events themselves survive, with no identifier that reaches back to you. They continue to exist as aggregate evidence that the product is used; they no longer describe a person.

The result is that the events survive and you do not. We are not keeping a shadow copy of you under another name, and we are not pretending to delete a record we still need.

One consequence you should know before you ask. Because we no longer have an account to return anything to, if a purchase of yours is refunded after your account is deleted, the money comes back but the cards cannot. Any card restoration that would ordinarily follow a refund under the Terms of Service simply has no destination. This is set out in Terms of Service section 7.3.

A small number of records survive deletion in identifiable form because the law or a completed drawing requires it — winner documentation, tax records, and the entry record for a drawing that has already been held. Where that applies to your request, we will tell you which records and why.

Backup copies. We keep copies of our database for disaster recovery. Each copy is kept for no more than 90 days and is then destroyed. A deletion is made in the live database when we act on your request and reaches the backup copies as they expire. Those copies are encrypted before they are stored, and the encrypted copy is the only one we keep.

If you live in California, you have the rights below. Exercising them costs you nothing and we will not treat you differently for using them.

• Know and access — ask what personal information we hold about you, where we got it, why we have it, and who we have disclosed it to.
• Get a copy — receive a copy of the information you gave us, in a portable form.
• Delete — ask us to delete personal information we hold about you. Section 11 describes exactly what we delete and what we sever, and names the narrow categories the law requires us to keep.
• Correct — ask us to fix information that is inaccurate.
• Limit the use of sensitive information — restrict our use of sensitive personal information, such as a taxpayer identification number, to what is necessary to provide the service.
• Opt out of sale or sharing — we do not sell or share personal information for advertising, so there is nothing to opt out of. If that ever changes, we will say so here and provide a way to opt out before it does.

How to exercise them. Email privacy@scorchpacks.com, or write to us at SCORCH LLC, 25 SE 2nd Ave #550-256, Miami, FL 33131. We will ask you to verify that the account is yours, usually by confirming control of the email address on it, because we will not hand your information to someone else. An authorised agent may act for you if you give them written permission and we can verify it.

We respond within the time the law allows, and we will tell you if we need longer.

If we refuse, we will tell you why, and you may ask us to reconsider by replying to our response.

Several other states give residents rights that are broadly similar — to know what we hold, to get a copy, to correct it, to have it deleted, to opt out of sale or of targeted advertising, and not to be treated worse for asking.

We apply the same process to everyone. If you live in a state with a privacy law, use the contact details in section 12 and we will handle your request under your state’s law. Some states also let you appeal a refusal; if yours does, our response will tell you how.

We protect information with access controls, encryption in transit, and limits on who inside the company can see what.

Two things help more than any control we could add:

• There are no passwords to steal, because we do not use them.
• We never see your card number.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the authorities as the law requires.

If we change this policy we will update the version identifier and the “last updated” date at the top.

If a change materially affects how we use information we already hold about you, we will tell you before it takes effect — by email to the address on your account, and by a notice in the app — at least 30 days in advance.

A change to this policy does not change the Official Rules of a sweepstakes that is already open. Those are fixed when the promotion opens.

Ask us anything about this policy at that address, and we will answer.