Privacy Policy

This Privacy Policy explains what information New Game Plus Ultra, Inc. ("we", "us") collects through Grail Mix, how we use and share it, and the choices you have. It applies to grailmix.io and the Grail Mix service. Grail Mix is a United States service for United States residents aged 18 and over.

1. What we collect

Account information: your email address, your name as provided by your sign-in method (such as Google), and, if you register a passkey, its public key — never a password from another service. Transaction and claim records: your credit balance and its history, packs you open, Vault Claims you hold, sell-backs, redemptions, and shipments, all recorded on an append-only ledger. Addresses: the shipping addresses you provide for redemptions, and the shipping address you keep on your account when you buy from a shop that delivers automatically; sales tax is calculated on the shipping address, so we collect no separate billing address. Verification status: where identity verification applies, our verification provider tells us the outcome (verified or not); your identity documents go to the provider, not to us. Support communications you send us. Technical data: IP address, browser and device information, timestamps, and security logs generated by using the service, plus error diagnostics collected by our monitoring tooling.

Invitations: when you invite a friend to Grail Mix, we collect the email address you enter for them, the name you choose to show them (or, if you leave it blank, your own email address, which the invitation then shows instead), and whether the invitation was accepted.

What we do not collect: your full payment-card number never touches our systems — payments are handled by our payment providers on their own systems. We use no advertising trackers, and we never sell or share your information for advertising.

Product analytics and session replay: we use PostHog, a product-analytics provider, to understand how Grail Mix is used — which pages people reach, which steps they complete, and where they get stuck. PostHog sets cookies and stores data in your browser to recognize your device between visits, and it records a replay of how pages are used so we can watch where a step goes wrong. Those replays are masked in your browser before anything is sent: everything you type, your credit balance, card values and your shipping address are blanked out and never leave your device. Separately from replays, PostHog may receive the other information described in this section — your account information, your transaction and claim records, and our payment provider's records of your credit purchases, which can include the name, email address and billing details you give that provider — so that we can study how Grail Mix is used alongside them. Besides these analytics cookies, the only cookies we set are the session and security cookies required to sign you in and keep your account safe.

2. How we use information

We use the information above to operate Grail Mix: maintaining your account and ledger, processing credit purchases and pack openings, coordinating custody, sell-backs, and shipments, calculating tax, and providing support. We use it to protect the service and comply with law: detecting fraud and abuse, screening against sanctions lists, meeting anti-money-laundering obligations, and keeping the records tax and financial rules require. We use it to understand how Grail Mix is used and to improve it. We send transactional email about your account and activity. We send marketing email only if you opt in, with one exception: when a member or the Grail Mix team invites you, we send you an invitation email at their request, and never more than one a day. Every marketing message, including an invitation, includes an unsubscribe link, and once you unsubscribe we send no further invitations to that address, whoever sends them. We do not sell your personal information, we do not rent it, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

We share personal information only as needed to run the service: with the payment provider that processes your credit purchases (currently Stripe, and its financial partners) and our tax and payments infrastructure (Stripe); with our identity-verification provider when verification applies; with the holding shop — it receives your name and shipping address when it fulfils a redemption, whether you requested it or it occurred automatically, and passes them to the carrier it ships with, and if we ever wind down it receives them so that it can deliver the cards you hold claims on; with Google's Places service, which receives the text you type when you use address suggestions on the redemption form; with our infrastructure providers (hosting on Vercel, database on Neon, transactional email via Resend, error monitoring via Sentry, and product analytics and masked session replay via PostHog, which also receives the account, transaction and payment-provider records described in Section 1); and with your sign-in provider (such as Google) to authenticate you. Each provider processes your data to provide its service to us. We also disclose information where the law requires it — including tax reporting, and responses to valid legal process — to protect the rights, safety, or property of users, the public, or the platform, and as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred data.

4. How long we keep it

We keep account information while your account is open. The ownership ledger is append-only by design, and financial, tax, and anti-money-laundering records are kept for as long as the law requires — typically seven years — even after your account closes. Technical logs and error diagnostics are kept for shorter operational periods. Product analytics data — including the records PostHog receives and session replays — is kept for up to seven years. When retention ends, records are deleted or de-identified. When you unsubscribe from invitations we keep a one-way hash of your email address, not the address itself, for as long as the service runs, so that we can honor your choice.

5. Your choices and rights

Wherever you live, you can: request a copy of the personal information we hold about you; ask us to correct it; ask us to delete it; and ask us to close your account. Send requests to support@grailmix.io from your account email; we will verify the request, respond within 45 days, and never discriminate against you for exercising these rights. An authorized agent may submit a request on your behalf with proof of authorization. Deletion has limits we cannot waive: records the law requires us to keep — the ledger, tax records, sanctions and anti-money-laundering records — are retained for their required periods and deleted when those periods end. Because we do not sell or share personal information for advertising, there is nothing to opt out of under state "do not sell or share" rights, and browser signals such as Global Privacy Control have nothing to switch off — but we honor the spirit of those signals, and this paragraph is our standing commitment not to sell.

6. Security

We protect personal information with industry-standard measures: encryption in transit, hashed session tokens, passkey support, access controls, and append-only financial records. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affects you, we will notify you as applicable law requires.

7. Children

Grail Mix is for adults 18 and over. We do not knowingly collect information from anyone under 18, and if we learn we hold information about a child under 13 we will delete it promptly.

8. Where data is processed

Grail Mix operates from the United States and our providers process data primarily in the United States. Some providers may process limited data in other countries under their own safeguards; we choose providers that commit to appropriate protections.

9. Changes to this policy

We may update this policy as the service evolves. Each version carries the version number and effective date shown at the top of this page, and we will notify you of material changes in the app before they take effect. Earlier versions are available on request.

10. Contact

Privacy questions and requests: support@grailmix.io. Legal notices: legal@grailmix.io. New Game Plus Ultra, Inc., a Delaware corporation.