Privacy policy

Effective October 28, 2026

Scope and operator

Papa Joey’s Collectibles operates papajoeys.com, Papa’s Pockets and related support services. This policy covers personal information reasonably linked to you. It distinguishes our Shopify storefront from the native iPhone app and applies to our processing, while independent providers may have their own notices. Contact: papajoey@papajoeys.com, 619.312.4622, 1640 Camino Del Rio N STE 200, San Diego, CA 92108.

Information we collect

Depending on the service used, information may include contact/delivery details; Apple sign-in identifier and email or private relay email; account identifiers, authentication/session records and preferences; orders, card ownership/custody records, market estimates, sell-back quotes and applicable transaction references; support communications and photos you choose to provide; and device, network, security and usage information generated when accessing the Services.

Where payment or shipping is enabled, processors/carriers handle the information needed for that transaction. We receive the necessary status, reference and limited transaction/delivery details. The native app is not intended to store your full payment card number, card security code, bank password or Apple Account password. Features not yet enabled do not imply that we already collect all such data.

Some preferences, optional local profile/photo features and cached reference artwork are stored on your device and may be included in its backups. Real customer account, order and ownership records are also stored on our servers; they are not described as fictional or device-only. Internal storage codes link physical card tags and shelf locations to records without requiring customer names or email addresses on shelf labels.

Sources and purposes

We collect information you supply, information generated by your use of the Services, and information received from providers such as Apple authentication, hosting, storefront, payment and delivery services where used. We use it to authenticate accounts; maintain orders and ownership; locate and safeguard cards; provide pricing/quotes; process enabled transactions; fulfill paid shipping requests; send service notices; answer support requests; investigate fraud; maintain security; and satisfy legal obligations.

Marketing, optional analytics or advertising uses must be described and supported by required choices/consent. The current native build does not include a third-party advertising SDK or cross-app advertising tracking. The website’s Shopify/marketing features may have different data practices; do not assume a website marketing opt-out changes every independent provider’s processing.

Providers and disclosures

Shopify supports the web storefront and may provide its enhanced advertising/shopping features as configured for that storefront. Apple provides authentication and related platform services; Supabase supports protected account/record storage; Vercel hosts app backend/admin services. Card identifiers and variant information are used with pricing/catalog providers such as JustTCG and TCGdex. Fetching reference images from a provider/CDN may expose ordinary network information such as an IP address to that provider.

We do not need to send a customer’s name, email or card-ownership history to JustTCG merely to request a card variant’s market price. Staff identification/confirmation metadata and any separately authorized documentation photos are distinct from canonical reference artwork. Employee photos are not automatically turned into public catalog art or an enabled model-training pipeline.

When activated, approved payment, identity-verification and shipping providers receive the details needed to perform their services. We may disclose information to support/security providers, where you direct us, to comply with valid legal process, to protect rights/safety, or in a business transaction subject to applicable protections. We do not publish customer custody locations or make other customers’ records generally accessible.

Shopify, cookies and advertising choices

The web storefront uses Shopify and may use cookies and enhanced features that process activity across merchants as explained by Shopify. Review Shopify’s Consumer Privacy Policy at https://www.shopify.com/legal/privacy/app-users and its privacy portal at https://privacy.shopify.com/en. Our web opt-out page is https://papajoeys.com/pages/data-sharing-opt-out.

Where applicable, a valid Global Privacy Control signal is treated as an opt-out as required by law and supported by the relevant storefront controls. Account-level and other-browser choices may require additional verification or settings. Ordinary Do Not Track signals are not otherwise treated as a universal opt-out. If you cannot use an online control, contact us to request the applicable choice. This revision does not assert that a new native advertising or tracking system has been activated.

Security and retention

We use measures appropriate to the Services, including protected transport, secure session storage on the iPhone and restricted access to customer records. No system is perfectly secure. Do not send passwords, payment security codes, private keys or verification codes through support messages.

We keep information only as reasonably needed for the stated purposes, outstanding ownership/custody and financial obligations, disputes, security and legal retention requirements. Deletion may be limited for records we must retain; we will explain applicable limitations rather than representing a pending request as complete. We review retention practices periodically and remove or de-identify information when it is no longer needed, subject to applicable retention obligations.

Your choices and privacy rights

Depending on applicable law, you may request access/knowledge, correction, deletion, a portable copy, limits on certain sensitive-information uses, or an opt-out of sale/sharing/targeted advertising. We do not discriminate for exercising applicable rights. Contact papajoey@papajoeys.com or use an available privacy control. We may verify identity and authorized-agent authority, and will respond within legally required periods. Where a legally required appeal is available, contact us to appeal a decision.

Papa’s Pockets provides secure in-app account deletion. Deleting an account does not itself sell or ship a held card, settle proceeds or remove a record required by law. If custody or another obligation needs resolution, we will explain the remaining steps. Completed deletion includes applicable Apple access revocation; it does not delete your Apple Account. Shopify and other independent providers may require requests through their own portals for information they control.

You may unsubscribe from marketing emails; necessary account/order/security messages may continue. SMS opt-in/consent is not sold or shared with other parties for their marketing. Providers/carriers may process it to deliver messages on our behalf. Reply STOP to stop SMS or HELP for help; message frequency and carrier rates may vary.

Children, other sites and international processing

The Services are not intended for children. Papa’s Pockets transaction features require adulthood and any additional disclosed eligibility. If you believe a child supplied information improperly, contact us. We do not knowingly sell/share under-16 information as those terms are defined by applicable law.

Links to other sites do not mean we control their privacy practices. Providers may process information in the United States or other countries; safeguards required by applicable law must be used. United States-only shipping does not guarantee that every network operation or provider record remains in one country.

Updates and contact

This policy is effective October 28, 2026. We provide notice or obtain consent for changes where required. Contact papajoey@papajoeys.com or 619.312.4622, or write to Papa Joey’s Collectibles, 1640 Camino Del Rio N STE 200, San Diego, CA 92108.