privacy policy

This policy explains what Zodiac Games Company, Inc. (doing business as SAJA) collects, why, who sees it, and the controls you have. It covers the SAJA iOS app and saja.com (together, the Service).

The short version: we collect what running a real-money collectibles service requires and little else. We do not sell your personal information. The one thing we share for advertising is measurement: if you allow it, a few app events (sign-up, first pack opened, deposits) go to Meta so we can tell which of our Instagram ads work, and you can switch that off in the app at any time. Nothing about your account, prices or odds changes either way. The most sensitive data, payment details and identity documents, is handled by Stripe and never stored on our servers.

what you give us

Account basics: your phone number, display name, handle, avatar, and any email addresses you add.

Shipping details: the name and address you enter when you ask us to ship a card.

Communications: messages you send our support team, survey answers, and anything else you choose to tell us.

On saja.com: an email address if you join the waitlist.

what using saja creates

Activity records: the packs you open, the cards you hold, sell, and ship, your deposits and withdrawals, promo and referral use, and the timestamps around all of it. This is your account history and the product cannot work without it.

Settings: your notification, email, sound, and data preferences.

what your device shares

Technical data: device model, operating system version, app version, language, IP address, and a push notification token if you allow notifications.

Usage analytics: anonymous-style event breadcrumbs about which screens are used, which you can turn off in Settings, then Data Preferences.

Crash and error reports, which stay on so we can fix what breaks.

Ad measurement: the app includes the Meta (Facebook and Instagram) SDK, which receives app installs and launches, sign-ups, first pack openings and deposit amounts, together with device information, so we can measure whether our ads bring people to SAJA and so Meta can show them to people more likely to enjoy it. On iOS, Meta receives your device's advertising identifier only if you allow tracking when the app asks. Turning off Share usage analytics in Settings, then Data Preferences, stops all of this.

We do not collect your precise location, your contacts, your photos (beyond an avatar you choose), or your microphone or camera data, except that Stripe uses your camera during identity verification, as described below.

cookies on saja.com

The website uses a small number of cookies and similar technologies (local storage, and pixels in marketing email that tell us whether a message was opened) to keep the site working, remember preferences, and understand aggregate usage. We do not use third-party advertising cookies. Some browsers send Do Not Track signals; there is no common standard for them, and the site currently does not respond to them, though our practices already match their spirit: we do not track you across other sites.

what stripe handles

Payments, payout accounts, and identity verification run on Stripe. Your card numbers, bank credentials, Social Security number, and identity documents (including the camera capture of your ID and selfie) go directly from your device to Stripe and are never written to SAJA's servers. Stripe shares limited information back with us, such as your name, the last digits of a payment method, transaction outcomes, and verification status, which we use for processing, support, fraud prevention, and legal compliance. Stripe's own privacy policy governs the data it holds.

what we receive from others

Payment providers send us fraud and risk signals about transactions. Shipping carriers send us delivery status. Our email provider tells us whether messages were delivered. Meta sends us aggregate statistics about our ad campaigns (installs, sign-ups and purchases per ad); nothing in those reports identifies you. We do not buy personal information from data brokers.

how we use personal information

• Running the Service: accounts, the vault, purchases, sales, payouts, and shipping
• Support: answering you, and investigating problems you report
• Security and fraud prevention: verifying identity, spotting abusive patterns, protecting accounts
• Improving the product: analytics, research, and diagnosing failures
• Legal compliance: tax, anti-money-laundering, sanctions, and record-keeping obligations
• Communications: service messages always; marketing email only until you opt out
• Aggregated or de-identified analysis that no longer identifies you, which we may use and share freely

what other users can see

Your display name, handle, avatar, and pull activity can appear to other users in community surfaces of the app. Your phone number, email, balance, address, and transaction details are never shown to other users. Pick a handle you are comfortable being seen.

who we share personal information with

Service providers who process data for us: Stripe (payments and identity), Google (Firebase and Google Cloud, which host our accounts, data, and notifications), our email delivery provider, and the carriers that deliver your shipments (name and address only). Each receives what its job requires and may not use your data for its own purposes.

Meta Platforms (Facebook and Instagram), for ad measurement only, as described under what your device shares. Under California law this counts as sharing personal information for cross-context behavioral advertising, and the switch that stops it is Settings, then Data Preferences, then Share usage analytics.

Professional advisors such as lawyers, accountants, and insurers, where their work for us requires it.

Authorities, when a law, subpoena, or legal process genuinely requires it, or where disclosure is necessary to protect someone's rights or safety.

A successor business, if SAJA is involved in a merger, acquisition, financing, or sale of assets; your information may transfer as part of that transaction under this policy's protections.

We do not sell personal information. Apart from the Meta ad measurement above, we do not share it for cross-context behavioral advertising, and text message opt-in data is never shared with anyone for marketing.

your controls

In the app: Settings, then Preferences controls push and email categories; Settings, then Data Preferences controls marketing email, usage analytics and ad measurement; Settings, then Email manages your addresses; your profile is editable; and Settings, then Delete Account permanently deletes your account.

Every marketing email contains an unsubscribe link, push notifications can also be disabled at the system level, and text messages are limited to sign-in codes and service alerts.

Some information is required to provide the Service: without a phone number there is no account, and without a verified email money cannot leave the platform.

your privacy rights

Depending on where you live, you may have legal rights to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising them. Most of these are available directly in the app; for anything else, email support@saja.com from your account email and we will verify and respond as the law requires. We do not sell personal information, so there is nothing to opt out of there; to opt out of sharing for ad measurement, turn off Share usage analytics in Settings, then Data Preferences, or email support@saja.com and we will do it for you.

security

Data is encrypted in transit, access inside the company is restricted, and money movements are recorded in append-only ledgers. No system is perfectly secure, and we cannot guarantee security absolutely, but protecting a money product is treated as a first-class engineering job here.

retention

We keep personal information while your account exists. When it closes, we delete or de-identify what we can; transaction and compliance records the law requires us to keep are retained only for their required period and then removed.

where your data lives

We operate from the United States and store data with providers in the United States. If you use the Service from elsewhere, you are sending your information to the United States, where privacy law may differ from your country's.

children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has an account or that we hold a minor's information, contact support@saja.com and we will delete it as the law requires.

changes to this policy

We may update this policy as the product evolves. Material changes will be announced in the app or on saja.com, and the date above always reflects the current version. Using the Service after a change takes effect means the updated policy applies.