Privacy Policy

1. Information we collect

• Account information: email address, display name, verified phone number, phone-verification records, authentication records, and account identifiers.
• Shipping information: recipient name, delivery address, and contact phone number and email you provide when you request a watch shipment.
• Transaction and collection information: credit purchases, balances, box openings, pull results, acquired values, sell-backs, collection status, and fulfillment activity.
• Payment information: Card and billing details are collected and processed by our payment service provider. We receive transaction identifiers, status, amount, and limited billing information rather than your full card number.
• Withdrawal information: if you withdraw sell-back proceeds, the withdrawal account details you provide and the record of each withdrawal request, its review, and its outcome. Withdrawal account details are collected and held by our payment provider.
• Compliance information: where our AML Policy requires it, identity and source-of-funds records and records of activity reviewed for financial-crime risk. Our payment provider may request your legal name, address, date of birth, government identification information, and identity-document photos or a selfie as part of verification. We also record age confirmation, policy acceptance, and verification status. Identity verification is required before a first withdrawal.
• Communications: information you provide when you request support, report a problem, or contact us.
• Device and usage information: browser and device details, IP address, pages viewed, timestamps, error data, and similar technical information that may be logged by us or our infrastructure providers.
• Mobile notification information: notification preferences, whether the notification prompt has been shown, app installation and account identifiers, device platform, and recent app activity timestamps. If your phone allows notifications, we also collect a push token that lets us address notifications to that installation. When notifications are sent, we record delivery attempts, provider responses, and when you open a notification.
• Mobile analytics information: public screens and box pages viewed, app-specific random device and session identifiers, and app and operating-system versions. These analytics events do not include your account identifier, email, display name, shipping address, payment information, or balance.
• Demo data: demo pulls and demo balances may be stored locally in your browser.

2. How we collect information

We collect information when you provide it, when you use the Services, and from service providers that support authentication, hosting, payments, fraud prevention, analytics, and fulfillment.

3. How we use information

• Provide accounts, credits, box openings, watch collections, sell-back options, and fulfillment features.
• Process and reconcile payments and maintain transaction records.
• Authenticate users, verify phone ownership, secure accounts, detect abuse, prevent duplicate-account misuse and fraud, and enforce our Terms.
• Respond to support requests and send service-related notices.
• Send optional weekly leaderboard updates and reminders to return to GemBreak when you opt in. We use recent mobile app activity to time reminders and avoid sending them while you are using the app. We use notification preferences and delivery records to respect your choices, limit message frequency, prevent duplicate sends, and troubleshoot delivery.
• Debug, measure, maintain, and improve the Services.
• Comply with legal obligations and protect users, gembreak, and third parties.

4. How we share information

We may share information with providers that work on our behalf, including Supabase for authentication and data storage, our payment service provider for card processing, Twilio for transactional phone-verification messages, and hosting, security, communications, analytics, and fulfillment providers. We may also share information with regulators, law enforcement, and our payment provider when required to meet the anti-money-laundering, sanctions, and fraud-prevention obligations described in our AML Policy, when otherwise required by law, to protect rights and safety, in connection with a merger or sale of the business, or with your direction or consent.

For mobile push delivery, we use Expo and, depending on your device, Apple Push Notification service or Google Firebase Cloud Messaging. Delivery data includes push tokens, notification content, and identifiers used to link a notification to your account and open the correct screen. Supabase stores notification preferences, device registrations, activity timestamps, and delivery records on our behalf.

We use PostHog to measure visits to public storefront pages and mobile screens and understand which boxes people view. Mobile analytics uses random identifiers stored on the device rather than your GemBreak account identifier. We disable session replay, automatic error capture, and IP-based geolocation in this analytics integration. Private account, payment, and shipping screens are excluded from mobile analytics.

Optional mobile usage analytics is off until you choose to share usage data on the welcome screen or in Account > Preferences > Usage analytics. You can use the app without enabling it and turn it off in Preferences at any time. Supabase stores your choice for your account, and it syncs across devices signed in to that account. Connected apps refresh the setting when it changes and when you reopen the app. We check the saved choice before sending mobile analytics; if we cannot verify consent, we do not send. Turning it off stops future collection and discards unsent analytics events as each device receives the change; it does not delete events already received. We also stop mobile analytics while you are signed out.

When you change your public display name, automated rules on our servers check it for inappropriate content, impersonation, and contact links. This check does not use AI or send your name to an AI provider or external moderation service. We temporarily cache the name and moderation decision in our database and use hashed request identifiers to limit abuse.

We do not sell personal information for money. We do not allow service providers to use personal information for their own unrelated purposes.

5. Cookies and local storage

We use cookies and similar browser storage for essential functions such as keeping you signed in, protecting sessions, remembering preferences, and maintaining demo pull data. Your browser may let you delete or block these technologies, but parts of the Services may stop working as intended.

The mobile app uses local storage for encrypted sign-in sessions, notification installation identifiers and prompt state. If you enable usage analytics, we also store analytics identifiers and queued events. Your analytics choice is saved to your account in Supabase. Sign-in encryption keys are kept in the device's secure storage.

6. Data retention

We keep information for as long as reasonably necessary to provide the Services, maintain account, verification, transaction, and collection records, comply with legal and accounting obligations, prevent fraud, resolve disputes, and enforce agreements. Pending phone-verification data can only be used to verify a number for a short period. A verified number may stay linked to your account until support changes it or you delete your account, subject to permitted retention. Browser-stored demo data remains until you or your browser removes it.

Turning off a notification category stops future sends for that category but does not delete its preferences or past delivery records. Signing out removes that installation's notification registration. Deleting your account removes your notification preferences, device registrations, and delivery records from our active notification system.

Transaction records and any identity or source-of-funds records collected under our AML Policy are retained for at least five years after the transaction or after the account relationship ends, whichever is later. This retention is a legal obligation and continues even if you delete your account.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information. No online system is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your password and account access confidential and for notifying us if you suspect unauthorized use.

8. Your choices and privacy rights

Mobile push notifications are optional. Weekly leaderboard updates and reminders to return to GemBreak are off by default and require your opt-in in the app, as well as permission from your phone. You can turn either category off at any time in Account → Preferences → Notifications, or disable all GemBreak notifications in your phone settings. You can keep using the app with notifications off. These preferences do not change authentication emails or phone-verification texts. A notification already handed to a delivery provider may still arrive after you turn a category off.

You may update certain account information, download an account-data export, or permanently delete your account through the account page. You may request a verified phone-number change through Support and control cookies through your browser. Verification texts are one-time transactional messages. Receiving them does not mean you have agreed to marketing texts. Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection regarding your personal information. We may need to verify your identity before completing a request, and some information may be retained where permitted or required by law.

9. International transfers

Our providers may process information in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers of personal information.

10. Age restriction

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from children under 18. If we learn that such information was collected, we will take reasonable steps to delete it.

11. Third-party services and links

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own policies, and we are not responsible for how those third parties handle information.

12. Changes and contact

We may update this policy when the Services change. We will post the revised policy and update the date above. For privacy questions or requests, email support@gembreak.com or contact us through the Support page.

Nexus Sky Corp, operating as gembreak
3422 Old Capitol Trail, Suite 4087, Wilmington, DE 19808, United States