Privacy Policy
Last updated: May 20, 2025
1. Who We Are
Unpacked.gg (“we,” “our,” “us”) is a review and comparison site for physical and crypto-based mystery boxes. We operate from the EU but speak to a global, 18-plus audience of collectors and risk-takers.
2. Why This Policy Exists
Because we use tools like Google Analytics 4 (GA4) and run affiliate programs, Google and several privacy laws (GDPR, CCPA, LGPD, etc.) require us to tell you what we collect, why, and how you can opt out.
3. Data We Collect
| Category | Examples | Legal Basis* | Retention |
|---|---|---|---|
| Info you hand over | Email (newsletter), feedback forms | Consent | Until you unsubscribe + 12 months |
| Automatic logs | IP address (server logs only), browser type, time stamps | Legitimate interest (security) | 90 days |
| Analytics data | Page views, scroll depth, outbound-link clicks | Consent (via cookie banner) | 26 months (GA4 default) |
| Affiliate IDs & cookies | Click ID, hashed IP, purchase totals | Legitimate interest / contract | 24 months (network default) |
*Under GDPR Articles 6(1)(a), 6(1)(b), 6(1)(f).
4. How We Use Your Data
- Measure article performance and squash bugs (GA4, Google Search Console).
- Track outbound clicks so partners know we referred you—this is how we earn commission, at no extra cost to you.
- Send one newsletter per week if you opted in.
- Detect fraud and keep bots from spamming our forms.
5. Cookies & Similar Tech
We drop three types:
- Essential cookies – Site security and load balancing (cannot be switched off).
- Analytics cookies – GA4 sets first-party cookies like _ga to understand usage patterns. GA4 truncates or drops EU IP addresses before storage.
Affiliate cookies / pixels – Networks place a short-lived cookie (7 – 30 days) or pass a click ID in the URL so they can reward us if you buy a box.
Our cookie banner lets you toggle analytics and affiliate tracking off (except strictly necessary cookies).
6. Sharing & Disclosure
We never sell your personal data. We share it only with:
- Google LLC (Analytics & Search Console) – USA
- Affiliate networks & merchants – Various locations; limited to hashed IDs and order totals
- Service vendors (email provider, hosting) – Bound by DPAs and standard contractual clauses
7. International Transfers
When data leaves the EEA, we rely on:
- Adequacy decisions (e.g., UK)
- Standard Contractual Clauses (SCCs) for US-based processors
8. Your Rights
Under GDPR, you can access, correct, erase, restrict, port, or object to processing. California residents get similar CCPA rights (know, delete, opt-out of “sale”/sharing). Hit us at privacy@unpacked.gg with your request—response within 30 days.
9. Security
We encrypt traffic (HTTPS), follow least-privilege access, and run quarterly vulnerability scans.
10. Minors
Our content is strictly 18+. We don’t knowingly collect data from anyone under 18. If you’re a parent who spots an issue, email us and we’ll nuke the data.
11. Affiliate Disclosure (Plain English)
Some links on Unpacked.gg are affiliate links. If you click and later cop a mystery box, we may earn a commission. It never changes your price, but it helps keep the lights on and the memes flowing.
12. Changes to This Policy
If we tweak how we track or process data, we’ll update this page and stamp a new “Last updated” date. Significant changes? We’ll drop a site-wide banner or email blast.
13. Contact
Questions, complaints, or memes about privacy?
Email: contact@unpacked.gg