Privacy Policy

1. Disc camera lighting

When you open the live disc camera, we attempt to enable its flashlight automatically where your browser and rear camera support torch control. You can toggle it manually. Alignment guides and automatic capture are framing aids; they do not verify the object or its condition. An administrator reviews the submitted photos.

2. Order progress and returns

We store courier names, tracking numbers, delivery updates including failed delivery, rider collection records, separate final condition acceptance, damaged-item reports and refund records. Signed-in customers can view their own records in My Orders. Administrator-written progress notes and refund references are visible to the corresponding customer.

3. Checkout protection

We retain a private checkout reference and a fingerprint of the submitted details to recognise retries without creating another order or deducting credits twice. Hashed email, phone and account identifiers and submission counters help limit repeated checkout attempts. These hashes are used for service protection, not marketing.

Your browser temporarily stores an unfinished checkout reference and its delivery details so an interrupted request can be checked again, including after a refresh. The pending record is removed after a confirmed result or a definite validation failure. Keep browser access private on shared devices. Clearing this record before resolving an interrupted request can prevent automatic recovery; contact support before placing another order.

4. Catalogue photographs

Administrators save product details and upload catalogue photographs to Supabase. These product photographs are publicly visible on the website and through their image links. They are separate from private customer trade-in evidence. Please do not include personal information in catalogue photographs. Older catalogue data on an administrator’s device may be recovered into the shared catalogue; the device backup is retained until removed by the administrator.

5. Information we collect

We collect the information you provide to create an account, buy games, request a stock alert, or submit a trade-in: your name, email, phone number, delivery address, preferred console, order details, and trade-in photos. Saved addresses, inspection reports, discounts, and GameDrop Credits are associated with the relevant account or order. Guests provide an email and delivery details at checkout. We store a hashed cancellation token, the recipient email, and cancellation records to securely process order cancellations and credit adjustments.

6. Accounts and Google sign-in

Email accounts are authenticated through Supabase. If you choose Google sign-in, Google shares account information such as your identifier, email, name, and profile image with our authentication service. We do not receive your Google password or request access to your Gmail messages. You can edit your personal details and saved addresses in your account. Customer access is limited to their own account records. Administrator access is assigned through trusted server controls; changing a profile or signup email does not grant administrator access. Credits, offer eligibility, order status, and inspection results are updated through authorised service operations.

7. Camera and trade-in photographs

Trade-in photos are captured live with your permission. We request the front of the case and the back of the disc; if you declare that you have no case, only the disc photo is required. The camera and supported flashlight controls help capture inspection evidence. Camera access is limited to the capture session; please keep people, documents, and unrelated personal information out of the photographs.

Photos are stored privately in Supabase and made available to authorised inspectors. Inspection emails to GameDrop administrators may contain time-limited links to the photos. Customer reports include the inspection result, value, and any notes written by the inspector.

8. Why we process information

We use information to authenticate accounts, fulfil orders, arrange delivery and trade-in collection, save addresses, inspect games, calculate discounts and credits, send order and inspection reports, respond to support requests, and protect the service against fraud or misuse. We do not sell your personal information.

9. Emails and delivery partners

Resend processes the recipient address and message content needed to send order confirmations, dispatch notifications, cancellation confirmations, trade-in acknowledgements, inspection reports, and requested restock alerts. Restock subscriptions remain pending until we notify you or you ask us to remove them. These service messages are separate from marketing consent.

We share the contact, address, and order information needed by the rider or courier to deliver your purchase and, where applicable, collect your trade-in. Authorised GameDrop administrators can access records needed to operate and support the service.

10. Hosting, game media, and other providers

The main website is hosted through Sites, with a separate preview hosted on Cloudflare Pages for testing. Supabase provides authentication, database, and photo storage for both. A custom domain such as www.gamedrop.pk is planned but is not yet active. We will update this policy when the hosting arrangement changes. These providers may process technical information such as network addresses and service logs. Service providers may process data outside Pakistan under their own terms and safeguards.

Game artwork, screenshots, and ratings may be sourced from RAWG or other game-media sources. Loading remote media can share your network address and browser information with its host. YouTube trailers load only after you choose to load the player; Google/YouTube then processes player activity under its own privacy policy. Direct trailers may similarly connect to their media host.

11. Browser storage

We cache a generic offline page in your browser so a connection-loss screen can appear after a previous online visit. This offline cache does not contain account details, orders, checkout forms or trade-in photos. We use browser local and session storage for authentication sessions, the cart, trade-in drafts, recent order references, account-flow state, and welcome-offer display preferences. Clearing browser storage can remove locally saved items or sign you out; it does not delete orders or account records stored in our database. Essential storage is needed for these features.

12. Payment information

Checkout currently accepts Cash on Delivery and optional GameDrop Credits only. We do not currently request or process card numbers or card security codes. If card payments are introduced, this policy and the checkout disclosures will be updated before that feature is enabled.

13. Retention and security

We retain records for as long as needed for orders, inspections, account services, support, disputes, fraud prevention, and applicable recordkeeping obligations. There is currently no fixed automatic deletion period for every record type. You can request deletion; some transaction records may need to be retained for these purposes.

We use encrypted connections, private photo storage, and account and administrator access controls. No online service can guarantee absolute security. Keep your account credentials private and contact us if you suspect unauthorised access.

14. Your choices and policy changes

Contact GameDrop to request access, correction, deletion, or removal of a restock subscription. We may need to verify your identity before acting on an account request. You can revoke camera access in your browser and disconnect Google access in your Google account; a trade-in cannot be evaluated without its required photos.

We will revise this policy when our services or information practices change and display the updated date here. Material changes will be brought to your attention through the website or an appropriate service message. Contact details appear below.