Effective Date: November 6, 2026
Monster Strategy, Inc., a Delaware corporation (“Monster,” “we,” “us,” or “our”), provides access to the Monster application located at monster.xyz (the “Application”) and associated products and services, including the Vault, the Marketplace, and the Scan feature (each as defined in our Terms of Service) (together, the “Products”). This Privacy Policy explains how and why we collect, use, store, and share personal information in connection with the Products, your rights in relation to your personal information, and how to contact us.
By using the Products, you agree to this Privacy Policy. This Privacy Policy is incorporated by reference into our Terms of Service posted at monster.xyz (the “Terms of Service”). Capitalized terms not defined here have the meanings given in the Terms of Service. This Privacy Policy does not apply to information collected by third parties, including our payment provider and vault partners, which have their own privacy policies.
1. Information We Collect
Information you provide or that is generated through your use of the Products. We may collect the following personal information when you use the Products:
- Account and contact information, such as your email address, display name, and, if you choose to connect them, social handles such as Discord or X usernames.
- Phone number. A phone number is not required to create an Account, but it is required to request shipment of a Card. If you provide one, we may use it for shipping, account security, and account and transactional notices.
- Purchase and activity information, such as the packs you purchase and open, the Cards you receive, hold in your Collection, ship, sell, or sell back, Marketplace and auction activity, your Account balance (including Store Credit and Withdrawable Balance), deposit and withdrawal history, Points balances and redemptions, promotion participation, and referral and Partner Program attribution.
- Shipping information, such as the recipient name, shipping address, and phone number you provide when you request shipment of a Card.
- Identity verification and tax information. Before a withdrawal, a shipment, or where otherwise required, you may be asked to verify your identity. This may include your legal name, date of birth, address, an image of a government-issued identification document, and a live facial image or short video, collected and processed through our payment and verification provider as described in Sections 2 and 4. Where required by law, we may also collect tax information, such as a Form W-9 and a taxpayer identification number.
- Payment information. Deposits, purchases, and withdrawals are processed by our third-party payment provider, Coinflow. Your card, bank account, or other payment credentials are collected and processed by Coinflow, and we do not receive or store your full card or bank account number. We receive transaction records and limited payment details, such as payment status and the last digits of a payment method.
- Scan information. If you use the Scan feature, we collect the photos you take or upload of trading cards in your personal collection and information derived from them, such as card identity, grade, and estimated value, to add those cards to your Account for tracking and valuation. Please do not include people or other personal information in Scan photos.
- Communications, such as information you provide when you contact support by email, support channels, or social media, or take part in a survey or promotion.
Information collected automatically. When you use the Products, we and our service providers automatically collect device and usage information, such as IP address, device and browser type, device identifiers, operating system, pages and features used, timestamps, and information collected through cookies, pixels, software development kits, localStorage, and similar technologies, including information about your interactions with our ads and your online activity on the Application. We also collect location information, derived from your IP address or device, to enforce geographic eligibility, including the Excluded Jurisdictions described in the Terms of Service, and to help prevent fraud.
Information from third parties. We may receive information about you from our payment and verification provider, vault partners, shipping carriers, fraud prevention and sanctions screening providers, and analytics providers, and from third parties with your consent.
2. Biometric Information
If you complete identity verification, our payment and verification provider may collect a live facial capture and derive from it a scan of face geometry or similar biometric identifier for the sole purpose of verifying your identity against your identification document and preventing fraud. We do not use biometric information for any other purpose, do not sell it, and do not use it for marketing. Biometric information is retained by us or our provider only as long as reasonably necessary to complete verification and comply with legal obligations, and in any event is permanently destroyed no later than the earlier of (i) satisfaction of the purpose for which it was collected and (ii) one (1) year after your last interaction with us, unless a longer period is required by law.
3. How We Use Your Information
We use personal information for the following purposes:
| What we use your personal information for | Our reasons |
|---|---|
| To provide the Products, including fulfilling pack purchases, maintaining your Account balance and Vault records of your Cards, shipping Cards, operating the Marketplace, processing sellbacks, and administering Points and promotions | To perform our contract with you and to provide, maintain, and improve the Products |
| To provide the Scan feature, including identifying and valuing cards in your personal collection | To perform our contract with you |
| To process deposits, purchases, and withdrawals through our payment provider | To perform our contract with you and to comply with legal obligations |
| To enforce geographic and eligibility requirements, including age and location checks | To comply with legal and regulatory obligations and the eligibility requirements of the Products |
| To verify your identity before withdrawals, shipments, or where otherwise required, and to collect tax information where required | To comply with legal and regulatory obligations and to prevent fraud |
| To prevent and detect fraud, multi-account and promotional abuse, and unauthorized transactions, and to screen against sanctions lists | For our legitimate interests and those of our users, and to comply with legal obligations |
| To respond to audits, inquiries, or investigations by regulators and to maintain financial, tax, and compliance records | To comply with legal and regulatory obligations |
| To administer giveaways, referrals, and Partner Program features | To perform our contract with you and for our legitimate interests in running promotions fairly |
| To send account, transactional, and security notices | To perform our contract with you |
| To contact you about Monster offerings, from which you may opt out at any time | With your consent or for our legitimate interests |
| To analyze usage, improve efficiency, and secure our systems | For our legitimate interests |
| To measure and improve our advertising and to show you and people with similar interests ads for Monster on other websites and apps, including through advertising partners such as Meta | With your consent where required, or for our legitimate interests; you may opt out as described in Section 8 |
You may opt out of marketing emails at any time by using the unsubscribe link or by emailing info@mnstr.xyz. You will continue to receive account and transactional notices.
6. How Long We Keep Your Information
We keep personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to satisfy legal, regulatory, tax, accounting, and reporting requirements, prevent fraud and abuse, resolve disputes, and enforce our agreements. The period varies with the type of information. For example, transaction, Account balance, withdrawal, identity verification, and tax records are generally kept for up to seven (7) years after your last transaction or after your Account is closed, and biometric information is kept only as described in Section 2. When information is no longer needed, we delete or de-identify it.
7. Security
We use administrative, technical, and physical safeguards designed to protect personal information from loss and from unauthorized access, use, alteration, and disclosure. We limit access to personal information to those with a business need. No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. You are responsible for keeping your login credentials confidential. We will notify you and applicable regulators of a data security breach where required by law.
8. Your Privacy Choices and Rights
Depending on where you live, and subject to exceptions in applicable law, you may have the right to:
- confirm whether we process your personal information and access it;
- correct inaccurate personal information;
- delete personal information;
- receive a portable copy of your personal information;
- opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
- not be discriminated against for exercising your rights.
We may decline or limit a request where permitted by law, for example where we must keep information for legal, tax, financial, fraud prevention, or security purposes, including transaction, identity verification, and tax records and information about Accounts closed for violating the Terms of Service.
Do Not Sell or Share My Personal Information. To opt out of the sale or sharing of your personal information and targeted advertising, email info@mnstr.xyz with the subject line “Do Not Sell or Share My Personal Information,” turn off non-essential and advertising cookies through any cookie settings available on the Application, or enable the Global Privacy Control in your browser. Cookie and Global Privacy Control choices apply to the browser or device you use, so you may need to set them on each one. We do not require identity verification for an opt-out request, but we may ask for information needed to apply it to your Account.
How to make a request. To exercise your other rights, email info@mnstr.xyz. We will verify your request using information associated with your Account, and we may require identity verification. You may use an authorized agent, and we may require proof of the agent’s authority and verification of your identity.
Appeals. If we deny your request, you may appeal by replying to our decision or emailing info@mnstr.xyz. If you are not satisfied with the outcome of your appeal, you may contact your state Attorney General.
9. Additional Information for California Residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), provides you the rights described in Section 8, including the right to know the categories and specific pieces of personal information we collect, use, and disclose.
Categories. In the past 12 months, we have collected the categories of personal information below, as described in Section 1. We collect it from the sources in Section 1, use it for the purposes in Section 3, disclose it for business purposes to the categories of recipients in Section 4, and keep it for the periods described in Section 6. The table shows which categories we may sell or share with advertising partners for targeted or cross-context behavioral advertising.
| Category of personal information | Sold or shared with advertising partners? |
|---|---|
| Identifiers, such as name, email address, phone number, IP address, and device and cookie identifiers | Yes, limited to email address or phone number (which may be hashed), IP address, and device and cookie identifiers |
| Customer records, such as shipping address | No |
| Commercial information, such as purchases, sign ups, and Card activity | Yes, limited to events such as sign ups and purchases and their value |
| Internet or other network activity, such as pages viewed and interactions with the Application and our ads | Yes |
| Geolocation data, such as approximate location derived from IP address | Yes, limited to approximate location derived from IP address |
| Audio or visual information, such as identification images and Scan photos | No |
| Financial information, such as transaction and withdrawal records | No |
| Inferences drawn from the above, such as interests used for advertising | Yes |
| Sensitive personal information, such as government identification, taxpayer identification number, identity verification data, and biometric information | No |
Sale, sharing, and sensitive information. We may sell or share personal information, as those terms are defined in the CCPA, with advertising partners as described above, and you may opt out as described in Section 8. We do not sell or share sensitive personal information or biometric information. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only to verify identity, prevent fraud, process payments and withdrawals, comply with law, and for other purposes permitted by the CCPA, so a right to limit does not apply.
Shine the Light. California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes, other than disclosures to advertising partners that you can opt out of as described in Section 8.
10. Additional Information for Residents of Other U.S. States
Residents of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) may have the rights described in Section 8, subject to the terms of the applicable law. These may include the right to opt out of the sale of personal information and targeted advertising, which you can exercise as described in Section 8. We will honor verified requests as required by the law of your state. Where state law requires consent to process sensitive data, such as identity verification and biometric information, we obtain it before you complete identity verification.
11. Users Outside the United States; GDPR
The Products are operated from the United States, and your information will be processed in the United States and other countries that may not have the same data protection laws as your jurisdiction. Where we transfer personal information from the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as contractual protections, as required by applicable law.
If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR and UK GDPR, subject to applicable exceptions:
| Right | Description |
|---|---|
| Access | To receive a copy of your personal information |
| Rectification | To require us to correct mistakes in your personal information |
| Erasure | To require us to delete your personal information in certain situations |
| Restriction of processing | To require us to restrict processing of your personal information in certain circumstances, such as if you contest its accuracy |
| Data portability | To receive the personal information you provided to us in a structured, commonly used, machine-readable format, and to transmit it to a third party in certain situations |
| Objection | To object at any time to processing for direct marketing, and in certain other situations to processing based on our legitimate interests |
| Automated decision-making | Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where automated identity verification results in a rejection, you may request human review |
| Withdraw consent | Where we rely on consent, to withdraw it at any time |
To exercise these rights, use the contact details in Section 14. You also have the right to lodge a complaint with a supervisory authority where you live, work, or where an alleged infringement occurred.
12. Children
The Products are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We require each user to confirm that they are at least 18 years of age. If we learn that we have collected personal information from someone under 18, we will delete it unless we are legally required to keep it. If you believe we have such information, please contact info@mnstr.xyz.
13. Changes to This Privacy Policy
We may change this Privacy Policy from time to time. When we do, we will post the updated version at monster.xyz and update the “Last Updated” date above. If changes are material, we will notify you through the Application, by email, or by other means before they take effect. Your continued use of the Products after changes take effect means you accept the updated Privacy Policy.
14. Contact Us
If you have questions about this Privacy Policy or the information we hold about you, or want to exercise your rights, please contact us:
Monster Strategy, Inc.
223 Bedford Ave PMB 78, Brooklyn, NY 11211
This Privacy Policy is governed by the Terms of Service, and any dispute relating to it is subject to the dispute resolution and arbitration provisions of the Terms of Service, except where applicable law requires otherwise.