Privacy Policy

What we collect

If you place an order: your name, email address, phone number and delivery address, plus what you ordered and what you paid. We need all of it to deliver the parcel and to keep a record of the sale.

If you create an account: your name and email address (if you sign in with Google, the name and email address Google shares with us), plus your wishlist and the contents of your cart, so they follow you between devices.

If you subscribe to the newsletter: your email address, and which page you signed up on.

If you post a review: the display name you type into the review form, your star rating and what you wrote. Reviews are public once we have checked and published them.

Whenever you visit: like every website, ours sees your IP address. Our host processes it to deliver the site, and we hold it briefly in memory to stop anyone flooding the review form. We do not store it with anything else about you.

What we do not collect

We never see your full card number, UPI PIN or bank credentials. Those go straight to our payment processor and never touch our systems.

We never see your password either. It goes straight from your browser to Supabase, which runs our sign-in and keeps only a scrambled, one-way version of it (a bcrypt hash) that cannot be turned back into the password.

Who else sees it

Razorpay processes payments. It receives the amount, plus the email address and phone number you gave at checkout so that its payment window does not ask for them again. Your card, UPI or bank details go to Razorpay directly.

Shiprocket, our shipping partner, receives your name, phone number, email address, delivery address and what you ordered, and passes what the courier needs to the courier that delivers your parcel.

When you type a PIN code, we look it up in India Post's public directory to fill in your city and state, and ask Shiprocket whether we can deliver there. Only the PIN code is sent for either.

Supabase stores the site's database and runs sign-in, including Sign in with Google when you choose it. Resend sends our emails, so it handles your email address and what those emails say — an order confirmation, for example, includes your delivery address.

Mail you send to support@blindbluff.com is forwarded by ImprovMX to our inbox, which Google hosts. Our own copy of each new order, with the details we need to pack and ship it, arrives in the same inbox.

Vercel hosts the site and provides anonymous traffic analytics.

We do not sell your data, and we do not share it for anyone else's advertising.

Emails we send

About an order: a confirmation, then updates when it ships, is delivered or is cancelled, a note if we refund you, and one request for a review after it arrives.

If you have an account and leave games in your cart, one reminder about them.

Newsletters, only if you signed up for them. The unsubscribe link in a newsletter email takes your address off the list in one click.

If you ask us to delete your data, one email with a link to confirm it.

How long we keep it

Order records are kept as financial records for as long as Indian tax and company law requires us to be able to produce them.

Your account, wishlist and saved cart are kept until you delete your account, and your newsletter subscription until you unsubscribe.

Deleting your data

You can delete your account yourself from Account Settings. That removes your sign-in, your wishlist, your saved cart and your newsletter subscription. If an order is still on its way, deletion waits until it arrives, because until then we need your address to deliver it.

Your past orders are not deleted, because we are required to keep the sales record. Instead your name, email address, phone number and delivery address are stripped out of them, leaving only the items, the amounts and the state the order shipped to — none of which identifies you.

Ordered or subscribed without an account? Use Delete My Data: enter the email address you used and follow the link we send to it. That strips your details from your past orders in the same way and takes you off the newsletter. The link is the proof the address is yours, so no account or password is needed.

To leave the newsletter, use the unsubscribe link in any newsletter email, or ask us. Your address is deleted from the list, not just marked.

Reviews are not linked to your account and are not removed automatically. Email us and we will take one down.

Delete My Data →

Cookies

We set cookies only when you sign in, and only to keep you signed in. Your cart is kept in your own browser's storage rather than a cookie, as is a note that you have seen our cookie notice. Our analytics are anonymous and set no cookies.

Razorpay's payment window and Google's sign-in page, when you use them, are run by those companies under their own privacy policies.

Getting in touch

For any question about your data, or to ask for a copy of what we hold, email support@blindbluff.com. Complaints about how we handle your information go to our grievance officer, Jeet Jhawar (Founder), at the same address, and are resolved within a month.