Privacy Policy

gears.games (the "Site", "we") is an online store of digital games for Xbox consoles. We sell access to shared accounts of our own stock (Primary and Secondary) and official activation codes, accept payment manually and deliver access data through the customer account or Telegram.

The controller of personal data is the operator of the Site. Before publication the owner must fill in its details:

• Legal name: GEARS GAMES LLC
• Registered address: 530-B Harkle Road Ste 100, Santa Fe, NM, 87505 USA
• Data protection contact: support@gears.games

We collect only what an order, its delivery and the support afterwards require. We do not ask for identity documents, do not build advertising profiles and do not buy data from third parties.

Account and order data comes from you: e-mail address and password (stored only as a scrypt hash) at registration, your name, Telegram and phone number, the console identifier you give us for delivery, and the history of your orders with their statuses and events.

When an order is delivered we keep the access data that was issued to you: account login, password, slot type and activation code, together with the delivery time. This is how we verify the order and replace access if it stops working during the warranty period.

Technical data appears automatically: IP address, browser and device details, request time and the pages you open. It lives in the server logs and in the internal audit log of staff and customer actions: sign-ins, order changes, deliveries.

Your cart stays in your browser only (localStorage) and reaches us as a list of items when you submit the order. We never receive card numbers or wallet keys: the payment happens outside the Site through a bank, a payment provider or a crypto service, and you send us the receipt yourself.

• E-mail address: signing in, order notifications, support.
• Name: how we address you in orders and chats.
• Telegram username: the fastest support channel.
• Phone number: only if you give it for contact.
• PSN ID / Xbox Gamertag: the console the game must be delivered to.
• Order history: items, amounts, statuses, payment method, comments.
• Issued access data: account login and password, slot type, activation code.
• IP address and technical logs: browser, device, time and requested pages.
• Cart contents: kept in your browser until you clear it.

We process personal data to perform the contract with you: without an e-mail address, order details and a console identifier an order cannot be created, paid, reserved or delivered.

Support and warranty work need the order history and the access data we issued, otherwise we cannot check the problem or replace an account that stopped working.

Technical logs, IP addresses and audit records protect the store from fraud: duplicate accounts, stolen payment instruments, chargeback abuse and attempts to resell one access many times.

We keep records of sales and payments because accounting and tax law demand it.

Aggregated and anonymised statistics (which game cards are viewed, which platforms are popular) help us improve the catalogue. Such statistics are not linked back to you.

• Creating, paying, reserving and delivering orders.
• Support, warranty replacement and refunds.
• Security: fraud prevention and protection of accounts.
• Accounting, tax and other legal obligations.
• Improving the catalogue and interface using aggregated data.

Where the GDPR or a comparable law applies, we rely on the following grounds for processing.

• Performance of a contract: everything needed to sell and deliver the game you ordered.
• Legitimate interests: fraud prevention, security of the store, defence of legal claims.
• Legal obligation: accounting, tax reporting and answers to lawful requests.
• Consent: optional communication, which you may withdraw at any time.

No law obliges you to give us your data, but without an e-mail address and order details we cannot complete a purchase.

We do not sell personal data and we do not share it for advertising. Data reaches only the processors that keep the store running, and only in the amount each of them needs.

Payments are processed outside the Site by a bank, a payment provider or a crypto service. They see the amount and your contact data, we see the confirmation. Support conversations happen in Telegram and are processed under its own policy.

Game titles, descriptions and reference prices are loaded from the public Microsoft Store catalogue. We send Microsoft no buyer data: a catalogue request contains only a product identifier and a market code. If you redeem a code on your own Xbox account, Microsoft processes that activation under its own terms.

We may disclose data when a law, a court or a competent authority requires it, and to our lawyer or accountant when we have to defend the store.

• Payment provider: Heleket, which confirms that your payment arrived.
• Telegram: support chats and order notifications, under Telegram's own privacy policy.
• Authorities: only on a lawful and documented request.

Game titles, descriptions, covers, platform support and reference prices come from the public catalogue of the Microsoft Store (displaycatalog.mp.microsoft.com) and are shown as reference information of the product card.

We never transfer your personal data to Microsoft: a catalogue request carries a product identifier and a market code, no cookies, accounts or buyer information.

We are not affiliated with Microsoft Corporation. All trademarks and game content belong to their respective owners.

We use a sign-in cookie, a language cookie and a currency cookie, and we keep your cart in browser storage. There are no advertising or analytics cookies on the Site.

Every cookie, its purpose and its lifetime are described in the Cookie Policy; non-essential storage can be refused in your browser settings.

The store is international, so your data may be processed on servers outside your country, including outside the EEA. We choose providers that offer contractual safeguards such as standard contractual clauses and transfer only what the service needs.

Support chats in Telegram may be stored in any country where Telegram operates. Do not send us documents or data you would not want processed abroad.

We keep personal data only while it serves the purpose it was collected for, and then delete or anonymise it.

• Account data: while the account exists and 12 months after the last order.
• Orders, payments and accounting documents: for the period required by tax and accounting law (12 months).
• Access data issued for a rental: until the warranty period of that order ends, so that we can restore or replace access.
• Technical logs and audit records: 1 month, then deleted or aggregated.

Deleting an account removes access to the order history but does not cancel the storage duties the law imposes on us: the minimum accounting records are kept for the required period.

Your data is yours to control. Depending on your country you may have the rights listed below; we do not charge for exercising them and we never discriminate against customers who do.

• Access: get a copy of the data we hold about you.
• Correction: fix an inaccurate name, e-mail or console identifier.
• Deletion: ask us to erase your account and the data we are not obliged to keep.
• Portability: receive your data in a structured, machine-readable form.
• Restriction and objection: ask us to limit processing based on legitimate interests.
• Withdrawal of consent: at any time, without affecting processing that was lawful before.
• Complaint: to your local supervisory authority, or to us first if you prefer.

Write to support@gears.games or to Telegram @weskars, describe the request and use the e-mail address linked to your account. We answer within 30 days; if the request is complex, we explain why it takes longer.

Passwords are stored as scrypt hashes, the sign-in cookie is httpOnly and SameSite=Lax, and access to the admin panel and to issued access data is limited to staff accounts and recorded in the audit log.

No transmission is absolutely secure. If a breach affects your rights, we will notify you and the competent authority as the law requires.

The store sells digital Xbox games and is not intended for children under 16. We do not knowingly collect data from children under 16 and we do not sell or share data of minors.

If you believe a child has given us personal data, write to support@gears.games: we will delete the account and its data unless the law requires us to keep the records.

We update this policy when the store changes, for example when a new payment method or a new service provider appears. The new version is published on this page with a new last-updated date.

If the changes are material, we announce them in the site header or by e-mail to registered customers. Continued use of the Site after an update means you accept the new version.

Questions about this policy, your data and your rights go to the data protection contact support@gears.games or to the support channels below.

When you write about an order, add its number: it helps us answer faster.