Privacy Policy

Introduction

HitGaming.com ("HitGaming," "we," "us," or "our") is a United States-based small business that buys used video games, consoles, and related items from individual sellers. This Privacy Policy explains what information we collect when you use our website and services, how we use it, who we share it with, and the choices you have. It applies to www.hitgaming.com and any related services we operate.

By accessing or using HitGaming.com, you confirm that you have read, understood, and agree to this Privacy Policy and our Terms of Service. If you do not agree, please do not use the site. We may update this Policy from time to time as described in Section 12.

Plain-English summary: We collect only the information we need to give you a quote, ship you a prepaid label, inspect what you send us, and pay you. We do not sell your information and we do not run advertising trackers, except one: if you accept cookies, Google Ads measures whether our ads led to a sell order (Section 1.3 explains exactly what it receives); if you decline, it does not run. We share what is necessary with the providers who help us do those things: shipping and carrier services, payment and check-issuing services, an independent review platform, an AI provider that helps answer support questions, website analytics (only if you accept cookies), and bot protection. We also share it with anyone we are legally required to share with. Section 3 lists each one and exactly what it receives.

1. Information We Collect

1.1 Account Information

When you create an account or place a sell order, we collect:

• Name: first and last, as you provide it.
• Email address: verified at signup using a one-time token that expires after 24 hours. We use email for account access, password resets, order updates, and inspection communication.
• Password: stored only as a one-way salted hash. We never see, store, or have any way to recover your plaintext password. Password resets are sent as time-limited email tokens.
• Phone number: optional, used only if we need to reach you about a shipment or payment issue.

1.2 Transactional Information

When you sell items to us, we collect:

• Mailing / shipping address: used to generate the prepaid shipping label (USPS or UPS), and (for returns) to mail items back to you.
• Ship-from ZIP code: collected at checkout so we can determine your shipping region (contiguous US vs. non-contiguous) and produce a correctly addressed return label if the order is cancelled.
• Payout method details you provide to us: the email address tied to your PayPal account, the mobile number or username of your Venmo account, the email address where you receive your eCheck, or the name and mailing address a paper check should be made out and sent to. We store only what you choose to give us; we do not have access to your PayPal or Venmo account itself.
• Order contents: the items in your sell order, the condition tier you selected, the offer prices generated, and the date/time of the order.
• Inspection records: our inspector's notes, condition reassessments, deduction line items, and the final payout amount for each order.
• Age verification: at registration you must affirm you are 18 or older. We record the timestamp of that affirmation.
• Battery items and self-shipped orders: if your shipment contains items with lithium-ion batteries (for example, Nintendo Switch consoles, handhelds, or wireless controllers), we record your acknowledgment of how the order must be packed and shipped. If you ship an order with postage you bought yourself, we collect your tracking number, the carrier you used, and (optionally) a photograph of the packed box. On an order that qualifies for postage reimbursement, we also collect a photograph of your postage receipt and the amount you paid. These are used to verify the shipment, follow its tracking, and work out any reimbursement you are owed.
• Order history: a record of past orders associated with your account so you can see what you sold and when.
• Business seller information: if you add a business name to your profile or request a resale certificate, we collect the business name and state you submit, the approval status of your request, and a log of each certificate download (the account, business name used, and time).
• PriceBot photographs: if you use PriceBot, the photograph you upload and the list of titles it produced, kept in your account for 90 days (see Terms §13.4).
• Package photos: if you choose to add a photo of your packed box on your order page, the photo and when you added it, or a note that you chose not to add one. Our staff use the photo to match your box when it arrives and to support a claim if the carrier loses or damages it. Before we store a photo, we remove the hidden information photos can carry, such as the place where it was taken.
• Job applications: if you apply for a job through our careers page, the information on that form: contact details, availability, education, work history, references and, for applicants under 18, a parent or guardian’s name and contact details. Used only to consider your application, kept for up to one year, and shared with no one outside HitGaming.
• Price My List: if you price a list of games, the name of your file, the lines of your list and the games we matched them to, kept in your account for 90 days. The file you upload is read once and not kept.
• Item requests: if you ask us to add an item to our catalog, the details you give us and your email address, so we can tell you when it is added.

We do not store credit card numbers. We are not a seller of goods to you; we buy from you and pay you. Any credentials you provide for a payment platform are stored to send money to you, not to charge you.

1.3 Technical Information Collected Automatically

When you visit the site, our server and our session software automatically log:

• IP address: used for security, fraud prevention, rate limiting, and approximate location (city or state level).
• Browser type, version, and operating system: from the standard User-Agent header.
• Pages visited, referring page, and timestamps: used to debug errors and understand how the site is used.
• Search terms: when you search our catalog we keep the search term with your internet address for 90 days (and with your account if you are signed in), for site security and to operate the site.
• Session cookie: a first-party cookie that keeps you logged in across pages. It contains a session identifier only, not your personal data. It is cleared when you log out or when the session expires.

If you accept cookies, we use Google Analytics to measure how many people visit the site and which pages they use, and Google Ads conversion measurement to learn which of our ads lead to a sell order: when you place an order, Google receives the order number and the quoted amount, never your name, email or address. If you decline, neither is loaded. We do not use retargeting pixels, cross-site tracking or social media share trackers, and we do not sell, rent, or share browsing data with data brokers or ad networks.

1.4 Information From Third Parties

Our shipping label provider and the carriers themselves (USPS, UPS) may return information to us about your shipment, such as label ID, tracking number, scan events, and delivery confirmation. This data is associated with your sell order.

1.5 Live Chat

Our website offers a live chat widget. If you start a chat, we collect the first name, email address, and messages you provide so we can answer your question and follow up by email if needed. Chat messages may be answered by an automated AI assistant (clearly labeled as such in the chat window); when they are, your messages are processed by our AI service provider to generate the reply. Chats that need follow-up are converted into support tickets and handled like any other support email. Nothing said by the automated assistant constitutes a binding offer.

2. How We Use Your Information

We use the information described above only for the following purposes:

• Create and maintain your account, including verifying your email address and processing password resets.
• Generate buy quotes for the items you want to sell.
• Generate a prepaid shipping label and ship your items to our facility.
• Receive, inspect, and grade your items, and contact you about any condition adjustments.
• Send payment to you using the payout method you selected.
• Send transactional emails about your order (label issued, package received, inspection complete, payment sent, etc.).
• Respond to your support requests and customer-service questions.
• Detect, prevent, and investigate fraud, abuse, counterfeit items, stolen goods, account takeover attempts, and security incidents.
• Keep records required for accounting and other regulatory obligations.
• Review business seller requests, generate your personalized resale certificate packet, and keep a record of the certificates we issue.
• Improve the website, fix bugs, and analyze aggregated, non-identifying usage patterns.
• Comply with subpoenas, court orders, law enforcement requests, and other legal obligations.

We do not use your information for behavioral advertising, do not sell it for marketing purposes, and do not share it with data brokers.

3. How We Share Your Information

3.1 Service Providers We Use

We share only the minimum information necessary, and only with providers who need it to do a specific job for us. These are the categories of provider we use and what each one receives. If you want to know exactly which companies these are, ask us at sell@hitgaming.com and we will tell you.

• Shipping and label providers: receive your name, return address, package weight, declared value (for insurance) and order number, so a prepaid label can be produced and tracked. The carrier itself receives the name and address printed on the label.
• Payment and check-issuing providers: receive only what is needed to pay you by the method you chose: the payout email address, or the Venmo mobile number or username, you gave us and the amount, or your name and email address to issue an e-Check, or the payee name and mailing address you gave us to print and mail a paper check. If you choose eCheck and later ask the provider to print and mail it, the provider receives your mailing address directly from you.
• A review platform: after we pay you, a copy of your payout email is passed to an independent review service so it can invite you to review us. That copy includes your name, your email address and the order reference, which is how they are able to email you. If you would rather not be invited, tell us at sell@hitgaming.com and we will stop sending it.
• AI providers: used in four places, and only these four. If you use the live chat, your first name and the messages you type are sent to one to generate a reply; when you ask about one of your orders and it is confirmed as yours (you are signed in to the account that placed it, or you enter its order number and your account email), that order’s details, as listed below, are sent too. If you email us a support question, our staff may ask it to draft an answer, which sends the subject line and the messages in that thread and, when the question is about an order, that order’s details as listed in the next sentence. When we email you about an order, our staff may ask it to draft that message, which sends the details of that order: the order number, its status and dates, the items with their quoted prices and condition, the inspection results and notes, any bonus, your payout amount and the type of payout you chose, how many orders you have placed with us, and the subject lines of earlier emails about that order. We remove your name and email address, and we never send your home address, phone number, payout account details or tax information. If you use PriceBot, the photograph you upload is sent to a second provider for the sole purpose of reading the titles in it (Terms §13.4). They process this for us as service providers. A person reviews and sends every email the AI drafts, and no decision about your payout is ever made by AI.
• An analytics and ad-measurement provider (Google): only if you accepted cookies. Receives your IP address, the pages you view, your browser and device type, a randomly generated identifier and, when you place an order, the order number and quoted amount. Nothing is loaded and nothing is sent until you accept, and it never receives your name, email or address.
• A bot-protection provider (Cloudflare): its “are you human” check loads with our pages, so it receives your IP address and basic details about your browser, plus a challenge token when you submit a form or start a chat. This keeps automated scripts from flooding us with fake accounts and submissions. It receives nothing you type into our forms.
• Page-file providers (Google Fonts and jsDelivr): your browser downloads our lettering from Google Fonts on every page, and a small helper file from jsDelivr when you upload a photo that needs converting or scan a barcode. As with any download, each sees your IP address and browser type. They receive nothing you type.
• A geolocation lookup service: receives an IP address so we can estimate its city or state when reviewing an order or suspected automated traffic. It receives nothing else.
• Our web host: stores the site, the database and the server logs on our behalf, and carries our outgoing email.

Each of these providers is bound by its own terms and privacy policy. We choose providers that we believe maintain reasonable security and confidentiality practices, but we are not responsible for their independent acts or omissions.

3.2 Legal and Safety Disclosures

We may disclose your information when we believe in good faith that doing so is appropriate or required to:

• Comply with applicable law, regulation, subpoena, court order, warrant, or other legal process;
• Respond to a lawful request from law enforcement or a government authority;
• Enforce our Terms of Service, this Privacy Policy, or any other agreement with you;
• Protect the rights, property, safety, or security of HitGaming, our customers, our employees, or the public;
• Investigate, prevent, or address fraud, counterfeit items, stolen-goods trafficking, security incidents, or other illegal activity.

We may share information about sellers who attempt to ship stolen, counterfeit, or fraudulently obtained items with law enforcement and, where appropriate, with industry anti-fraud databases.

3.3 Business Transfers

If HitGaming is acquired by, merged with, sold to, or reorganized into another entity, or if all or substantially all of its assets are transferred, your information may be transferred as part of that transaction. Any successor entity will be bound by the commitments in this Policy unless and until it provides notice of a change.

3.4 We Do Not Sell Your Personal Information

HitGaming does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We do not "share" personal information for cross-context behavioral advertising as defined by the California Consumer Privacy Act (CCPA).

4. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect the personal information we hold against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Those safeguards include encrypting information in transit between your browser and our server, limiting access to personal information to the people and systems that need it, and reviewing our practices as our site and our tools change.

Important honest disclaimer: No method of transmission over the internet and no method of electronic storage is 100% secure. Despite our reasonable efforts, we cannot and do not guarantee absolute security. You use the site at your own risk. You are responsible for keeping your account password confidential, using a unique strong password, and notifying us immediately at sell@hitgaming.com if you suspect any unauthorized access to your account.

5. Data Retention

We retain your information only as long as necessary for the purposes described in this Policy, including legal and business needs:

• Search terms with an address or account: 90 days, then deleted automatically.
• Counts of how often a title is searched for: kept indefinitely. These are totals only: no address, no account, nothing that identifies you.
• Security and fraud-prevention logs (sign-in attempts, page-visit logs, rate-limit, block and trusted-device records, including IP addresses): 90 days, then deleted automatically. The IP address recorded on an account or a sell order is kept with that record.
• PriceBot photographs and scan results: 90 days, then deleted automatically; a scan that became a sell order keeps its result as part of the order record.
• Package photos: 90 days after the order is paid out or cancelled, then deleted automatically. Until your box is delivered, you can remove a photo yourself from your order page.
• Price My List lists: 90 days, then deleted automatically.
• Support tickets, chat transcripts, price-match, bulk-sale and item requests: kept as part of our records, including the internet address they were sent from.
• Active accounts: retained as long as you keep the account open.
• Order records (sell orders, inspection notes, payout records): kept as part of our own business records (what we bought and what we paid for it) so we can answer questions about a past order and defend against a dispute or chargeback. We do not collect tax documents from you, we do not ask for a Social Security or taxpayer ID number, and we do not report your sales to any tax authority. Some payout-platform metadata may be retained longer where that platform requires it.
• HAZMAT self-ship receipts and packaging photos: retained for two (2) years following the order's final payout for claim-support, audit, and dispute purposes, then deleted.
• Closed accounts: if you close your account, we deactivate your login and, on request, delete your profile details: name, address, phone number and payout details. What remains is the bare record of orders we completed with you and what we paid, which is our own business record. See Section 6.1 for how to close your account.
• Email verification, password reset, and receipt-upload tokens: unusable after expiry; expired records are cleared automatically.
• Server access logs: retained for a short rolling window and then rotated or deleted, except where we need to keep them longer to investigate a security or fraud issue.
• Reminder and news email: sent while your account is open and you have not turned it off; your unsubscribed status is retained indefinitely so we do not contact you again.

We may retain information longer than stated above when required to comply with a legal hold, government request, audit, dispute, fraud investigation, or to enforce our Terms.

6. Your Rights and Choices

6.1 Access, Correction, and Deletion

You may request a copy of the personal information we hold about you, ask us to correct inaccurate information, or ask us to delete your account by emailing sell@hitgaming.com from the address on file. We will respond within forty-five (45) days, or sooner where required by law. To protect you, we will verify your identity before acting on a request, typically by confirming control of the email address tied to the account.

Deletion requests cannot remove information we are required to keep for legal, tax, accounting, fraud-prevention, or recordkeeping purposes (see Section 5). In those cases we will delete or anonymize what we can and securely retain only what we must.

6.2 Email Preferences

We send two kinds of email: transactional (order updates, inspection notices, payment confirmations, security and account messages) and occasional reminder and news emails to account holders, for example a reminder that games are still in your cart. You can turn reminder and news emails off at any time under Email preferences on your account page, using the unsubscribe link in any such message, or by emailing us; once you do, we keep your address on a do-not-email list so it stays off. Transactional emails are part of the service and cannot be opted out of while your account is active. If you do not want them, close your account.

6.3 Cookies

We use a small number of cookies:

• A first-party session cookie: keeps you signed in. It holds a session identifier only, not your personal information, and is cleared when you log out or when the session expires.
• Analytics and ad-measurement cookies: set by Google so we can count visits, see which pages are used and learn which ads lead to orders. They hold a randomly generated identifier, not your name or email. These are set only if you accept cookies.
• A bot-check token: set when you submit a form, so automated scripts cannot flood us with fake accounts and submissions.
• A cookie-choice cookie: remembers whether you accepted or declined analytics cookies, so we do not ask on every visit.
• A trusted-device cookie: after you confirm a sign-in with a code we email you, it lets this browser skip the code next time. It holds a random token, not your personal information.
• An offer-bar cookie and an offer pop-up cookie: each remembers that you closed that offer. They hold nothing about you.
• A chat cookie: set when you sign out and removed the next time the chat loads, so the chat window forgets your conversation on a shared computer.

The chat window, the offer bar and the offer pop-up also keep a small note in your browser’s own storage, for the same purposes.

The first time you visit we ask whether you accept analytics cookies. Nothing analytics-related loads until you accept, and you can change your answer at any time through the Cookie choices link in our footer. You can also block or delete cookies in your browser settings, or install Google’s official opt-out add-on (opens in new tab). Blocking the session cookie will stop you signing in, checking out, or viewing your order history; blocking analytics cookies does not affect anything you can do on the site. We do not use retargeting or cross-site tracking cookies.

6.4 Do Not Track

Our site does not respond to browser “Do Not Track” signals, because there is no consistent industry standard for what they mean. We do not build advertising profiles about you and we do not follow you around other websites to show you ads. If you would rather not be counted in our traffic measurement at all, use your browser’s cookie settings or Google’s opt-out add-on linked in Section 6.3. We do honor the Global Privacy Control signal: if your browser sends it, we treat it as a “no” to cookies, and Google’s traffic and ad measurement is not loaded, even if you accepted cookies earlier.

7. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you certain rights regarding your personal information. The disclosures in this Section 7 apply to California residents.

7.1 Categories of Personal Information We Collect

In the past 12 months we have collected the following categories of personal information described in Cal. Civ. Code § 1798.140:

• Identifiers: name, postal address, email address, IP address, account ID.
• Customer records: phone number, mailing address, payment method details (such as PayPal email, Venmo mobile number or username, or the email address for an eCheck).
• Commercial information: sell-order history, items offered, payout amounts.
• Internet or network activity: pages viewed, browser type, referring URL, session cookie.
• Geolocation data: approximate, IP-derived only (city or state level); we do not collect precise GPS location.
• Inferences: we do not build behavioral profiles for advertising.

We collect this information for the business and commercial purposes described in Section 2 (operating the service, fulfilling orders, paying sellers, preventing fraud, and complying with law). The sources are listed in Section 1. The categories of third parties we disclose to are listed in Section 3.

7.2 Sensitive Personal Information

Payout-method credentials (such as a PayPal email, a Venmo mobile number or username, or the email address you provide for an eCheck) may be considered "sensitive personal information" under California law. We use this information only for the limited purpose of sending payment to you, as described in Section 2, and not for inferring characteristics about you. You are not required to make additional limitation requests under Cal. Civ. Code § 1798.121.

7.3 No Sale or Sharing

In the preceding 12 months we have not sold and have not shared personal information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

7.4 Your California Rights

• Right to know what personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
• Right to access a copy of the specific pieces of personal information we hold about you.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. (As stated above, we do not sell or share, so there is nothing to opt out of, but you can confirm this preference at any time.)
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising any of these rights. We will not deny service, change prices, or reduce service quality because you exercised a privacy right.

7.5 How to Exercise Your Rights

Submit a verifiable request by emailing sell@hitgaming.com with the subject line "California Privacy Request." We will verify the request by confirming control of the email address tied to the account (and, for high-risk requests, by requesting additional information sufficient to verify identity). You may use an authorized agent; we will require proof of the agent's authority.

We will respond within forty-five (45) days, with one extension of up to forty-five (45) days where reasonably necessary.

8. Other U.S. State Privacy Rights

Residents of other U.S. states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others with comprehensive consumer privacy laws) may have rights similar to those described in Section 7 above, including the right to access, delete, correct, and opt out of targeted advertising or the sale of personal information. We honor these rights to the extent applicable. To exercise them, contact us at sell@hitgaming.com.

9. International Users

HitGaming is a U.S.-based business. We serve sellers with a shipping address in the United States or Canada. Your information is stored and processed in the United States and may be accessed by US courts and authorities under US law. Sellers in Canada receive marketing emails only if they opt in, and can unsubscribe at any time; you may ask to see or correct the information we hold about you by contacting sell@hitgaming.com. We do not intentionally market to or solicit users in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions whose data-protection laws (such as the GDPR) impose extraterritorial obligations. If you access the site from outside the United States, you do so on your own initiative and you consent to the transfer, storage, and processing of your information in the United States, where data-protection laws may differ from those in your country.

10. Children's Privacy

HitGaming is intended only for adults aged 18 or older (or the age of legal majority in your state). The service is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it and terminate any related account. If you are a parent or guardian and believe a child under 13 has provided information to us, please contact sell@hitgaming.com immediately so we can take action.

11. Third-Party Links and Services

Our site may contain links to third-party websites, payment platforms, or carrier tracking pages. We are not responsible for the content, privacy practices, or security of any website we do not operate. Once you leave our site or interact with a third-party platform (such as PayPal, USPS, or UPS), your information is governed by that third party's own privacy policy. Please read those policies before sharing your information.

12. Changes to This Privacy Policy

We may update this Privacy Policy at any time to reflect changes in our practices, technology, applicable law, or for any other reason at our sole discretion. The "Effective Date and Last Updated" line at the top of this page shows when the current version took effect. We encourage you to review this Policy periodically. Material changes will be communicated by posting a clear notice on the site or, where appropriate, by emailing registered users. Your continued use of the site after any change becomes effective constitutes your acceptance of the updated Policy.

13. Disclaimers and Limitation

The information and services on HitGaming.com are provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, express or implied, to the maximum extent permitted by law. We make no warranty that the site will be uninterrupted, error-free, or secure, or that any data will be free from loss, alteration, or unauthorized access.

We may suspend, restrict, or terminate any account, refuse any sell order, or modify or discontinue any feature of the site at our sole discretion, with or without notice, for any reason permitted by law, including suspected fraud, misrepresentation of items, attempted sale of stolen or counterfeit goods, abusive conduct, or violation of our Terms of Service or this Policy.

To the maximum extent permitted by law, HitGaming's total aggregate liability for any claim arising out of or relating to this Privacy Policy or your use of the site is limited to the total amount we have paid you for sell orders in the twelve (12) months immediately preceding the event giving rise to the claim, or one hundred U.S. dollars ($100), whichever is greater.

Nothing in this Policy is intended to disclaim any liability that cannot be disclaimed under applicable law.

14. Contact Us

For questions, requests, or complaints regarding this Privacy Policy or our handling of your information, contact us at:

We will acknowledge your inquiry as promptly as we reasonably can and aim to respond substantively within thirty (30) days, or sooner if required by applicable law (such as the CCPA/CPRA's forty-five (45) day window). If you are not satisfied with our response, you may have the right to lodge a complaint with the California Privacy Protection Agency, your state attorney general, or another applicable supervisory authority.