Terms of Service

1Acceptance of Terms

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and GachaBox Labs LLC ("GachaBox," "we," "us," or "our"), governing your access to and use of the GachaBox.GG website, mobile interfaces, APIs, and all related services (collectively, the "Service").

You represent that you are at least 18 years of age (or the age of majority in your jurisdiction) and have the legal capacity to enter into a binding contract. By using the Service, you confirm that any information you provide is accurate and complete.

Pursuant to the standard established in Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002), enforceable clickwrap consent requires that users have actual and conspicuous notice of the terms to which they are assenting. GachaBox.GG satisfies this standard by (a) presenting these Terms at sign-up, (b) requiring affirmative acknowledgment before account creation, and (c) displaying a persistent legal notice on every page of the Service linking to this document.

Under ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir. 1996), your continued use of GachaBox.GG after being presented with these Terms constitutes your express clickwrap acceptance of all provisions herein, including the mandatory arbitration clause in Section 8 and the Dynamic Fulfillment Pricing policy in Section 4.

2Service Description

GachaBox.GG is a digital collectible platform that allows Users to open randomized virtual mystery boxes containing digital representations of Pokémon Trading Card Game cards and other collectibles. The Service includes:

• Digital Box Openings: Randomized pulls from curated card pools with published pull rates for each tier.
• Digital Inventory: A user account holding digital card assets with associated market values.
• Physical Withdrawal: A request mechanism for Users to receive a physical raw Near Mint copy of a card they hold digitally, subject to the JIT Sourcing SLA in Section 5.
• Wallet & Top-Up: A stored-value GP (GachaPoints) balance used to open boxes and cover Dynamic Fulfillment Price adjustments (see Section 4).

Pokémon card imagery and names are trademarks of The Pokémon Company International. GachaBox.GG is not affiliated with or endorsed by The Pokémon Company, Nintendo, or Game Freak.

3Digital Inventory Finality

All box opening results are final and non-reversible. Once a box has been opened and a card result has been generated and written to your digital inventory, that transaction is complete. GachaBox.GG does not offer refunds, re-pulls, or exchanges on the basis of dissatisfaction with an opening result.

3.1 Provably Fair Integrity

Each pull is determined using a cryptographic commitment scheme (server seed hash committed before each session; client seed provided by the User; nonce incremented per pull). The algorithm is deterministic and tamper-evident. Any attempt to manipulate or reverse-engineer a pull result will be treated as a material breach of these Terms.

3.2 Digital-Only Nature

Digital inventory items represent rights to request fulfillment of a corresponding physical card, subject to availability through our JIT sourcing network. A digital inventory item does not constitute immediate ownership of a physical card, a securities instrument, a commodity, or any form of investment product. Market values displayed are real-time Scrydex API data and are provided for informational purposes only.

3.3 Account Termination

If your account is suspended or terminated for cause (including violation of Prohibited Conduct in Section 10), all unredeemed digital inventory items and GP wallet balance are forfeited without compensation, to the maximum extent permitted by applicable Nevada law.

4Dynamic Fulfillment Pricing

GachaBox.GG operates on a Just-In-Time (JIT) physical procurement model. Cards are not pre-stocked in a warehouse; they are sourced from secondary market suppliers at the time of your withdrawal request. Because secondary market card prices fluctuate continuously, the following 24-Hour Market Price Adjustment Policy applies to all physical withdrawal requests.

4.1 The 24-Hour Price Lock Window

4.2 Asymmetric Adjustment Rule

If more than 24 hours have elapsed since the card was pulled, the following rules apply without exception:

• If current market price > captured pull price: The difference ("delta") is automatically and atomically deducted from your GP wallet balance before the withdrawal request is accepted. The exact delta amount is disclosed at submission.
• If current market price ≤ captured pull price: No adjustment is made. You pay nothing extra. GachaBox absorbs any market decrease — no credit is issued to your account.
• If your GP wallet balance is insufficient to cover the delta: The withdrawal request is rejected with a 402 Payment Required error. No state changes are made to your inventory or wallet. You must top up your wallet and resubmit.

4.3 Scrydex API Unavailability

If the Scrydex market data API is temporarily unavailable at the time of withdrawal submission (e.g., timeout, rate limiting, or maintenance), no delta charge will be applied and the withdrawal proceeds at the originally captured price. This is a user-favorable fallback and does not constitute a guarantee of any particular price in future submissions.

4.4 Express Acknowledgment

535-Day Fulfillment SLA

Physical card withdrawals are fulfilled under a comprehensive fulfillment model governed by the following Service Level Agreement:

5.1 Fulfillment Timeline

• Upon submission, your withdrawal enters processing. Our fulfillment team prepares your raw Near Mint (NM) card for shipping.
• Our team carefully verifies the condition of the card from our inventory to ensure it meets our strict quality standards before dispatch.
• Once condition verification is complete, your withdrawal is confirmed and enters admin review for shipping authorization.

5.2 FTC Mail Order Rule Escalation Schedule

Consistent with the FTC Mail Order Rule (16 C.F.R. Part 435) and Nevada consumer protection law (NRS Chapter 598), GachaBox.GG commits to the following mandatory escalation schedule:

5.3 Condition Standard

All physical cards will be raw (ungraded) Near Mint (NM) or better condition. GachaBox.GG reserves the right to provide cards graded NM–Mint equivalent or better by reputable grading services. No graded (slabbed) cards will be shipped in lieu of raw unless explicitly agreed to by you in writing.

5.4 Shipping

Physical cards are shipped via tracked, insured courier to the address provided at withdrawal submission. Risk of loss transfers to you upon handoff to the carrier. GachaBox.GG is not liable for carrier delays, lost packages, or damage in transit, provided adequate insurance was purchased at time of shipment.

6Payments & Refunds

All purchases are processed in USD via Stripe or other authorized payment processors. GP (GachaPoints) are a platform-internal stored-value credit and are not legal tender, cryptocurrency, or a transferable security under Nevada law.

• No refunds on box openings. Once a box has been opened and the card result generated, no refund is available, subject to applicable Nevada consumer protection statutes (NRS Chapter 598).
• GP wallet balance is non-transferable. GP cannot be withdrawn as cash or transferred between accounts except where required by applicable law.
• Chargebacks. Initiating a payment chargeback for a completed box opening that was delivered as described constitutes a material breach of these Terms and may result in immediate account suspension.
• Fraud. Any transaction suspected to involve fraudulent payment methods will be immediately reversed, the associated inventory forfeited, and the matter referred to applicable law enforcement agencies.

7Provably Fair System

GachaBox.GG employs a cryptographic commitment scheme to ensure verifiable randomness for all box openings:

• A server seed is generated per session and its SHA-256 hash is committed to you before any pull.
• You may provide a client seed of your choice, which is combined with the server seed and a monotonically increasing nonce to produce each pull result.
• After a session concludes, the raw server seed is revealed, allowing independent verification of every result using our published verification algorithm.

Published pull rates for each card tier are guaranteed to sum to 100% within any given box configuration. Materially misrepresenting pull probabilities constitutes an unfair trade practice under NRS 598.0923 and applicable federal law.

8Binding Arbitration

EXCEPT AS OTHERWISE PROVIDED HEREIN, ALL DISPUTES ARISING OUT OF OR RELATING TO THESE TERMS OR YOUR USE OF THE SERVICE — INCLUDING THE FORMATION, VALIDITY, BINDING EFFECT, INTERPRETATION, PERFORMANCE, BREACH, OR TERMINATION THEREOF — SHALL BE SUBMITTED TO FINAL AND BINDING ARBITRATION UNDER NEVADA LAW.

8.1 Arbitration Rules

Arbitration shall be conducted by the American Arbitration Association ("AAA") in accordance with its Consumer Arbitration Rules, as modified by this Section 8. The arbitration shall take place in Clark County, Nevada(or via video conference at either party's election for claims under $25,000). The arbitrator may award any relief that a court of competent jurisdiction could award, including injunctive relief, on an individual basis only.

8.2 Small Claims Exception

Notwithstanding the foregoing, either party may bring an individual action in a Nevada small claims court of competent jurisdiction, provided the matter remains within that court's jurisdictional limits and is not removed or transferred.

8.3 Injunctive Relief

Either party may seek emergency injunctive or other equitable relief from a court of competent jurisdiction in Nevada solely to prevent irreparable harm pending arbitration. Seeking such relief shall not constitute a waiver of the right to arbitrate.

8.4 Costs

Filing fees and arbitrator compensation are governed by the AAA's Consumer Arbitration Rules. If the arbitrator finds that your claim was frivolous or brought in bad faith, GachaBox Labs LLCreserves the right to seek recovery of its reasonable attorneys' fees and costs pursuant to NRS 18.010.

8.5 Opt-Out Right

You have the right to opt out of this arbitration agreement by sending written notice to legal@gachabox.gg within 30 days of first accepting these Terms. Your opt-out notice must include your full name, email address, and a clear statement that you wish to opt out of binding arbitration. Opting out does not affect any other provision of these Terms.

9Class Action Waiver

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, YOU AND GACHABOX AGREE THAT EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, OR REPRESENTATIVE PROCEEDING.

Furthermore, unless both you and GachaBox expressly agree otherwise in writing, the arbitrator may not consolidate more than one person's claims and may not preside over any form of a representative or class proceeding. If this Section 9 is found to be unenforceable under applicable Nevada law, then the entirety of the arbitration agreement in Section 8 shall be null and void.

10Prohibited Conduct

You agree not to:

• Use automated scripts, bots, or mechanical means to open boxes or manipulate pull outcomes;
• Exploit, reverse-engineer, or attempt to circumvent our provably fair system;
• Use the Service for money laundering, fraud, or any unlawful purpose;
• Create multiple accounts to abuse promotions, daily pulls, or referral programs;
• Sell, transfer, or share account credentials;
• Engage in market manipulation of card values through coordinated wash trading or fake transactions;
• Attempt to execute more than one withdrawal for the same digital inventory item;
• Harass, threaten, or abuse our staff, administrators, or other users.

GachaBox.GG reserves the right to immediately suspend or terminate accounts and forfeit balances for any violation of this Section, without prior notice.

11Disclaimers & Limitation of Liability

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT UNDER NEVADA REVISED STATUTES.

TO THE FULLEST EXTENT PERMITTED BY NEVADA LAW (NRS CHAPTER 104A), GACHABOX.GG'S TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID TO GACHABOX.GG IN THE 90 DAYS PRECEDING THE CLAIM OR (B) ONE HUNDRED DOLLARS ($100.00 USD).

IN NO EVENT SHALL GACHABOX.GG BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, TO THE EXTENT PERMITTED BY NEVADA LAW.

12Governing Law

These Terms shall be governed by and construed in accordance with the laws of the State of Nevada, without regard to its conflict-of-law provisions. Relevant Nevada statutes include:

• NRS Chapter 598 — Nevada Deceptive Trade Practices Act (consumer protection, unfair business practices)
• NRS 603A — Nevada Online Privacy Law (personal information collection and security)
• NRS 719 — Nevada Uniform Electronic Transactions Act (electronic signatures and records)
• NRS Chapter 38 — Nevada Uniform Arbitration Act (arbitration agreements and enforcement)

To the extent any matter is not subject to arbitration under Section 8, the parties consent to exclusive jurisdiction in the state and federal courts located in Clark County, Nevada.

The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Terms.

13Modifications to Terms

GachaBox.GG reserves the right to modify these Terms at any time. We will provide notice of material changes by updating the Effective Date at the top of this page and, where feasible, by sending an email notification to your registered address at least 14 days before the change takes effect.

Your continued use of the Service after a modification's effective date constitutes your acceptance of the revised Terms. If you do not agree to revised Terms, you must stop using the Service and may request a refund of any unused GP balance (see Section 6).

Material changes to Sections 4 (Dynamic Fulfillment Pricing), 5 (JIT Sourcing SLA), 8 (Arbitration), 9 (Class Action Waiver), 15 (Acceptable Use Policy), or 16 (Third-Party Authentication Indemnification) will always be accompanied by a prominent, standalone notification in-app to satisfy the conspicuousness standard required by Specht v. Netscape.

15Acceptable Use Policy

Access to and use of the GachaBox.GG platform, APIs, and underlying infrastructure is conditioned on compliance with this Acceptable Use Policy ("AUP"). Pursuant to the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, and the holding of Craigslist, Inc. v. 3Taps Inc., 964 F. Supp. 2d 1093 (N.D. Cal. 2013), any access to GachaBox.GG systems beyond the scope expressly authorized by these Terms is unauthorized access under federal law, regardless of whether technical barriers were circumvented.

15.1 Prohibited Automated Access

The following activities are strictly prohibited and constitute unauthorized computer access under 18 U.S.C. § 1030(a)(2) and (a)(5):

• Web Scraping & Data Harvesting: Using any automated tool, script, spider, crawler, scraper, or extraction mechanism to access, collect, copy, or aggregate any content, card data, pricing data, pull rates data, or user data from GachaBox.GG without prior written authorization.
• Bot-Based Box Opening: Using any automated script, macro, bot, or artificial agent to simulate or perform box openings, daily pulls, or any platform interaction that would otherwise require manual human input.
• API Abuse: Querying the GachaBox.GG API at rates exceeding those documented in our published rate-limit headers; using undocumented internal API endpoints; or accessing the API with credentials belonging to another user.
• Credential Stuffing & Brute Force: Attempting to access accounts through automated credential testing, password spraying, or any method that exceeds authorized authentication flows.
• Circumvention of Access Controls: Bypassing, disabling, or attempting to defeat any rate limiter, CAPTCHA, IP block, or other technical access control measure.
• Mirror Sites & Unauthorized Republication: Reproducing, republishing, or creating derivative databases of GachaBox.GG card catalog data, box configurations, or pricing information without a signed data licensing agreement.

15.2 CFAA Enforcement Rights

Violation of Section 15.1 constitutes unauthorized access under 18 U.S.C. § 1030. GachaBox Labs LLC expressly reserves all rights available under the CFAA, including the right to pursue:

• Civil damages under 18 U.S.C. § 1030(g), including compensatory damages for losses exceeding $5,000 in any one-year period;
• Injunctive and other equitable relief from courts of competent jurisdiction in Clark County, Nevada, consistent with Section 8.3 of these Terms (which permits injunctive relief outside arbitration);
• Referral of criminal conduct to the United States Department of Justice and the Federal Bureau of Investigation.

Consistent with Craigslist, Inc. v. 3Taps Inc., the delivery of these Terms — including via the persistent global footer notice on every page of GachaBox.GG — constitutes legally adequate notice that automated, unauthorized access is prohibited. Any access to GachaBox.GG systems following receipt of this notice, beyond the scope of these Terms, is unauthorized.

15.3 Authorized API Access

Programmatic API access may be authorized through a signed Data Access Agreement ("DAA") available upon request at legal@gachabox.gg. Authorized access remains subject to published rate limits, the Clark County, Nevada arbitration clause (§8), and all other provisions of these Terms.

16Third-Party Authentication Indemnification

GachaBox.GG uses third-party identity providers, including Firebase Authentication (Google LLC) and Google OAuth 2.0(collectively, "Identity Providers"), to authenticate users and manage account sessions. By using the Service, you acknowledge and agree to the following terms regarding third-party authentication:

16.1 Identity Provider Independence

Firebase Authentication, Google OAuth 2.0, and all other Identity Providers integrated into GachaBox.GG are independent third-party services operated by entities unaffiliated with GachaBox Labs LLC or its parent holding company, Gacha Box Holdings LLC. Neither GachaBox Labs LLC nor Gacha Box Holdings LLC has control over, responsibility for, or ability to audit the internal security architecture of these Identity Providers.

16.2 Indemnification & Shield

TO THE MAXIMUM EXTENT PERMITTED BY NEVADA LAW (NRS § 78.7502 AND NRS CHAPTER 695D), YOU AGREE TO FULLY INDEMNIFY, DEFEND, AND HOLD HARMLESS GACHA BOX HOLDINGS LLC, GACHABOX LABS LLC, AND THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND SUCCESSORS FROM AND AGAINST ANY AND ALL CLAIMS, DAMAGES, LOSSES, COSTS, AND EXPENSES (INCLUDING REASONABLE ATTORNEYS' FEES) ARISING FROM OR RELATED TO:

• Identity Provider Breaches: Any unauthorized access to your GachaBox.GG account resulting from a security breach, data exposure, credential compromise, or service failure originating at Firebase Authentication, Google OAuth 2.0, or any other third-party Identity Provider;
• OAuth Token Compromise: Theft, hijacking, replay, or unauthorized use of OAuth tokens, JWT tokens, or session credentials issued by a third-party Identity Provider;
• Third-Party Policy Changes: Any harm arising from changes to the terms of service, privacy policies, security practices, or authentication protocols of a third-party Identity Provider;
• Account Takeover via Shared Credentials: Unauthorized account access resulting from your reuse of credentials across multiple services or your failure to enable two-factor authentication where available.

16.3 Scope of Shield

Gacha Box Holdings LLC and GachaBox Labs LLC expressly disclaim all liability for losses, damages, or harms to your digital inventory, GP wallet balance, or personal data arising from authentication failures originating outside the GachaBox.GG application layer. This shield applies regardless of whether the breach was foreseeable, and regardless of whether GachaBox Labs LLC was advised of the possibility of such loss.

This indemnification provision is governed by Nevada law (NRS § 78.7502) and is subject to the Clark County, Nevada arbitration mandate in Section 8. Any disputes arising from this Section 16 shall be resolved exclusively through arbitration in Clark County, Nevada, consistent with Sections 8 and 9 of these Terms.

16.4 Best-Effort Security Practices

Notwithstanding the foregoing, GachaBox.GG commits to implementing industry-standard security measures within our application layer, including server-side token verification, session expiry enforcement, and anomaly detection for unusual account activity. These measures do not extend to, and do not create liability for failures within, third-party Identity Provider infrastructure.

1747 U.S.C. § 230(d) — Parental Control Notification

Pursuant to Section 230(d) of the Communications Decency Act, 47 U.S.C. § 230(d), GachaBox.GG is required to notify you of the existence of parental control technologies that may assist in limiting access to material that is harmful to minors.

17.1 Statutory Notice

NOTICE: Commercial online services that allow interactive computer services to be used by minors are required under 47 U.S.C. § 230(d) to notify subscribers of the availability of parental control protections (such as computer hardware, software, or filtering services) that may help limit children's access to content that may be harmful to them.

GachaBox.GG is a platform intended exclusively for users 18 years of age or older. We do not knowingly permit access by minors. If you are a parent or guardian and believe a minor has created a GachaBox.GG account, please contact us at legal@gachabox.gg to request immediate account review and removal.

17.2 Available Parental Control Technologies

The following commercially available parental control technologies may assist in limiting minors' access to online services including GachaBox.GG. GachaBox.GG does not endorse, warrant, or support any of these third-party products:

• Operating System Controls: macOS Screen Time (Apple Inc.), Microsoft Family Safety (Windows), Google Family Link (Android/ChromeOS) — built-in controls for limiting application and website access by time and content category.
• Network-Level Filtering: Circle Parental Controls, OpenDNS FamilyShield, CleanBrowsing — DNS-based and router-level content filtering services.
• Browser Extensions: Bark, Qustodio, Net Nanny — application-layer monitoring and blocking tools compatible with major web browsers.
• ISP-Level Controls: Many internet service providers offer family safety packages. Contact your ISP directly to inquire about parental filtering options available on your plan.

17.3 COPPA Compliance

GachaBox.GG does not knowingly collect personal information from children under the age of 13 within the meaning of the Children's Online Privacy Protection Act (" COPPA"), 15 U.S.C. §§ 6501–6506. If we learn that we have inadvertently collected personal information from a child under 13, we will delete such information promptly. Parents or guardians with concerns regarding COPPA compliance may contact legal@gachabox.gg.

18Contact

For questions about these Terms, arbitration opt-out requests, AUP licensing inquiries, or formal legal notices, contact: