Privacy Policy

Overview

Capely ("we", "us") sells Minecraft cape redemption codes. This policy explains what we collect when you browse this site or buy a code, why we collect it, and what you can ask us to do about it. It is written to be read rather than to sound impressive. Capely is not affiliated with, endorsed by, or sponsored by Mojang Studios or Microsoft.

What we collect

Only what the shop needs to work. We never ask for your real name, your postal address or your phone number ourselves, and there is nowhere on our own pages to give them. If you pay by card, Whop's payment form asks for the name on the card and a billing address, which go to Whop: see Payments.

• Your email address, typed at checkout. We send your receipt to it, which is also the copy of your code you can keep, and it is how we identify your order and contact you about it.
• Your order: the capes, the quantity, the price, the payment method, any discount code used, any referral code, and the reference our payment processor gives us.
• The description your browser sends with every request. It is stored with your order, to help us spot fraud.
• A Minecraft username, only if you use the try it on preview. Our server asks Mojang's public API for that account's skin and keeps the answer in memory for a few minutes so a repeat preview is quick. It is never written to our database, and your browser never talks to Mojang itself.
• A referral code, only if you arrived through a creator's link. It is kept in your browser for 30 days and recorded with any order you place in that time, so the creator gets the credit. It does not identify you.
• Page views: which page you opened, which cape if you were on a cape page, the site you came from, which parts of the page you scrolled to, and, when you leave, which part was on screen and how long you stayed. There is more on this under Analytics below.
• A review, if you send us one: the display name you choose, your rating and what you wrote. Nothing is published until we have read it.

Our server also sees the address your connection comes from, because every web server does. We use it to limit how fast requests can arrive, so a script cannot drain the stock or hammer the site. We do not keep the address itself with your order. What we keep is a shortened, salted hash of it, stored with your order and with any review you send, so repeat activity can be recognised without naming you. The salt changes every day, so a hash cannot be turned back into an address or matched from one day to the next. There is one exception: a request that looks like an attack on the site is logged with the address it came from, so that address can be blocked.

How we use it

To take your order and issue your code. To find your order and answer you if you get in touch. To spot fraud and discount abuse. To credit a creator for a referral. To keep the records we need for accounting and tax. We do not sell your information, we do not share it for advertising, and we do not use it to build a profile of you.

Payments

Payments are handled by a payment processor: Whop for card, Apple Pay and Google Pay, PayPal for PayPal, or NOWPayments for cryptocurrency. All are paid at checkout, on this site, except that a card payment is made on Whop's own website, and a PayPal payment on PayPal's, when its form cannot be shown here or you choose that.

If you pay by card, Apple Pay or Google Pay, the payment is processed by Whop. You do not need a Whop account. The payment form at checkout is Whop's own. It is loaded from whop.com into our page by Whop's script, in frames that belong to Whop, and what you type in it goes straight to Whop. It does not pass through Capely's server and our page cannot read it. The form asks for your card, the name on it and your billing country and address, which Whop uses to take the payment and to work out any tax. Whop's script and form are loaded only on the payment step of checkout, and only after you have chosen Card and continued. No other page loads them, and they are not loaded if you choose cryptocurrency. When they load, your browser connects to Whop, so Whop sees the address your connection comes from and what a browser sends to any website it opens, and Whop runs its own fraud checks, under Whop's privacy policy. Whop's script also loads the Apple Pay button from Apple, and the Google Pay button from Google where your browser can use it, so your browser connects to those companies too. Your bank may ask you to confirm the payment, inside the form. We give Whop our order id, which capes you bought and how many, the order total in US dollars, the email address you gave us (so the form does not ask for it again; Whop may email you a receipt of its own), and the address to send you back to, which is your order's own link. If the form cannot be shown, or you choose to, you pay the same way on Whop's own website and are sent back here afterwards. Whop's own record of the payment is open to us as the seller, and it shows the name, email address and billing details you gave Whop. We do not copy them into our own records.

If you pay with PayPal, the payment is processed by PayPal. On the payment step of checkout, once you have chosen PayPal and continued, our page loads PayPal's script from paypal.com, which draws PayPal's own buttons: one to pay with your PayPal account, and one to pay by debit or credit card through PayPal without an account. Pressing one opens PayPal's window, and what you type there goes straight to PayPal. It does not pass through Capely's server and our page cannot read it. No other page loads PayPal's script, and it is not loaded if you choose another way to pay. When it loads, your browser connects to PayPal, so PayPal sees the address your connection comes from and what a browser sends to any website it opens, and PayPal runs its own fraud checks, under PayPal's privacy policy. We give PayPal our order id, which capes you bought and how many, and the order total in US dollars. We do not give PayPal your email address. PayPal's own record of the payment is open to us as the seller, and it shows the name and email address of the PayPal account, or the details you gave for a card. We do not copy them into our own records. If PayPal's buttons cannot be shown, you can pay the same way on PayPal's own website and are sent back here afterwards.

If you pay with cryptocurrency, our server asks NOWPayments for a payment address and shows it to you at checkout. NOWPayments is given the amount, our order id, the coin you chose and a short description of which capes you bought, and no email address. Nothing is loaded from NOWPayments in your browser.

From any processor we keep what happened to the payment, with a reference and the amount, and for a card payment the processor's fee where Whop reports one, and nothing about your card.

Your code

Codes are issued automatically after a successful payment. They are shown to you on the order confirmation page and emailed to the address you gave at checkout, through our email provider, Resend. While you pay, your order number and its access token are held in your browser's session storage, and they go when you close the tab. The code itself is not stored in your browser. We keep our own record of which code went with which order, so we can help if you lose it. Because a code has value only until it is redeemed, a code that has been shown to you is treated as sold. The Terms of Service explain what that means for refunds.

Cookies

This site sets no advertising cookies. The one place another company's code sets cookies is the card payment step, described below. The site sets two cookies of its own while you browse the shop, so we can count visitors and visits without a third party analytics service. One names your browser and lasts up to a year. The other names the current visit and lapses after 30 minutes of inactivity. Both are random strings set by this site, and neither carries your name, your email or anything you typed. Nobody else is sent them. On the card payment step alone, Whop's script runs inside our page, so it is technically able to read them and the order held in your browser there. They are set when your browser talks to our own API, so if you have Do Not Track or Global Privacy Control switched on, browsing alone will not set them. If you arrive through one of our links, such as capely.store/name, a third cookie, cap_ref, holds that link's name for 30 days, so an order you place in that time is credited to the link even when your browser blocks our scripts. It holds nothing else, no script on the page can read it, and it is not set if your browser sends Do Not Track or Global Privacy Control. Clearing your cookies removes them.

If you reach the card payment step, Whop's script sets two cookies on this site's address, named _whop_ssk and whop_anonymous_id. Each holds a random identifier that Whop's script uses to recognise the same browser and visit while you pay. Our own code does not read them. Whop may also set cookies of its own from inside its form, on its own address (whop.com) and under its own policies, which this site cannot read. Whop's script also keeps one entry in your browser's storage for this site, listed below.

What your browser keeps

Separately from cookies, the shop stores a few things in your own browser. They sit on your device and are not sent to us on their own.

• Your basket, as cape ids and quantities only, never prices. Every price is worked out by our server.
• The currency you chose to view prices in. The conversion is for display only. Our prices are set in US dollars; if you pay by card, Whop's form shows the final amount, which may be in your own currency and include tax.
• A referral code, for up to 30 days, if you followed a creator's link.
• The order you are paying for: its number, its access token and how you chose to pay, and for a cryptocurrency payment the address and amount shown to you. This is session storage for the current tab and is gone when you close it. Your code is not stored in your browser.
• Your country, as two letters (for example GB), so each page shows prices in your currency without asking our server again. This is session storage for the current tab and is gone when you close it.
• A note that you came to checkout from another page of the shop, kept for a moment to draw the page transition. This is session storage for the current tab and holds only a time.
• That you closed the offer bar at the top of the page, if you did, so it stays closed.
• An entry written by Whop's script, named _whop_device, if you reach the card payment step. It holds a random identifier for your browser. Whop's script reads it. Our own code does not. It stays until you clear your browser storage.
• An entry written by PayPal's script, named __paypal_storage__, if you reach the PayPal payment step. PayPal's script reads it. Our own code does not. It stays until you clear your browser storage. PayPal may also set cookies of its own from inside its buttons and its window, on its own address (paypal.com) and under its own policies, which this site cannot read.

Clearing your browser storage removes all of it.

Analytics

Our analytics are our own. There is no Google Analytics and no advertising pixel anywhere on this site, and the fonts and the 3D code are served from our own server, so opening a page tells nobody but us that you were here. Another company's script runs in two places only, both on the payment step of checkout and nowhere else, described under Payments: Whop's, with the Apple Pay and Google Pay buttons it loads, once you choose Card, and PayPal's once you choose PayPal. Your browser sends us a short note when you open a page: which page it was, which cape if you were on a cape page, and the site you came from. It sends another as each part of the page reaches the middle of your screen, and one when you leave the page saying which part was showing and how many seconds you stayed. It never records where your mouse goes or what you type. An order link's access token is stripped out before the page address is sent. Order and referral events are recorded by our server rather than by your browser, because a browser can claim a purchase that never happened. Requests that announce themselves as bots are not counted, and if your browser sends a Do Not Track or Global Privacy Control signal the page sends nothing at all. These usage records are deleted after 180 days.

To show prices in your own currency, and the right flag beside English, our server looks up which country the address of your connection belongs to, in a table of address ranges kept on our own server: IP Geolocation by DB-IP, used under its free licence (CC BY 4.0). Your address is not sent to DB-IP or anyone else for this, and the country is not recorded by us. It only changes how prices are displayed: every order is charged in US dollars.

Who else sees your information

Only where the shop cannot work otherwise. Our payment processors, to take the payment: Whop if you pay by card, Apple Pay or Google Pay, which is given the order details and email address listed under Payments above, and which sees whatever you type into its form at our checkout or give it on its own website; PayPal if you pay with PayPal, which is given the order details listed under Payments and sees what you give it in its own window; and NOWPayments if you pay in cryptocurrency, which is given neither your email address nor your IP address. Our email provider, Resend, to deliver your receipt: because that receipt contains your code, the provider handles both your email address and the code itself. Mojang's public API, if you use the try it on preview, which our server queries on your behalf. And anyone we are required by law to tell, such as in answer to a valid legal request. We do not share your information with advertisers or data brokers. The sale alerts we send to ourselves carry the order id, the capes and the amount, and no customer details. Whop, PayPal, NOWPayments, our email provider and Mojang are outside the United Kingdom, so information sent to them may be handled abroad.

Keeping it safe

The site is served over HTTPS. Cape codes are encrypted where they are stored, with a key held outside the database, so a copy of the database on its own does not reveal a single code. The database itself is not reachable from the web. We cannot promise that any system is impossible to break into, and we would not trust a shop that did.

How long we keep it

Order records, including the email address and any referral code on the order, are kept for as long as we need them for accounting, tax, fraud prevention and support. Usage records are deleted after 180 days. The referral code in your browser expires after 30 days. You can ask us to delete an order record and we will, except where we are required to keep it.

Children

This site is not aimed at children under 13 and we do not knowingly collect information from them. Minecraft is popular with younger players, so if you are a parent or guardian and believe your child has given us information, contact us and we will remove it.

Your choices

You can ask what we hold about an order, ask for a copy of it, ask us to correct it, or ask us to delete it. You can turn cookies off, switch Do Not Track on, or clear your browser storage at any time. Nothing here depends on us recognising you, although clearing your storage will empty your basket. To make a request, contact us below and tell us the email address you used at checkout, so we can find the order.

Changes

We will update this policy as the shop changes. The date at the top is when it last changed. Using the site after an update means you accept the updated version.

Contact

Reach us on Discord or by email at capelybusiness@gmail.com. Requests about your information can go to either. Our order receipts come from a sending address that is not monitored for replies, so please do not reply to a receipt to contact us.