Privacy Policy

Last updated: June 23, 2026

CardSwaps ("we", "our", or "us") is operated by CardSwap LLC. This Privacy Policy explains how we collect, use, and protect your information when you use the CardSwaps mobile application.

Information We Collect

We collect the following information when you create an account or use the app:

• Account information — your first name, last name, username, email address, and optionally your phone number. You may sign up directly with an email and password, or via Apple Sign-In or Google Sign-In. When you use a social sign-in option, we receive your name and email address from that provider. Your phone number is collected only if you consent to SMS during registration and is used solely for account-related text messages.
• Location — your precise location (latitude and longitude), used to show you nearby traders on the map and discovery screens. Location is only collected while the app is in use, only if you grant permission, and can be disabled at any time in your device settings. Only your city or region is shown to other users — your exact coordinates are never shared.
• Profile photos and banner — a profile photo and optional banner image you choose to upload. We do not access your photo library without your explicit permission.
• Card photos — up to two photos per card that you choose to attach to items in your collection, used to document card condition.
• Collection and wishlist data — the cards you add to your collection and wishlist, including condition, card variant (e.g. 1st Edition, Reverse Holo), PSA grade, graded value, and any custom values you set.
• Trade activity — trade offers you send and receive, the cards and any monetary amounts involved, messages exchanged within trades, and your completed trade history.
• Direct messages — messages you send to and receive from other users outside of trade conversations.
• Social connections — accounts you follow and accounts that follow you.
• Ratings — ratings you submit about other users, and ratings others submit about you.
• Support submissions — when you contact us through the in-app contact form, we collect your name, email address, the nature of your inquiry, any description you provide, and any images you choose to attach. If you submit a user report, we also collect the username of the reported user.
• Device push token — used to send you notifications about trade activity and messages. Collected only if you grant notification permission.
• Watchlist pins — cards you choose to pin to your price watchlist to track market price changes over time. This is separate from your wishlist and is used only to display price activity to you.

How We Use Your Information

• To create and manage your account
• To show you nearby traders and facilitate card trades
• To enable direct messaging between users
• To send you push notifications about trade offers and messages
• To send account-related emails, such as password reset codes
• To send account-related text messages, such as password reset codes and email change verification codes
• To display your profile, collection, and trading history to other users
• To operate the follower and following system
• To display ratings on user profiles
• To respond to support inquiries and investigate user reports

Information Visible to Other Users

The following information is visible to other CardSwaps users by design, as it is core to the app's trading and community functionality:

• Your username, display name, profile photo, and banner image
• Your card collection and wishlist, including card photos, condition, variant, PSA grade, and custom values
• Your approximate city or region (never your precise coordinates)
• Your follower and following counts
• Your completed trade count
• Ratings left on your profile by other users

Photos you upload are stored at URLs that are accessible without authentication. You should not upload photos containing sensitive personal information.

Third-Party Services

We use the following third-party services to operate the app. We share only the minimum information necessary with each.

• Apple Sign-In — if you choose to sign in with Apple, Apple provides us with your name and email address. Apple's privacy policy applies to data Apple holds.
• Google Sign-In — if you choose to sign in with Google, Google provides us with your name and email address. Google's privacy policy applies to data Google holds.
• Expo Push Notification Service — we send your push token, notification title, notification body, and trade ID to Expo's servers to deliver notifications to your device.
• Resend — we use Resend to send transactional emails such as password reset codes. Your email address is transmitted to Resend for this purpose.
• Twilio — we use Twilio to send account-related text messages, such as password reset codes and email change verification codes. Your phone number is transmitted to Twilio for this purpose. We do not share your mobile number with any other third parties for marketing purposes.
• DigitalOcean — your data is stored on servers hosted by DigitalOcean in the United States.
• Pokemon TCG API — we query this service for card metadata (names, images, and market prices). No personal information is sent to this service.

We do not sell your personal information. We do not share your information with any advertising networks or analytics platforms.

Text Messaging (SMS)

If you consent to SMS during registration, CardSwaps may send you text messages for account-related purposes only, including password reset codes and email change verification codes. Message frequency varies based on your account activity.

Your mobile number is never shared with third parties for marketing purposes.

Message and data rates may apply. You can opt out at any time by contacting us at [email protected].

Data Storage and Security

Your data is stored on servers hosted by DigitalOcean. We take reasonable measures to protect your information, including:

• Encrypted connections (HTTPS) for all data in transit
• Passwords stored as bcrypt hashes — we never store your password in plain text
• Authentication tokens stored in secure storage on your device
• Password reset codes hashed before storage and valid for 15 minutes only

Your Choices

• Location — you can disable location access at any time in your device settings. You can also toggle location visibility within the app's Settings screen.
• Notifications — you can disable push notifications for trades and messages independently in the app's Settings screen, or disable them entirely in your device settings.
• Card photos — you can remove photos attached to collection cards at any time within the app.
• Text messages — you can opt out of SMS at any time by contacting us at [email protected].
• Account deletion — you can permanently delete your account and all associated data directly from the Settings screen in the app. This action is immediate and irreversible.

Children's Privacy

CardSwaps is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the date at the top of this page.

Contact

If you have any questions about this Privacy Policy or want to request deletion of your data, you can reach us through the Contact form in the app or by email at:

[email protected]