Privacy Policy

Last updated: 27 July 2026

This Privacy Policy explains how trade.singles ("we", "us") collects, uses, and protects your information when you use the trade.singles mobile app and website (the "Service").

1. Information we collect

When you create an account and use the Service, we collect:

• Account information: email address, username, and authentication credentials. If you sign in with Google or Apple, we receive your email and a unique identifier from that provider.
• Profile information you provide: avatar, bio, city, games you collect, and a "looking to trade" flag.
• Content you create: your card collections (For Trade, Want, Keep), folders, friend connections, trades, ratings, store preferences, and direct messages between you and your friends.
• Generated identifiers: a unique account ID and an 8-character friend code.
• Usage analytics: events describing how the app is used (screens viewed, features used, share-link views), processed by PostHog. In the app these events are linked to your account ID; on the public website they are anonymous. We use them only to understand and improve the Service.
• Purchase information: if you buy trade.singles Pro, RevenueCat processes your subscription status linked to your account ID. Payment itself is handled by Apple or Google — we never receive your card details.

We do not collect device identifiers for advertising, location data, contacts, or biometric data. We do not track you across other apps or websites.

2. How we use information

We use the information above only to operate and improve the Service: authenticate your account, store your collections, match you with friends' trade opportunities, deliver direct messages, display per-user pricing in your chosen currency, manage Pro subscriptions, and understand which features are used so we can improve them. We do not sell or rent personal data.

3. Service providers

We use the following third-party providers to operate the Service:

• Supabase — database, authentication, storage, and realtime infrastructure. Your account, collections, and messages are stored on Supabase's managed Postgres infrastructure.
• Scryfall and pokemontcg.io — public card-data APIs we query for card details and prices. We do not send any personal information to these providers; only card identifiers (set code, collector number) are transmitted.
• Frankfurter / open.er-api.com — public foreign-exchange rate APIs. No personal information is sent.
• Google and Apple — authentication providers, used only when you choose to sign in with one of these accounts.
• PostHog — usage analytics. Receives usage events as described in section 1 (linked to your account ID in the app; anonymous on the website).
• RevenueCat — in-app purchase and subscription management for trade.singles Pro. Receives your account ID and subscription status from Apple or Google. Never receives payment card details.
• Vercel — hosts the trade.singles website you are reading now.

4. Data visibility

The Service uses row-level access controls so that:

• Your collections are visible only to you and to friends whose friend request you have accepted.
• Direct messages are visible only to the sender and the recipient.
• Public profile information (username, avatar, city, games, looking-to-trade flag, rating averages) is visible to all signed-in users.

5. Children

The Service is not intended for children under 13. At signup we ask for your date of birth to verify this; the date itself is never stored or transmitted — only a confirmation that the check was passed. If we become aware that a user under 13 has created an account, we will delete it.

6. Your rights

You can:

• Access your data — everything you've stored is visible inside the app.
• Modify your profile, collections, and friend connections at any time from within the app.
• Delete your account from the Profile tab in the app. Deletion is immediate and irreversible. It removes your account, profile, collections, ratings, friendships, direct messages, and any trade records you were part of (which means those trades also disappear from the other party's history). Avatar files are deleted from storage. If for any reason you cannot complete the in-app deletion, email us using the contact below.

If you are in the European Union, the United Kingdom, California, or another jurisdiction granting additional rights (such as access, portability, or restriction), email us using the contact below to exercise those rights.

7. Data retention

We keep your account data until you delete your account or request deletion. Backups may persist for up to 30 days after deletion, after which data is purged.

8. Security

Data is transmitted over HTTPS. Database access is gated by row-level security policies enforced by Supabase. Passwords (when not using a third-party provider) are hashed by Supabase Auth.

9. Changes

We may update this policy. Material changes will be highlighted in the app or by email. The "Last updated" date above will change.

10. Contact

For privacy questions or requests: support@trade.singles.