Privacy Policy

Last updated: 5 May 2026

This Privacy Policy explains how trade.singles ("we", "us") collects, uses, and protects your information when you use the trade.singles mobile app and website (the "Service").

1. Information we collect

When you create an account and use the Service, we collect:

• Account information: email address, username, and authentication credentials. If you sign in with Google or Apple, we receive your email and a unique identifier from that provider.
• Profile information you provide: avatar, bio, city, games you collect, and a "looking to trade" flag.
• Content you create: your card collections (For Trade, Want, Keep), folders, friend connections, trades, ratings, store preferences, and direct messages between you and your friends.
• Generated identifiers: a unique account ID and an 8-character friend code.

We do not collect device identifiers for advertising, location data, contacts, or biometric data. We do not track you across other apps or websites.

2. How we use information

We use the information above only to operate the Service: authenticate your account, store your collections, match you with friends' trade opportunities, deliver direct messages, and display per-user pricing in your chosen currency. We do not sell or rent personal data.

3. Service providers

We use the following third-party providers to operate the Service:

• Supabase — database, authentication, storage, and realtime infrastructure. Your account, collections, and messages are stored on Supabase's managed Postgres infrastructure.
• Scryfall and pokemontcg.io — public card-data APIs we query for card details and prices. We do not send any personal information to these providers; only card identifiers (set code, collector number) are transmitted.
• Frankfurter / open.er-api.com — public foreign-exchange rate APIs. No personal information is sent.
• Google and Apple — authentication providers, used only when you choose to sign in with one of these accounts.
• Vercel — hosts the trade.singles website you are reading now.

4. Data visibility

The Service uses row-level access controls so that:

• Your collections are visible only to you and to friends whose friend request you have accepted.
• Direct messages are visible only to the sender and the recipient.
• Public profile information (username, avatar, city, games, looking-to-trade flag, rating averages) is visible to all signed-in users.

5. Children

The Service is not intended for children under 13. If we become aware that a user under 13 has created an account, we will delete it.

6. Your rights

You can:

• Access your data — everything you've stored is visible inside the app.
• Modify your profile, collections, and friend connections at any time from within the app.
• Delete your account from the Profile tab in the app. Deletion is immediate and irreversible. It removes your account, profile, collections, ratings, friendships, direct messages, and any trade records you were part of (which means those trades also disappear from the other party's history). Avatar files are deleted from storage. If for any reason you cannot complete the in-app deletion, email us using the contact below.

If you are in the European Union, the United Kingdom, California, or another jurisdiction granting additional rights (such as access, portability, or restriction), email us using the contact below to exercise those rights.

7. Data retention

We keep your account data until you delete your account or request deletion. Backups may persist for up to 30 days after deletion, after which data is purged.

8. Security

Data is transmitted over HTTPS. Database access is gated by row-level security policies enforced by Supabase. Passwords (when not using a third-party provider) are hashed by Supabase Auth.

9. Changes

We may update this policy. Material changes will be highlighted in the app or by email. The "Last updated" date above will change.

10. Contact

For privacy questions or requests: support@trade.singles.