Privacy Policy

1. Who we are

SwapSignal is operated by [OPERATING ENTITY — TO BE CONFIRMED BEFORE LAUNCH] (ABN [ABN — TO BE CONFIRMED]). You can contact us about privacy at [CONTACT EMAIL — TO BE CONFIRMED].

This policy explains what personal information SwapSignal collects, why, who can see it, and what you can do about it. It applies to the SwapSignal website and the account you create on it.

SwapSignal has no advertising, no analytics, no tracking pixels, no marketing lists and no payment processing. We do not sell or share your information with anyone for their own purposes.

2. What we collect

Account and sign-in information. Your email address and a securely hashed version of your password, along with the dates your account was created, confirmed and last signed in. This is held by our authentication provider (see section 5). We never see or store your password itself.

Profile information. The username and display name you choose, the suburb you select, your preferred search radius, whether you trade in person, by mail or both, and whether you want to be discoverable by other collectors.

Your For Trade list. The cards you have marked as owned and as available to trade, and how many of each.

Your Want list. The cards you are looking for.

Messages. The messages you send and receive on SwapSignal, who they were between, when they were sent, whether they have been read, and the item a message refers to if you started it from one.

Optional Facebook contact. If you choose to provide one, a link to your Facebook or Messenger profile, and whether you have turned on the option for other collectors to contact you through it. Both are optional, and you can remove or switch them off at any time.

Legal acceptance records. Which version of the Terms of Use and Privacy Policy you accepted, when you accepted them, and that you confirmed you were 18 or older. We keep this so that we can show what you agreed to. We do not ask for or store your date of birth.

Account type. Whether your account is a standard account and whether it has administrator access. Today every account is a standard free account.

Blocking and reporting are built into how SwapSignal decides who can see whom, and blocks are already respected everywhere collectors are shown. The ability to create a block or a report is not yet available in the app. When it is, we will store who blocked or reported whom, when, and any reason you give — and this policy will be updated before that happens.

3. Your suburb and how distance works

SwapSignal asks for a suburb, not an address. We never ask for, and never store, a street address.

Your profile stores a reference to a suburb from a public list of Australian localities. That list includes an approximate centre point for each suburb, which is how SwapSignal works out roughly how far away another collector is.

Other collectors are never sent your coordinates or the underlying suburb reference. The Nearby feature runs on our server and returns only your suburb name, state and postcode, and a distance rounded to the nearest kilometre. Anything under a kilometre is shown as "less than 1 km" rather than as a smaller number.

If you would rather not appear in Nearby at all, turn off discoverability in your profile.

4. Who can see what

Visible to other signed-in collectors, if you are discoverable: your username, display name, suburb, state and postcode, an approximate distance from them, whether you trade in person or by mail, the cards you have listed as available to trade, and how many cards you are looking for. Other collectors are also shown how many of your wanted cards they hold, and how many of theirs you want, so you can both see whether a swap is possible. Where you trade in person, they are also shown whether they fall inside your search radius — not the radius itself, only whether they are within it, so they can tell whether you are likely to see them.

Visible only if you opt in: your Facebook or Messenger link. It is stored privately unless you turn on "Allow collectors to contact me on Facebook". While that setting is off, the link is withheld by our database itself, not merely hidden by the website.

Visible only to the two of you: the messages in a conversation. Nobody else can read them — not other collectors, and not SwapSignal administrators. There is no staff or support access to message content, and the database refuses it rather than the website merely hiding it. The one honest limit: anyone holding direct database credentials for the service could technically read any stored data, as is true of any system; what we can tell you is that the application grants no one that access.

Never visible to other collectors: your email address, your password, your exact location or coordinates, how many of a card you own beyond what you have offered for trade, your legal acceptance records, and your account settings.

Nothing on SwapSignal is visible to people who are not signed in. Collector profiles, trade lists and the Nearby feature all require an account.

If you block someone, or they block you, neither of you will see the other anywhere collectors are listed, and neither of you can see the other’s contact details.

5. Service providers

SwapSignal uses Supabase for its database, authentication and email confirmation messages. Your account information and everything described in section 2 is stored there. Our database is hosted in Supabase’s Sydney region (ap-southeast-2).

Supabase is a company based in the United States. Although your data is stored in Australia, Supabase personnel and their own service providers may be able to access it from outside Australia in the course of running and supporting the platform.

If you choose to add a Facebook or Messenger link and another collector clicks it, they leave SwapSignal and go to a service operated by Meta. What happens there is covered by Meta’s terms and privacy policy, not ours.

These are the only third parties involved in running SwapSignal today. We will update this section before adding any others.

6. Cookies

SwapSignal sets cookies for one purpose: keeping you signed in. These hold your authentication session and are refreshed as you browse. Without them you would have to sign in on every page.

We do not use advertising cookies, analytics cookies or any other tracking technology, and we do not track you across other websites.

7. Emails we send

We send you email when it is needed for your account — confirming your email address when you sign up, and helping you reset your password — and to tell you when another collector has messaged you. There is no newsletter and no marketing email.

A new-message email tells you who wrote to you and links to the conversation. It never contains the message itself. Email is not encrypted and is often copied into other mail apps, so we keep message content inside SwapSignal where only the two of you can read it.

You will get at most one email per conversation until you have read it, so an active back-and-forth does not fill your inbox. You can turn these off in your notification settings.

8. How we protect your information

Access to your information is enforced by the database itself, through row level security rules, rather than only by the website. Sensitive fields such as your email address and your Facebook link are not readable by other users at the database level, even if a page were to ask for them.

Information shared between collectors, such as Nearby results, is produced by specific server-side functions that return only the fields listed in section 4.

No system is completely secure, and we cannot guarantee that your information will never be accessed improperly. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required.

9. How long we keep it

We keep your information while your account exists. If you delete your account, your profile, trade list, want list, contact link, messages and legal acceptance records are deleted with it.

Deleting a conversation removes it from your own inbox only. The other person keeps their copy — a message you have already sent someone is theirs as much as yours — and if they write again, the conversation reappears for you so a reply is never silently lost.

Backups and system logs held by our service providers may take some time to age out after deletion.

10. Accessing and correcting your information

You can see and change most of your information yourself in your profile at any time — your username, display name, suburb, radius, trading method, discoverability and Facebook contact link.

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account. Contact us at [CONTACT EMAIL — TO BE CONFIRMED].

Legal acceptance records are the one thing you cannot change, because their purpose is to record what was agreed and when. They are deleted along with your account.

11. Children

SwapSignal is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, please contact us and we will remove it.

12. Complaints

If you are concerned about how we have handled your personal information, please contact us first at [CONTACT EMAIL — TO BE CONFIRMED] and we will try to resolve it.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

If we make a material change to this policy, we will publish a new version and ask you to acknowledge it before you continue using SwapSignal. The version you acknowledged and the date are recorded against your account.