Privacy Policy

What card-exchange collects, why, and what we never do with it.

Last updated: 25 September 2026

Who we are

card-exchange is an Android application (package ca.cardexchange.app) for identifying, pricing, collecting and trading Pokémon trading cards. This policy covers the app and both websites, card-exchange.ca and app.card-exchange.ca.

Questions, requests or complaints: hello@card-exchange.ca.

What we collect

Account information

If you create an account, we use Firebase Authentication (Google) to store your email address and a unique account identifier. If you sign in with Google, we receive your email address and basic profile information from Google. We never see or store your password.

Your collection and trade data

Cards you scan, collections you build, exchanges you create and receipts you generate are stored on your device. If you are signed in, this data is also synced to our server so you don't lose it when you change phones. It is tied to your account and is not visible to other users.

Camera

The app uses your camera to identify cards. Card images are processed on your device — the recognition models run locally. Photographs are not uploaded to our servers for identification, and we do not retain a copy of what your camera sees. If you deliberately prepare an eBay listing, the selected listing photos are handled as described under “Connected eBay listings” below.

Location

The app requests location access only for the Trade Events feature, to show nearby events and to confirm you're at an event you're joining. It is requested at the point you use that feature, it is not collected in the background, and you can decline it and still use every other part of the app.

Pricing lookups

When you check a price, your device queries eBay directly and computes the result locally. Anonymous, aggregated price results may be contributed back to our pricing service to improve accuracy for everyone. These contributions carry card and price data — not your identity, your collection, or your account.

Connected Google Sheets workbook

Connecting Google Sheets is an optional Pro feature. After you authorize card-exchange through Google, our server sends your synced collection, inventory and sales records to a workbook in your Google Drive and keeps its Inventory and Sales History sheets updated. This includes card and collection details, quantities, condition and grade, recorded prices and purchase costs, stock and sale dates, and notes. The Dashboard is yours to customize; automatic updates do not overwrite it.

We request Google's drive.file permission, which limits access to files created by, opened with, or explicitly shared with card-exchange. We use it to create and update your vendor workbook. We do not receive your Google password. Authorization tokens are encrypted on our server; we also store the workbook identifier and synchronization status to maintain the connection.

Disconnecting Google Sheets removes our saved authorization credentials and stops further automatic updates. It does not delete your workbook or custom Dashboard. You can delete the file yourself in Google Drive and revoke access in your Google account settings. Google's privacy policy and your Drive sharing settings apply to the workbook.

Connected eBay listings

Connecting an eBay seller account is optional and available to eligible Pro accounts. You sign in on eBay and choose whether to authorize card-exchange. We do not receive your eBay password. We receive your seller identity and authorization tokens so the app can prepare, verify and publish listings you explicitly approve. Authorization tokens are encrypted on our server.

We read the shipping, payment and return policies for the marketplace you select. If you choose to create seller policies in card-exchange, we request the additional eBay permission needed to manage those settings and show the proposed policies for your review.

Listing details and photos

When you verify an eBay listing, the selected public listing details and actual card photos are sent through our server to eBay. This can include the title, description, price, quantity, item specifics, condition, dispatch location, selected seller policies, and the selected front, back and optional detail photos. eBay may store those selected photos before you publish. Publishing requires a separate explicit action after review.

We keep returned photo references and listing verification and recovery records so you can resume work and check uncertain results without creating a duplicate listing. Your original collection photos remain on your device. The listing payload does not include your purchase costs, private notes or local file paths. A published listing is public on eBay and is governed by eBay's terms and privacy policy.

Disconnecting and deleting eBay data

You can disconnect the seller connection in card-exchange or remove the app's authorization in your eBay account settings. Disconnecting removes our stored access credentials. It does not end listings already created on eBay. Saved listing and recovery records may remain so an uncertain or previously published listing is not accidentally duplicated. Contact us through the data-deletion process in this policy to request removal of stored integration data.

When eBay sends a verified, signed account-deletion notice, we remove integration data associated with that seller. The app also removes matching saved eBay data when it reconnects and successfully processes the deletion update. We retain only minimal deletion markers needed to prevent removed data from being restored and to let offline devices complete cleanup. These markers are not used for advertising or to create new listings.

Diagnostics

We collect basic device and app-version information to diagnose crashes and errors.

Our websites

If you join the early-access list, we store the email address you submit, whether you identified as a vendor or a collector, the country your request came from, and the time you submitted it.

We use Cloudflare Web Analytics to count page views and see which pages people reach. It sets no cookies, does not fingerprint your device, does not track you across other websites, and gives us aggregate counts only — never a profile of an individual visitor. There are no advertising trackers and no third-party advertising cookies on this site.

Optional website analytics

With your permission, we use Google Analytics on card-exchange.ca and app.card-exchange.ca to understand which campaigns bring visitors, which pages and features are useful, and where people have trouble getting started. Google Analytics is off until you accept. Declining it does not change how either website works.

When you accept, Google Analytics uses first-party cookies with a random browser identifier to recognize visits across our two websites. We send broad page categories, selected campaign labels and specific actions such as opening the web app, choosing an install link, searching, viewing prices, adding a card or completing an exchange. We do not send your account ID, email address, search text, card or collection contents, photographs, prices, private notes, or private page identifiers. Google also processes basic browser and device information. We do not enable advertising personalization, Google Signals or session recordings.

Choose Analytics choices in the marketing website footer or Settings → Privacy choices in the web app to change your choice. Turning analytics off stops new Google Analytics events and removes its cookies for these websites. Analytics cookies expire after 180 days without automatically extending their lifetime. We remember your choice for 180 days so we can respect it on your next visit. The separate cookieless Cloudflare counts described above continue.

Native-app upgrade analytics

Inside the Android and iOS apps we count how people arrive at our paid tier, so we can tell which Pro features are actually wanted. This records five things and nothing else: which Pro feature you tapped before being told it needs Pro, that the subscription page was opened and what sent you there, and whether a subscription was started, completed or abandoned. Each record carries a random per-install identifier, your app version, and — if you are signed in — your account ID, so we can tell a subscriber apart from someone who never subscribed.

No card names, collection contents, photographs, prices or notes are ever included, and there is no free-text field in these records at all. This is our own system on our own server; it is not Google Analytics or any advertising SDK, and the data is never shared or sold. It is on by default — turn it off any time under Settings → Privacy → Share upgrade analytics, which also discards anything still waiting to be sent from your device.

Beta and early-access testers

Before launch we run a limited testing programme. If you join it, a few extra things apply, and we'd rather say them plainly than bury them:

• To give you access we add the email address of your Google account to a test group in Google Play. That means Google receives it, and Google's own privacy policy governs what they do with it. We can't test the app any other way.
• We use the email you gave us on this site only to invite you and to tell you when the app is ready. We won't add you to any test without you opting in yourself.
• Testers see features before they're finished. Pricing, receipts and profit tracking may change or break during testing, and data created in a pre-release build can occasionally be lost when we fix something. We'll warn you before anything destructive.
• If you send us feedback, we keep it so we can act on it, and we may quote it anonymously when Google asks us to describe our testing. We will never attach your name or email to a public quote without asking you first.
• You can leave the test at any time — opt out in Google Play, or email us and we'll remove you. Leaving a test does not delete your account or your collection.

What we do with it

Data	Purpose
Email & account ID	Sign you in, sync your collection, contact you about the service
Collection & trades	Provide the app's core features; restore your data on a new device
Camera frames	Identify the card in front of you, on-device, in the moment
Location	Find and join nearby trade events, when you ask it to
Anonymous price data	Improve pricing accuracy for all users
Google Sheets workbook data & encrypted authorization tokens	Create and update the optional vendor workbook after your Google authorization
eBay seller identity & encrypted authorization tokens	Connect the seller you authorize and make the eBay listing features work
Selected eBay listing fields & photos	Verify the listing with eBay and publish it only after your final review
eBay listing recovery records & deletion markers	Resume uncertain results, avoid duplicate listings and prevent deleted seller data from being restored
Diagnostics	Fix crashes and bugs
Optional website analytics	Understand campaign performance, feature use and the steps to getting started, when you agree.
Upgrade analytics	See which Pro features people want and whether the subscription page works. No card data, ever.
Early-access email	Tell you when the app is available, and invite you to the test if you want in. Nothing else.
Tester feedback	Fix what you tell us is broken; describe our testing to Google when applying for release

What we never do

• We do not sell or rent your personal information to anyone.
• We do not show advertising, and we do not share your data with ad networks or data brokers.
• We do not make your collection public. Other users see only the cards you explicitly flag For Sale at a trade event you have joined or deliberately publish on eBay.
• We do not upload your card photographs for identification. Photos you deliberately select for an eBay listing are uploaded for eBay verification and publication.
• We do not ask for, process, or store your payment card details. If and when paid subscriptions launch, billing is handled entirely by Google Play — we receive confirmation that a subscription is active, never your financial information.

Who else is involved

We use a small number of third-party services, each for a specific job:

• Google Firebase — authentication, push notifications and beta build distribution.
• Google Sheets and Drive — store your optional vendor workbook and receive its inventory and sales data after you authorize the connection.
• Cloudflare — hosts this website, routes traffic to our server, and provides the cookieless page-view analytics described above.
• Google Analytics — processes optional website usage data when you agree. See how Google uses data from sites that use its services.
• eBay — your device queries eBay's public pages for sold-listing prices. If you connect a seller account, eBay also provides the seller identity and authorization you approve and receives the public listing details and photos you select for verification and publication. eBay's own terms and privacy policy apply.
• Google Play — app distribution and, in future, subscription billing.

card-exchange is not affiliated with, endorsed by, or sponsored by Nintendo, The Pokémon Company, or eBay.

Where your data lives

Our server is operated in Canada. Firebase, Google Analytics and Cloudflare process data across infrastructure that may be located outside your country, including the United States.

How long we keep it

Account and collection data are kept while your account exists. If you ask us to delete your account, we remove your account record and the collection data associated with it. Anonymous, aggregated price data is not linked to you and is retained. Early-access emails are kept until launch, or until you ask us to remove yours — whichever comes first. Connected eBay listing and recovery data may be retained to resume work and avoid duplicate listings. You can request removal of that integration data. Minimal deletion markers may remain to prevent removed seller data from being restored and to let offline devices finish cleanup.

Your choices

• Access or delete your data — email hello@card-exchange.ca and we'll action it.
• Revoke a permission — camera and location can be withdrawn at any time in Android Settings. The app keeps working; the features needing them stop.
• Disconnect eBay — disconnect in card-exchange to remove the seller connection and its access credentials. You can also revoke card-exchange's access in your eBay account settings. Neither action ends listings already created on eBay.
• Disconnect Google Sheets — disconnect from Vendor workbook to stop automatic updates and remove our saved credentials. Your workbook remains in Google Drive, where you can delete it.
• Leave the early-access list — reply to any email from us, or write to the address above.
• Choose website analytics — use Analytics choices in the footer of either website. This is separate from the native app's upgrade-analytics setting.
• Turn off upgrade analytics — Settings → Privacy → Share upgrade analytics. Switching it off stops collection immediately and discards anything still queued on your device.
• Use it signed out — scanning, pricing and a local collection work without an account. Nothing syncs, and nothing leaves your device except price lookups and upgrade analytics, if you leave those on.

Children

card-exchange is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

If we change this policy materially, we will update the date at the top of this page and, where the change affects how we use data you've already given us, notify you in the app.