Privacy Policy
What card-exchange collects, why, and what we never do with it.
Last updated: 13 September 2026
The short version. Your card collection lives on your phone. We don't sell your data, we don't run ads, and we don't show your inventory to anyone unless you deliberately list a card for sale at a trade event or publish it on eBay. Card identification and pricing run on your device. Photos you deliberately select for an eBay listing are sent to eBay when you verify that listing.
Who we are
card-exchange is an Android application (package ca.cardexchange.app) for
identifying, pricing, collecting and trading Pokémon trading cards. This policy covers the
app and this website, card-exchange.ca.
Questions, requests or complaints: [email protected].
What we collect
Account information
If you create an account, we use Firebase Authentication (Google) to store your email address and a unique account identifier. If you sign in with Google, we receive your email address and basic profile information from Google. We never see or store your password.
Your collection and trade data
Cards you scan, collections you build, exchanges you create and receipts you generate are stored on your device. If you are signed in, this data is also synced to our server so you don't lose it when you change phones. It is tied to your account and is not visible to other users.
Camera
The app uses your camera to identify cards. Card images are processed on your device — the recognition models run locally. Photographs are not uploaded to our servers for identification, and we do not retain a copy of what your camera sees. If you deliberately prepare an eBay listing, the selected listing photos are handled as described under “Connected eBay listings” below.
Location
The app requests location access only for the Trade Events feature, to show nearby events and to confirm you're at an event you're joining. It is requested at the point you use that feature, it is not collected in the background, and you can decline it and still use every other part of the app.
Pricing lookups
When you check a price, your device queries eBay directly and computes the result locally. Anonymous, aggregated price results may be contributed back to our pricing service to improve accuracy for everyone. These contributions carry card and price data — not your identity, your collection, or your account.
Connected eBay listings
Connecting an eBay seller account is optional and available to eligible Pro accounts. You sign in on eBay and choose whether to authorize card-exchange. We do not receive your eBay password. We receive your seller identity and authorization tokens so the app can prepare, verify and publish listings you explicitly approve. Authorization tokens are encrypted on our server.
We read the shipping, payment and return policies for the marketplace you select. If you choose to create seller policies in card-exchange, we request the additional eBay permission needed to manage those settings and show the proposed policies for your review.
Listing details and photos
When you verify an eBay listing, the selected public listing details and actual card photos are sent through our server to eBay. This can include the title, description, price, quantity, item specifics, condition, dispatch location, selected seller policies, and the selected front, back and optional detail photos. eBay may store those selected photos before you publish. Publishing requires a separate explicit action after review.
We keep returned photo references and listing verification and recovery records so you can resume work and check uncertain results without creating a duplicate listing. Your original collection photos remain on your device. The listing payload does not include your purchase costs, private notes or local file paths. A published listing is public on eBay and is governed by eBay's terms and privacy policy.
Disconnecting and deleting eBay data
You can disconnect the seller connection in card-exchange or remove the app's authorization in your eBay account settings. Disconnecting removes our stored access credentials. It does not end listings already created on eBay. Saved listing and recovery records may remain so an uncertain or previously published listing is not accidentally duplicated. Contact us through the data-deletion process in this policy to request removal of stored integration data.
When eBay sends a verified, signed account-deletion notice, we remove integration data associated with that seller. The app also removes matching saved eBay data when it reconnects and successfully processes the deletion update. We retain only minimal deletion markers needed to prevent removed data from being restored and to let offline devices complete cleanup. These markers are not used for advertising or to create new listings.
Diagnostics
We collect basic device and app-version information to diagnose crashes and errors.
This website
If you join the early-access list, we store the email address you submit, whether you identified as a vendor or a collector, the country your request came from, and the time you submitted it. To stop automated abuse we also keep a short-lived counter keyed to your IP address; it expires automatically about an hour after your last request and is never linked to the email you submitted.
We use Cloudflare Web Analytics to count page views and see which pages people reach. It sets no cookies, does not fingerprint your device, does not track you across other websites, and gives us aggregate counts only — never a profile of an individual visitor. There are no advertising trackers and no third-party advertising cookies on this site.
Upgrade analytics
Inside the app we count how people arrive at our paid tier, so we can tell which Pro features are actually wanted. This records five things and nothing else: which Pro feature you tapped before being told it needs Pro, that the subscription page was opened and what sent you there, and whether a subscription was started, completed or abandoned. Each record carries a random per-install identifier, your app version, and — if you are signed in — your account ID, so we can tell a subscriber apart from someone who never subscribed.
No card names, collection contents, photographs, prices or notes are ever included, and there is no free-text field in these records at all. This is our own system on our own server; it is not Google Analytics or any advertising SDK, and the data is never shared or sold. It is on by default — turn it off any time under Settings → Privacy → Share upgrade analytics, which also discards anything still waiting to be sent from your device.
Beta and early-access testers
Before launch we run a limited testing programme. If you join it, a few extra things apply, and we'd rather say them plainly than bury them:
- To give you access we add the email address of your Google account to a test group in Google Play. That means Google receives it, and Google's own privacy policy governs what they do with it. We can't test the app any other way.
- We use the email you gave us on this site only to invite you and to tell you when the app is ready. We won't add you to any test without you opting in yourself.
- Testers see features before they're finished. Pricing, receipts and profit tracking may change or break during testing, and data created in a pre-release build can occasionally be lost when we fix something. We'll warn you before anything destructive.
- If you send us feedback, we keep it so we can act on it, and we may quote it anonymously when Google asks us to describe our testing. We will never attach your name or email to a public quote without asking you first.
- You can leave the test at any time — opt out in Google Play, or email us and we'll remove you. Leaving a test does not delete your account or your collection.
What we do with it
| Data | Purpose |
|---|---|
| Email & account ID | Sign you in, sync your collection, contact you about the service |
| Collection & trades | Provide the app's core features; restore your data on a new device |
| Camera frames | Identify the card in front of you, on-device, in the moment |
| Location | Find and join nearby trade events, when you ask it to |
| Anonymous price data | Improve pricing accuracy for all users |
| eBay seller identity & encrypted authorization tokens | Connect the seller you authorize and make the eBay listing features work |
| Selected eBay listing fields & photos | Verify the listing with eBay and publish it only after your final review |
| eBay listing recovery records & deletion markers | Resume uncertain results, avoid duplicate listings and prevent deleted seller data from being restored |
| Diagnostics | Fix crashes and bugs |
| Upgrade analytics | See which Pro features people want and whether the subscription page works. No card data, ever. |
| Early-access email | Tell you when the app is available, and invite you to the test if you want in. Nothing else. |
| Tester feedback | Fix what you tell us is broken; describe our testing to Google when applying for release |
What we never do
- We do not sell or rent your personal information to anyone.
- We do not show advertising, and we do not share your data with ad networks or data brokers.
- We do not make your collection public. Other users see only the cards you explicitly flag For Sale at a trade event you have joined or deliberately publish on eBay.
- We do not upload your card photographs for identification. Photos you deliberately select for an eBay listing are uploaded for eBay verification and publication.
- We do not ask for, process, or store your payment card details. If and when paid subscriptions launch, billing is handled entirely by Google Play — we receive confirmation that a subscription is active, never your financial information.
Who else is involved
We use a small number of third-party services, each for a specific job:
- Google Firebase — authentication, push notifications and beta build distribution.
- Cloudflare — hosts this website, routes traffic to our server, and provides the cookieless page-view analytics described above.
- eBay — your device queries eBay's public pages for sold-listing prices. If you connect a seller account, eBay also provides the seller identity and authorization you approve and receives the public listing details and photos you select for verification and publication. eBay's own terms and privacy policy apply.
- Google Play — app distribution and, in future, subscription billing.
card-exchange is not affiliated with, endorsed by, or sponsored by Nintendo, The Pokémon Company, or eBay.
Where your data lives
Our server is operated in Canada. Firebase and Cloudflare process data across infrastructure that may be located outside your country, including the United States.
How long we keep it
Account and collection data are kept while your account exists. If you ask us to delete your account, we remove your account record and the collection data associated with it. Anonymous, aggregated price data is not linked to you and is retained. Early-access emails are kept until launch, or until you ask us to remove yours — whichever comes first. Connected eBay listing and recovery data may be retained to resume work and avoid duplicate listings. You can request removal of that integration data. Minimal deletion markers may remain to prevent removed seller data from being restored and to let offline devices finish cleanup.
Your choices
- Access or delete your data — email [email protected] and we'll action it.
- Revoke a permission — camera and location can be withdrawn at any time in Android Settings. The app keeps working; the features needing them stop.
- Disconnect eBay — disconnect in card-exchange to remove the seller connection and its access credentials. You can also revoke card-exchange's access in your eBay account settings. Neither action ends listings already created on eBay.
- Leave the early-access list — reply to any email from us, or write to the address above.
- Turn off upgrade analytics — Settings → Privacy → Share upgrade analytics. Switching it off stops collection immediately and discards anything still queued on your device.
- Use it signed out — scanning, pricing and a local collection work without an account. Nothing syncs, and nothing leaves your device except price lookups and upgrade analytics, if you leave those on.
Children
card-exchange is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy materially, we will update the date at the top of this page and, where the change affects how we use data you've already given us, notify you in the app.