card-exchange

Privacy Policy

What card-exchange collects, why, and what we never do with it.

Last updated: 29 October 2026

The short version. Your card collection lives on your phone. We don't sell your data, we don't run ads, and we don't show your inventory to anyone unless you deliberately list a card for sale at a trade event, publish it on eBay, connect your Google Sheets workbook, or invite partners to your vendor group. Card identification and pricing run on your device. Photos you deliberately select for an eBay listing are sent to eBay when you verify that listing.

Updated 10 October 2026: this policy now describes the first-party visit measurement on card-exchange.ca (see "How we measure this website" below) and removes the Google Analytics section, which this site no longer runs. This notice stays here for 30 days from that date.

Updated 11 October 2026: this policy now describes vendor groups (see "Vendor groups" below), synced show records, and per-account saves on your device. This notice stays here for 30 days from that date.

Updated 14 October 2026: the app no longer uses your device's location (see "Location" below). Your Trade profile shows only a city you type yourself. This notice stays here for 30 days from that date.

Updated 19 October 2026: from version 2.2.0, the optional upgrade analytics also cover how offline pack downloads go (see "Native-app upgrade analytics" below). They stay off unless you turn them on. This notice stays here for 30 days from that date.

Updated 20 October 2026: when you send a bug report, we also post its description to a private staff channel on our Discord server (see "Diagnostics" below). Your account ID, email and name are not included. This notice stays here for 30 days from that date.

Updated 29 October 2026: vendor groups are now businesses of their own: control can be handed over, and a disbanded group's data stays on our server for 30 days before it is deleted (see "Vendor groups" below). This notice stays here for 30 days from that date.

Who we are

card-exchange is an app for Android and iOS (iPhone), with identifier ca.cardexchange.app, for identifying, pricing, collecting and trading Pokémon trading cards. This policy covers the app and both websites, card-exchange.ca and app.card-exchange.ca. The operator is Belal Kourkmas.

Who is responsible for your personal information

Belal Kourkmas, Privacy Officer, is responsible for how card-exchange handles personal information. Contact: [email protected]. We do not publish a postal address.

How to complain

Email [email protected] first. We aim to reply within 30 days. If you are not satisfied with our reply, you can complain to:

What we collect

Account information

If you create an account, we use Firebase Authentication (Google) to store your email address and a unique account identifier. If you sign in with Google, we receive your email address and basic profile information from Google. On iPhone, you can also use Sign in with Apple; we receive the account information Apple shares with us, which can include Apple's private relay email address. We never see or store your Google or Apple password.

Your collection and trade data

Cards you scan, collections you build, exchanges you create and receipts you generate are stored on your device. Each account you sign in with on a device keeps its own separate save there, and using the app signed out keeps a separate Guest save, so one account's cards never appear under another. If you combine two saves, you first sign in to both accounts, and the cards are copied into the account you choose. Pro and Vendor Pro provide account-linked cloud collection backup and restore. Online trades, messages, and event listings are also stored on our server to provide those services. Your collection is not public by default; other people can see information you deliberately share through trades, listings, or connected services.

Your chosen trading nickname, permanent public account ID, and the date you joined card-exchange are visible to other users. Your shared trade history with another account remains linked to that account when its nickname changes; ordinary users cannot see that account's private interactions with other people.

A vendor's online shop is available only while their stand is open at an unexpired event. Vendors choose which collections to bring to each event; only cards marked for sale in those selected collections are published in the shop.

Customers can privately choose the cards they brought to an event. Sending an offer shares a snapshot of the selected cards still available at that time with the other participant. Later sales or collection changes do not update that previously shared bay. Private event choices and availability records support future offers; vendors do not receive a live feed of those records.

Reports and written block explanations are not shown to the person they concern. Authorized moderators can review reported accounts, reporting accounts and their relevant trade and message history to investigate abuse or malicious reports. Communications withheld because of a block may be retained privately for safety review and are not delivered later. Moderator access and decisions are recorded.

Vendor groups

A Vendor Pro member can start a vendor group, a business they run with up to five partners. The member who runs it (the group's controller) can hand control to a partner who has Vendor Pro; the partner has 7 days to accept. To invite a partner, the controller types that person's email address. We store it with the group so that the partner sees the invitation when they sign in with that verified email address, or the controller can give them a join code that expires. We do not send emails to invited people. We store the group name the controller chooses, who is in the group, when each member was invited and joined, and an open hand-over offer (who offered control, to whom, and when the offer expires). The group name is shown outside the group, for example on a shared show stand, only after the controller confirms it as public, like a trading nickname. The group's website showcases show the controller's trading nickname.

The group's business data belongs to the group, not to any member's own account: collections, prices and costs, sales and purchases, receipts, goals, notes, wishlists, value history, stands, listings, showcases, and the trades made for the group with their messages. Every member can see and change it. Each member's own (Personal) data stays theirs; a member copies collections into the group only when they choose to. Members cannot see each other's email address, sign-in details, subscription or eBay seller connection. Members see each other only by trading nickname (or "Collector") and public account ID, never by email address.

To keep everyone's copies in sync and to stop the same card being sold twice, we record with each shared record which member's account last changed it and which app installation made the change (a random identifier the app creates; it is not your phone's hardware ID), and which member completed each group trade.

When a partner leaves or is removed, their device keeps a read-only copy of the group's data as it was on that device at that moment. When the controller disbands the group, every member's device keeps such a copy, and the group's stands, listings and showcases are taken down at once. Those copies stay on members' devices only, and no one can remove a copy from another member's device. After a disband we keep the group's data on our server for 30 days, readable but not changeable by its former members, so that a device that was offline can catch up; then we delete it. When a group is disbanded we also keep a record of it: the group's name, its former members' account IDs, and the dates it was disbanded and its data deleted. We keep this record after the group's data is deleted, so that a former member's app that comes back online later still learns that the group was disbanded. A member's account ID is removed from the record when that member deletes their account.

Shows you track in the app (show records) are synced to our server with your account's other synced business data: the show's name, the event it is linked to, its start and end times, the cash on hand you started with, cash deposits and withdrawals with any note you add, and show expenses (amount, label, category, and whether they were paid from cash). In a vendor group, show records are shared with the group's members. They are deleted when you delete your account, or with the group's data.

Camera

The app uses your camera to identify cards. Card images are processed on your device — the recognition models run locally. Photographs are not uploaded to our servers for identification, and we do not retain a copy of what your camera sees. If you deliberately prepare an eBay listing, the selected listing photos are handled as described under “Connected eBay listings” below.

Location

The app does not read your device's location, in the app or in the background. Your Trade profile shows only a city you type yourself, and a trade event's map pin comes from the venue address its organizer enters. On Android 11 and older, Android requires the location permission before an app can search for Bluetooth devices, so the app asks for it only to find a label printer you pair; it never reads your location with it.

Pricing lookups

When you check a price, your device queries eBay directly and computes the result locally. Aggregated price results, with no identity, collection or account information attached, may be contributed back to our pricing service to improve accuracy for everyone. These contributions carry only card and price data.

Connected Google Sheets workbook

Connecting Google Sheets is an optional Pro feature. After you authorize card-exchange through Google, our server sends your synced collection, inventory and sales records to a workbook in your Google Drive and keeps its Inventory and Sales History sheets updated. This includes card and collection details, quantities, condition and grade, recorded prices and purchase costs, stock and sale dates, and notes. The Dashboard is yours to customize; automatic updates do not overwrite it.

We request Google's drive.file permission, which limits access to files created by, opened with, or explicitly shared with card-exchange. We use it to create and update your vendor workbook. We do not receive your Google password. Authorization tokens are encrypted on our server; we also store the workbook identifier and synchronization status to maintain the connection.

Disconnecting Google Sheets removes our saved authorization credentials and stops further automatic updates. It does not delete your workbook or custom Dashboard. You can delete the file yourself in Google Drive and revoke access in your Google account settings. Google's privacy policy and your Drive sharing settings apply to the workbook.

Connected eBay listings

Connecting an eBay seller account is optional and available to eligible Pro accounts. You sign in on eBay and choose whether to authorize card-exchange. We do not receive your eBay password. We receive your seller identity and authorization tokens so the app can prepare, verify and publish listings you explicitly approve. Authorization tokens are encrypted on our server.

We read the shipping, payment and return policies for the marketplace you select. If you choose to create seller policies in card-exchange, we request the additional eBay permission needed to manage those settings and show the proposed policies for your review.

Listing details and photos

When you verify an eBay listing, the selected public listing details and actual card photos are sent through our server to eBay. This can include the title, description, price, quantity, item specifics, condition, dispatch location, selected seller policies, and the selected front, back and optional detail photos. eBay may store those selected photos before you publish. Publishing requires a separate explicit action after review.

We keep returned photo references and listing verification and recovery records so you can resume work and check uncertain results without creating a duplicate listing. Your original collection photos remain on your device. The listing payload does not include your purchase costs, private notes or local file paths. A published listing is public on eBay and is governed by eBay's terms and privacy policy.

Disconnecting and deleting eBay data

You can disconnect the seller connection in card-exchange or remove the app's authorization in your eBay account settings. Disconnecting removes our stored access credentials. It does not end listings already created on eBay. Saved listing and recovery records may remain so an uncertain or previously published listing is not accidentally duplicated. Deleting your card-exchange account removes the saved connection, seller personal information, drafts, and stored listing photos. Minimal publication and deletion identifiers can remain to prevent duplicate listings or restoration of deleted data. See account deletion.

When eBay sends a verified, signed account-deletion notice, we remove integration data associated with that seller. The app also removes matching saved eBay data when it reconnects and successfully processes the deletion update. We retain only minimal deletion markers needed to prevent removed data from being restored and to let offline devices complete cleanup. These markers are not used for advertising or to create new listings.

Diagnostics

Think-Back Logging is optional and records recent activity in a local, seven-day log. It does not automatically upload that log. If you choose Report a Bug, the app sends your description and recent logs to our support service. We also post the description, app and operating-system versions, device model and a report number to a private staff channel on our Discord server so our team sees it; your account ID, email and name are not included. The report and logs sent to our support service can include your account and device identifiers, app and operating-system versions, device model, screens and actions, request timings, error/status information, and short service-response previews. We keep the submitted report and logs to diagnose the issue; they are linked to the account sending the report.

Security checks (Android)

When you buy or restore a subscription, or complete or cancel a trade, the Android app asks Google Play Integrity for a security check. Google tells us whether the app is the unmodified version we published and was installed from Google Play, whether the device passes Google's integrity checks, how often the device has requested such checks recently, the status of Google Play Protect, and whether apps that could capture the screen, draw over other apps or control the device are installed or running. Google reports only those categories, not which apps they are.

We store a summary of that result with your account ID, the action that triggered it and the time, for up to 90 days or until you delete your account. We use it only to detect fraud and protect subscriptions and the trading system. The check never blocks, delays or changes any feature, purchase or subscription. The iPhone app and the web app do not perform this check; for those requests we record only that no check result was received.

Our websites

If you join the early-access list, we store the email address you submit, whether you identified as a vendor or a collector, the country your request came from, and the time you submitted it.

How we measure this website

On card-exchange.ca we run our own first-party visit measurement on every page request, before you have made any choice (unless you have turned counting off; see "Your measurement choices" below). This is separate from, and in addition to, the account, camera and other app data described above, and separate from the native app's own optional upgrade analytics (below). It replaces Google Analytics, which this site no longer uses. If your browser still holds cookies from our earlier Google Analytics setup (_ga, _ga_KMSRWCHFV8 or ce_analytics_v1), our pages on card-exchange.ca delete them when you next open one.

What we record on every page request

For visitors in the United States, and in Canada with a known province other than Quebec, each page request is linked, for one Toronto calendar day, to a daily code built from your IP address and browser (see "The daily code" below), and we keep a visit record of: which of our four pages you viewed, and when (to the minute, plus your local hour and day of the week); the website you came from (its main domain only, such as reddit.com) and its kind (search, social, a direct link and so on); campaign labels from a short fixed list (anything else is stored as "other", so a personal tag in a link is never kept); your device type, operating system, browser family and whether it is an in-app browser; your browser's main language; your country and province or state; your rough network class (for example, a cloud server or VPN relay), never the exact network number; which visit of today's this is, and how many minutes it has been since your first visit today; the signals we use to judge whether a visit is a bot; and whether you tapped an install link, which store it led to, and how many seconds after the page loaded.

Everyone else is counted only in a daily total for that page, broad area and bot judgement, with no code, no visit record and no recorder: Quebec, Canada when we cannot tell the province, every country outside the United States and Canada (including the EU/EEA and the UK), Tor, anyone we cannot place, and any browser that sends "Do Not Track" or "Global Privacy Control". Their install-link taps are counted the same way, by store instead of page.

A random sitting identifier groups the page views of one sitting (a new sitting starts after 30 minutes without a page view). It is kept with your visit record for as long as that record exists (see "How long we keep each kind of data" below). Once the daily code is deleted, the sitting identifier is no longer linked to any daily code.

The daily code

The daily code is built from your IP address and browser information for one Toronto calendar day, and links the page views and install-link taps that share it that day. It is never used for Quebec, the EU/EEA, the UK, or anyone else outside the regions above.

Shortly after midnight (Toronto time), an install-link tap or an Allow answer can still be matched, through the previous day's code, to a page you viewed before midnight — at most 6 hours earlier; it is then recorded with that earlier visit and kept as long as that visit record. Our hourly cleanup normally deletes the previous day's code within 1 hour after midnight. We stop using the previous day's code to link anything new more than 3 hours after midnight, whether or not that cleanup has finished; if it has not, we keep retrying the deletion until it is gone. A deleted copy of the code still exists in Cloudflare's own Time Travel backup for 7 days.

The detailed recorder (only after you say Allow)

The recorder runs only on our home page, and only for visitors in the regions above who tap Allow on the choice panel. Your Allow lasts 12 months, so it also runs on your later visits to the home page in that time, until you change your choice. For each visit it records: which sections of the page you see and for how long, the links, buttons, videos and questions you use, scrolling and zoom, where you leave the page, your screen size and display settings (such as dark mode or reduced motion), your connection type, whether the page was translated and into which language, how fast the page loads, any errors, and the install links you tap. It never records the text you type, select or copy (only that a selection or copy happened, and where on the page), and it sends what it records only to our own site.

Before you choose, the page carries an identifier naming that one page view; Allow returns a pass for that page view only. The recorder script itself is fetched only afterwards, when your browser is next idle: normally within 1 second of tapping Allow (3 seconds on a later page). Browsers without an idle-time signal, such as Safari, fetch it about 1 second after Allow (3 seconds on a later page), counted from when the page has finished loading if that is later.

We use what the recorder gathers to see which parts of the page work well and which do not. Two further uses of the same data are planned and not running yet: a replay of an individual visit for authorised staff, and spotting general patterns across many visits ("moments"). We will update this policy before either starts. You can stop the recorder at any time: choose No thanks under "Privacy choices" on the home page, or use "Don't count my visits" (see "Your measurement choices" below).

What we use this measurement for

Who sees this data

Cloudflare processes it for us, as our infrastructure provider, under its standard data processing terms. Individual visit records can be read only by the operator named above, who runs the database. When the planned staff viewer starts, only staff who need an individual visit for their work will see it there, and each such access will be logged. Investors, a prospective buyer or any other outside reviewer of the business see aggregate figures only.

Where it is stored

Cloudflare's worldwide edge network briefly handles each request. The database itself (Cloudflare D1) is located in the United States. Authorities in the United States, or elsewhere Cloudflare operates, may be able to compel access to data stored there.

How long we keep each kind of data

Your measurement choices

Don't count my visits (use this link) works per browser: from then on, nothing from this browser is counted or recorded, not even in the daily totals. When you open the link from our own site (or type it in), it also deletes, shortly afterwards and where it can, the visit records that this browser's daily code links today and, until that code is deleted shortly after midnight, the previous day (Toronto time). That code is shared by anyone using the same network address with the same browser, browser version and operating system that day, so their linked records are deleted too, alongside yours. In browsers that tell us where a request came from (all current major browsers do), the link opened from another website still saves your choice but deletes nothing. Earlier records, the choice log and the aggregate totals stay as they are.

Count my visits again (use this link, from our own site) turns counting back on in this browser. Either link brings you back to this section; no confirmation message is shown.

If you are shown the choice panel, Allow and No thanks are offered with equal weight; neither is highlighted over the other. Saying No thanks does not stop the basic page-request counting described above; it only keeps the detailed recorder off.

We use two cookies for this. ce_count remembers "Don't count my visits" for 2 years, renewed each time you open one of our pages while it is set. ce_measure remembers Allow or No thanks for 12 months, or for 30 days if you close the panel that opened by itself without answering (that counts as No thanks); scripts on the page cannot read it.

If your browser sends "Do Not Track" or "Global Privacy Control", we never give it a daily code, a visit record or the recorder: its page views are counted only in the daily totals. Where you get only daily totals (see "What we record on every page request" above), or after you have turned counting off, "Privacy choices" offers both counting links, because the page cannot tell which applies to you.

Your rights over this data

Because none of this is tied to your name, we can normally only look up a record through a daily code that still exists: today's, or, until our hourly cleanup deletes it shortly after midnight, yesterday's. A saved copy of our home page from a visit where you were offered the choice also carries an identifier for that one page view, which can find that one visit record. Contact [email protected] for access, correction or deletion requests, or to withdraw your Allow. See "How to complain" above for the privacy regulators you can also contact.

Nevada

If Nevada law gives you the right to ask us not to sell certain information, send that request to [email protected].

Native-app upgrade analytics

If you opt in, inside the Android and iOS apps we count how people arrive at our paid tiers, so we can tell which Pro features are actually wanted. This records five things about upgrades and nothing else: which Pro feature you tapped before being told it needs Pro, that the subscription page was opened and what sent you there, and whether a subscription was started, completed or abandoned. Each record carries a random per-install identifier, your app version, and — if you are signed in — your account ID, so we can tell a subscriber apart from someone who never subscribed.

From version 2.2.0 the same opt-in also records how offline pack downloads go: which pack (the scanner, card images or a game catalog) was picked, started, finished or failed, where in the app it was picked, whether the phone was on Wi-Fi, mobile data or offline, roughly how long the download took (in broad ranges), and, for a failure, a short error code from a fixed list (such as the app store's error). It never records how much storage your phone has, the size of anything on it, or anything about your cards.

No card names, collection contents, photographs, prices or notes are ever included, and there is no free-text field in these records at all. This is our own system on our own server; it is not Google Analytics or any advertising SDK, and these records stay on our own server — we do not sell them. Starting with version 2.0.0 build 339, it is off unless you explicitly enable it under Settings → Privacy → Share upgrade analytics. Every app feature remains available with analytics off. Older builds enabled this collection by default; you can turn it off using the same setting or update. On update, an older default-on preference does not count as consent and queued observations from that setting are discarded. Turning analytics off stops new collection and discards anything still waiting to be sent from your device.

Beta and early-access testers

Before launch we run a limited testing programme. If you join it, a few extra things apply, and we'd rather say them plainly than bury them:

What we do with it

DataPurpose
Email & account IDSign you in, sync your collection, contact you about the service
Collection & tradesProvide the app's core features; restore your data on a new device
Vendor group name, members, invitation emails, hand-over offers & change recordsLet the members of a vendor group run their business together, keep their copies in sync, and stop the same card being sold twice
Camera framesIdentify the card in front of you, on-device, in the moment
City you type on your Trade profileShow other traders roughly where you are, in the words you choose
Aggregated price dataImprove pricing accuracy for all users
Google Sheets workbook data & encrypted authorization tokensCreate and update the optional vendor workbook after your Google authorization
eBay seller identity & encrypted authorization tokensConnect the seller you authorize and make the eBay listing features work
Selected eBay listing fields & photosVerify the listing with eBay and publish it only after your final review
eBay listing recovery records & deletion markersResume uncertain results, avoid duplicate listings and prevent deleted seller data from being restored
DiagnosticsFix crashes and bugs
Android security check resultsDetect fraud and protect subscriptions and trades. Never used to block or change a feature.
Website visit measurementUnderstand campaign performance, feature use and the steps to getting started; basic counts always, page detail only after Allow.
Upgrade analyticsSee which Pro features people want, whether the subscription page works, and whether offline pack downloads work. No card data, ever.
Early-access emailTell you when the app is available, and invite you to the test if you want in. Nothing else.
Tester feedbackFix what you tell us is broken; describe our testing to Google when applying for release

What we never do

Who else is involved

We use a small number of third-party services, each for a specific job:

card-exchange is not affiliated with, endorsed by, or sponsored by Nintendo, The Pokémon Company, or eBay.

Where your data lives

Our server is operated in Canada. Firebase, Cloudflare and Discord process data across infrastructure that may be located outside your country, including the United States (see also "Where it is stored" above, for the website measurement data specifically).

How long we keep it

Account and cloud collection data are kept while your account exists. In version 2.0.0 build 339 or newer, use Settings → Danger Zone → Delete Account in the app to remove your account, Firebase sign-in record, owned server data, and saved service connections. You verify your identity before deletion. The app distinguishes completed deletion from pending cleanup; interrupted server cleanup is retried.

Other collectors may retain their own completed transaction facts and receipts, with your identity replaced by a deleted-account reference and your name, contact information, and photos removed. We retain minimal deletion and moderation security markers and limited eBay publication identifiers to prevent abuse, duplicate listings, and restoration of deleted data. Android security check summaries are deleted after 90 days, or sooner when you delete your account. When a vendor group is disbanded, its invitations and hand-over offer are deleted at once, and its business data 30 days later. The record of the disbanded group (its name, its former members' account IDs, and the disband and deletion dates) is kept after that; a member's account ID is removed from it when that member deletes their account. Deleting the controller's account disbands the group unless they handed control to a partner first. The change records stay with the group's data and are deleted with it. Read-only copies that members' devices kept stay on those devices. A partner who deletes their account leaves the group; the group's data is not affected. Historical backup or log copies, where present, are not necessarily erased at the same instant as live service data.

When you delete your account in the app, that device's save for the account is erased once our server confirms the deletion. The Guest save, other accounts' saves, and saves on other devices remain until you delete them in the app. Your Google Drive workbook, live eBay listings, and Apple or Google billing records remain with those services. Deleting your account does not cancel store subscriptions. Staff delete bug-report posts on Discord after 90 days. Aggregated price contributions are retained with no link to your account. Early-access emails are kept until launch or until you ask us to remove yours. See what account deletion removes and retains.

Your choices

Children

card-exchange is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Effective date

This policy, as it describes our website measurement, takes effect on 10 October 2026 — the date we publish this version.

Changes to this policy

If we change this policy materially, we will update the date at the top of this page, keep a dated notice like the one above for 30 days, and, where the change affects how we use data you have already given us, notify you in the app.