Privacy Policy
What card-exchange collects, why, and what we never do with it.
Last updated: 31 July 2026
The short version. Your card collection lives on your phone. We don't sell your data, we don't run ads, and we don't show your inventory to anyone unless you deliberately list a card for sale at a trade event. Card identification and pricing run on your device, not on our servers.
Who we are
card-exchange is an Android application (package ca.cardexchange.app) for
identifying, pricing, collecting and trading Pokémon trading cards. This policy covers the
app and this website, card-exchange.ca.
Questions, requests or complaints: [email protected].
What we collect
Account information
If you create an account, we use Firebase Authentication (Google) to store your email address and a unique account identifier. If you sign in with Google, we receive your email address and basic profile information from Google. We never see or store your password.
Your collection and trade data
Cards you scan, collections you build, exchanges you create and receipts you generate are stored on your device. If you are signed in, this data is also synced to our server so you don't lose it when you change phones. It is tied to your account and is not visible to other users.
Camera
The app uses your camera to identify cards. Card images are processed on your device — the recognition models run locally. Photographs are not uploaded to our servers for identification, and we do not retain a copy of what your camera sees.
Location
The app requests location access only for the Trade Events feature, to show nearby events and to confirm you're at an event you're joining. It is requested at the point you use that feature, it is not collected in the background, and you can decline it and still use every other part of the app.
Pricing lookups
When you check a price, your device queries eBay directly and computes the result locally. Anonymous, aggregated price results may be contributed back to our pricing service to improve accuracy for everyone. These contributions carry card and price data — not your identity, your collection, or your account.
Diagnostics
We collect basic device and app-version information to diagnose crashes and errors.
This website
If you join the early-access list, we store the email address you submit, whether you identified as a vendor or a collector, the country your request came from, and the time you submitted it. To stop automated abuse we also keep a short-lived counter keyed to your IP address; it expires automatically about an hour after your last request and is never linked to the email you submitted.
We use Cloudflare Web Analytics to count page views and see which pages people reach. It sets no cookies, does not fingerprint your device, does not track you across other websites, and gives us aggregate counts only — never a profile of an individual visitor. There are no advertising trackers and no third-party advertising cookies on this site.
Beta and early-access testers
Before launch we run a limited testing programme. If you join it, a few extra things apply, and we'd rather say them plainly than bury them:
- To give you access we add the email address of your Google account to a test group in Google Play. That means Google receives it, and Google's own privacy policy governs what they do with it. We can't test the app any other way.
- We use the email you gave us on this site only to invite you and to tell you when the app is ready. We won't add you to any test without you opting in yourself.
- Testers see features before they're finished. Pricing, receipts and profit tracking may change or break during testing, and data created in a pre-release build can occasionally be lost when we fix something. We'll warn you before anything destructive.
- If you send us feedback, we keep it so we can act on it, and we may quote it anonymously when Google asks us to describe our testing. We will never attach your name or email to a public quote without asking you first.
- You can leave the test at any time — opt out in Google Play, or email us and we'll remove you. Leaving a test does not delete your account or your collection.
What we do with it
| Data | Purpose |
|---|---|
| Email & account ID | Sign you in, sync your collection, contact you about the service |
| Collection & trades | Provide the app's core features; restore your data on a new device |
| Camera frames | Identify the card in front of you, on-device, in the moment |
| Location | Find and join nearby trade events, when you ask it to |
| Anonymous price data | Improve pricing accuracy for all users |
| Diagnostics | Fix crashes and bugs |
| Early-access email | Tell you when the app is available, and invite you to the test if you want in. Nothing else. |
| Tester feedback | Fix what you tell us is broken; describe our testing to Google when applying for release |
What we never do
- We do not sell or rent your personal information to anyone.
- We do not show advertising, and we do not share your data with ad networks or data brokers.
- We do not make your collection public. Other users see only the cards you explicitly flag For Sale at a trade event you have joined.
- We do not upload your card photographs for identification.
- We do not ask for, process, or store your payment card details. If and when paid subscriptions launch, billing is handled entirely by Google Play — we receive confirmation that a subscription is active, never your financial information.
Who else is involved
We use a small number of third-party services, each for a specific job:
- Google Firebase — authentication, push notifications and beta build distribution.
- Cloudflare — hosts this website, routes traffic to our server, and provides the cookieless page-view analytics described above.
- eBay — your device queries eBay's public pages for sold-listing prices. Those requests go from your phone to eBay and are subject to eBay's own privacy policy.
- Google Play — app distribution and, in future, subscription billing.
card-exchange is not affiliated with, endorsed by, or sponsored by Nintendo, The Pokémon Company, or eBay.
Where your data lives
Our server is operated in Canada. Firebase and Cloudflare process data across infrastructure that may be located outside your country, including the United States.
How long we keep it
Account and collection data are kept while your account exists. If you ask us to delete your account, we remove your account record and the collection data associated with it. Anonymous, aggregated price data is not linked to you and is retained. Early-access emails are kept until launch, or until you ask us to remove yours — whichever comes first.
Your choices
- Access or delete your data — email [email protected] and we'll action it.
- Revoke a permission — camera and location can be withdrawn at any time in Android Settings. The app keeps working; the features needing them stop.
- Leave the early-access list — reply to any email from us, or write to the address above.
- Use it signed out — scanning, pricing and a local collection work without an account. Nothing syncs, and nothing leaves your device except price lookups.
Children
card-exchange is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy materially, we will update the date at the top of this page and, where the change affects how we use data you've already given us, notify you in the app.