Privacy Policy
Last updated: 30 October 2026. What changed: we now explain how we see which links bring people to GotSwap and the few actions we count in the app, what we keep for push notifications, and that a scanned card's photo goes to our card data provider.
1. What this covers
This explains what personal data GotSwap collects, why, and what rights you have over it. The company responsible for it (the data controller) is GOTSWAP LTD, trading as GotSwap, a company registered in England and Wales (company number 17541526), registered office: 15 Gertrude Street, Abercynon, CF45 4RL. You can reach us at hello@gotswap.co.uk.
2. What we collect
Your name, email address and date of birth (used only to check you're 16 or older); your password, handled entirely by our authentication provider: we never see or store it in plain text; an optional profile picture; your circle membership(s); and the collection, want-list and trade data you enter into the app. If you turn on "show when you're online", a rough last-active time is stored while that's on. We also note how you reached GotSwap (for example the link you followed), the kind of device you use and whether you installed the app, and a few actions in the app, such as opening it, sending an offer or starting a Pro trial. If you turn on push notifications, we keep the address your device gives us so we can send them. If you tick the box to receive marketing emails, we also keep that choice, when you made it and the exact words you agreed to.
3. Why we collect it
To create and secure your account, confirm you meet the age requirement, run the matching/trading features circles use GotSwap for, and let your circle see the things you've chosen to make visible (your profile, spares, favourites). We use the notes about how you arrived and what you do in the app to see which links bring people to GotSwap, find what is not working and improve it. Only the GotSwap team can see them. If you choose to receive marketing emails, we use your email address and first name to send you GotSwap news, tips and offers. We only do this if you say yes, and you can change your mind at any time in Preferences or with the unsubscribe link in any marketing email. We also send emails that are part of the service, such as confirming your account and, if you have not added any cards yet, one or two reminders to help you get started. Those are not marketing.
4. Who your data is visible to
Your collection, wants and trade activity are visible to your circle in whichever circle(s) you join: that visibility is how matching works. They're never visible to members of a different circle you haven't joined, and your date of birth, email and password are never shown to other members at all.
5. Who else processes it
We use Supabase for our database, authentication and file storage, and Vercel to host the app itself: both process data on our behalf to run the service. Card names, images and pricing come from public trading card data providers; we don't send them any of your personal data, apart from the photo of a card when you scan it, which goes to our card data provider (Scrydex) only to identify the card. If you buy Pro, Stripe (our payment provider) processes your payment, taking your name, email, billing address and card details directly: GotSwap never sees or stores your card details. We receive only the status of your subscription (active, cancelled, renewal date) and Stripe's reference numbers for your payment, so we can switch Pro on and off. Stripe handles that data under its own privacy notice. We use Vercel Web Analytics to count visits and see which pages and links people arrive from; it does not use cookies and does not identify you personally. We use Sentry to receive error reports when something breaks, which can include technical details such as your browser and device type and the page you were on. If you agree to marketing emails, we use Sender (sender.net), an email service, to send them: we pass it your email address and first name, only for people who have agreed, and it handles them on our behalf to send the emails.
6. How long we keep it
We keep your data while your account is active. You can delete your account yourself at any time from Preferences (Delete my account), which permanently erases your collection, trades, posts, photos, messages and sign-in. You can also email us (below) and we'll do it for you. The only things we may keep are records we're required to hold for legal or accounting reasons: for example, our payment provider Stripe and our accounts keep payment records of any Pro purchase under tax law.
7. Your rights
Under UK GDPR you can ask to see the personal data we hold about you, have inaccurate data corrected, have your data deleted, or ask for a copy in a portable format. Contact us using the details below to exercise any of these. You can also withdraw your consent to marketing emails at any time, in Preferences or with the unsubscribe link.
8. Age requirement
GotSwap is restricted to people aged 16 and over, and we don't knowingly collect data from anyone younger. If an adult brings a younger family member in, it's on the adult's own account and their responsibility to supervise, per our Terms & Conditions.
9. Security
Data access is restricted per-circle and per-member at the database level (row-level security), passwords are handled entirely by our authentication provider rather than stored by us, and uploaded photos are only writable by the account that uploaded them.
10. Cookies and local storage
We use your browser's local storage to keep you signed in and remember a few things on your device: display preferences, the link you arrived from, and your last collection numbers so they show quickly. Our analytics does not use cookies, and we don't use third-party advertising or tracking cookies.
11. Changes
We may update this policy as the app changes. Material changes will be reflected here with an updated date.
12. Contact
Questions about this policy, or a request about your data: hello@gotswap.co.uk