CardLocal Privacy Policy

Last Updated: [DATE — NEEDS CONFIRMATION, set when this is actually published]

CardLocal is a local collectible-card discovery and trading platform provided by TCG Trading Lab Technologies Inc. — NEEDS CONFIRMATION (confirm this is the correct registered legal entity) ("CardLocal," "we," "us," or "our"). This Privacy Policy explains how we collect, use, store, and protect your information when you use the CardLocal app (the "Service").

Information We Collect

Account Information

Your email address, an account identifier created when you sign in with Apple or Google, and your username.

Profile Information

Your display name, avatar, region label, and any bio or collector-focus details you choose to add to your profile.

User Content

Content you create while using the Service, including your card and sealed-product collection, listings, offers, messages sent to other users, reviews and ratings you give or receive, and reports you submit about another user or their content.

Location Information

CardLocal uses location information to power nearby-collector discovery and to help you arrange in-person meetups. We handle this in two distinct ways, described fully in Location Information below. In short: CardLocal does not require users to publicly disclose their precise real-time location. Location information shown to other users is approximate.

Usage Data

Information about how you use the Service, such as searches, taps, and feature usage.

Device / Technical Data

Device type, operating system version, and information generated when the app encounters an error or crash.

Support Communications

Information you provide when you contact us for support, such as your username, device type, app version, and a description of your issue.

How We Use Your Information

We use the information described above to:

• Create and maintain your account
• Provide search, collection, trading, offer, and meetup-scheduling features
• Show you relevant nearby content
• Operate reporting, blocking, and other safety features, and investigate reports of abuse, fraud, or violations of our Terms of Service
• Improve the Service's performance and user experience
• Investigate bugs and crashes
• Respond to support requests
• Comply with legal obligations

Third-Party Services

CardLocal uses the following third-party service providers to operate the Service:

• Apple Sign In and Google Sign-In — for account authentication.
• Supabase — our database, file storage, and authentication infrastructure. User content, profile data, and account credentials are stored with Supabase.
• Google Maps / Places API — used for address search and autocomplete when setting a location. Receives search text you type and an approximate area used to bias search results.
• OpenStreetMap / Nominatim — used to resolve coordinates into a place name (e.g. a neighbourhood or city) when you set or search a location.
• Hosting provider (Render) — NEEDS CONFIRMATION whether this needs its own disclosure line depending on final legal review

CardLocal does not currently use any analytics or crash-reporting third-party SDK, and does not currently use any payment processor — this Policy will be updated if that changes.

We Do Not Sell Your Information

CardLocal does not sell users' personal information to advertisers or data brokers.

Location Information

CardLocal's core use of location is nearby discovery: finding other collectors and listings near a general area, called your Trading Region.

• When you set your Trading Region (including via "Use Current Location"), the app may request your device's precise location permission and may briefly access a precise GPS position to help identify the area you're in.
• Before saving or displaying a Trading Region, CardLocal applies a random offset to that position. Only this approximate, offset position is ever stored on our servers or shown to other users — your precise, real-time location is never saved by CardLocal and never shown to other users.
• To resolve a position into a readable place name, CardLocal sends the coordinates involved to OpenStreetMap's Nominatim service (and, for address search, to Google's Places API). This is necessary to show a human-readable area name and is separate from what gets stored or displayed to other users.

Separately, CardLocal offers a meetup location feature for arranging an in-person trade. Because picking a specific meeting spot (e.g. a shop or mall) requires more precision than nearby discovery, this feature may use a more precise position when you search for or select a meetup location. A meetup location is only shared with the other party to that specific trade, and only once you choose to propose it.

Data Retention and Account Deletion

We retain personal information for as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce platform safety.

You can delete your account at any time from within the CardLocal app (Profile → Account Settings → Delete Account). Deleting your account permanently removes your profile, collection, listings, offers, and reviews — including trade history and reviews visible to the other party to a trade — except where retaining information is required by law, for safety and fraud-prevention purposes, or to resolve an active dispute. This action cannot be undone.

Security

We use reasonable technical and organizational measures to protect your information. No internet service can guarantee absolute security.

Children's Privacy

CardLocal is not intended for children under the minimum age permitted to independently use the Service in their jurisdiction. [Specific minimum age — NEEDS CONFIRMATION, to be finalized alongside the App Store age rating and Terms of Service]

Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last Updated" date above.

Contact

TCG Trading Lab Technologies Inc. — NEEDS CONFIRMATION
Email: support@[domain] — NEEDS CONFIRMATION