🧸 Privacy Policy

Effective date: July 3, 2026 · Contact: [email protected]

Swappatoy is a community platform for swapping and sharing toys between neighbors. We collect as little personal information as we can, and we never sell it. This page explains what we collect, why, and the choices you have.

1. Information we collect

Account details: your email address and a password (managed by Google Firebase Authentication — we never see or store your password itself).
Profile details you choose to add: a display name, a neighborhood/area, and optional contact information (phone or email) used to coordinate swaps.
Listings and events: toy titles, descriptions, photos, and swap-meet event details you publish.
Toy Token activity: your token balance and a log of token transactions (earned, spent, purchased) so balances can be audited and disputes resolved.
Payments: if you buy Toy Tokens, payment is processed by Stripe. Your card details go directly to Stripe and never touch Swappatoy's servers. We only receive confirmation that a payment succeeded.

2. Photos and location metadata

Photos you attach to a listing are re-encoded before they are stored. This process removes all embedded metadata — including GPS coordinates, device information, and timestamps (EXIF data) — so a photo taken at home cannot reveal your address. Only the re-encoded copy is ever stored or shown to other users.

3. Who can see what

Public: toy listings (title, description, photo, display name, neighborhood, token value) and swap-meet events (title, place, date, organizer display name).

Never public: your email address, your contact information, and your token balance. Contact info is shared only with the specific neighbor you agree to swap with, and only after the request is accepted. Event organizer contact details are visible to signed-in members only.

4. Children's privacy (COPPA)

Swappatoy accounts are for adults (18+): parents, guardians, and caregivers. The service is not directed at children under 13, and we do not knowingly collect personal information from children. Please do not include children's names, faces, or other identifying details in listing photos or descriptions. If you believe a child has provided us personal information, contact us and we will delete it.

5. How your data is stored and secured

Data is stored in Google Firebase (Firestore) data centers, protected by security rules that restrict each account to its own private data.
All traffic is encrypted in transit (HTTPS).
Token balances can only be changed by our server-side code — never directly by a browser.

6. Retention and deletion

We keep your account data for as long as your account is active. You may delete your listings at any time. To delete your account and associated personal data, email [email protected] — we will remove it within 30 days, except for token-transaction records we must keep for fraud prevention and accounting.

7. Your rights (GDPR and similar laws)

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

8. Cookies and local storage

We use browser local storage only for your interface preferences (language, accessibility options) and Firebase Authentication uses browser storage to keep you signed in. We do not use advertising trackers. Some listing pages contain affiliate links to Amazon or eBay (for batteries or replacement parts); those sites have their own privacy policies once you click through.

9. Changes to this policy

If we make material changes, we will update the effective date above and announce it on the site before the change takes effect.