Privacy Policy

Personal Information You Disclose To Us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include:

• Names
• Email addresses
• Usernames
• Passwords (stored as encrypted hashes — we never store plaintext passwords)
• Profile photos
• Mailing/shipping addresses (when you initiate a trade requiring shipment)
• Contact preferences

Sensitive Information. We do not process sensitive information.

Application Data

If you use our application, we also collect the following information if you choose to provide us with access or permission:

• Geolocation Information. We request access to track location-based information from your mobile device to show you nearby listings and enable the map feature. If you wish to change our access or permissions, you may do so in your device's settings.
• Camera and Photo Library Access. We request access to your device's camera and photo storage so you can photograph and upload items for listing. If you wish to change our access or permissions, you may do so in your device's settings.
• Mobile Device Data. We automatically collect device information such as your mobile device ID, model, manufacturer, operating system, version information, browser type, and IP address.
• Push Notifications. We request to send you push notifications regarding trade activity, new messages, and account updates. If you wish to opt out, you may turn off notifications in your device's settings.

This information is primarily needed to maintain the security and operation of our application, for troubleshooting, and for our internal analytics and reporting purposes.

Information Automatically Collected

In Short: Some information — such as your IP address and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information. The information we collect includes:

• Log and Usage Data: Service-related, diagnostic, usage, and performance information our servers automatically collect, including IP address, device information, browser type, and activity in the Services.
• Device Data: Information about your phone, tablet, or other device, including IP address, device identification numbers, location, browser type, hardware model, and operating system.
• Location Data: We collect location data from your device to enable the map feature showing nearby listings. You can opt out by disabling Location in your device settings.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for the following purposes:

• To facilitate account creation and authentication — so you can create and log in to your account.
• To deliver our services — including listing creation, AI item identification, trade matching, trade lifecycle management, and in-app chat.
• To enable user-to-user communications — facilitating chat between trading partners.
• To send push notifications — notifying you of trade proposals, messages, trade status changes, and account activity.
• To process and manage trades — managing the full trade lifecycle from proposal through completion.
• To respond to user inquiries and offer support.
• To send administrative information — details about changes to our terms, policies, and services.
• To send marketing and promotional communications — if you have opted in to receive marketing. You may opt out at any time.
• To protect our Services — including fraud monitoring and prevention.
• To identify usage trends — to understand how our Services are being used so we can improve them.
• To comply with legal obligations.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK: We rely on the following legal bases under GDPR and UK GDPR:

• Consent — Where you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time by contacting us.
• Performance of a Contract — Where processing is necessary to fulfill our contractual obligations to you, including providing the Services.
• Legitimate Interests — Where processing is reasonably necessary to achieve our legitimate business interests, such as improving our Services, preventing fraud, and communicating with users.
• Legal Obligations — Where processing is necessary for compliance with applicable law.
• Vital Interests — Where processing is necessary to protect your vital interests or those of a third party.

If you are located in Canada: We may process your information with your express or implied consent. You can withdraw consent at any time. In exceptional cases, we may process information without consent as permitted by applicable law.

In Short: We may share information in specific situations described in this section.

We may share your personal information in the following situations:

• Service Providers. We may share your information with third-party service providers that perform services on our behalf, including cloud infrastructure (Railway, Cloudflare), AI services (Google Cloud AI via OpenRouter), and email delivery (Resend). These providers are contractually obligated to use your data only to provide services to us.
• Other Users. When you create a listing or engage in a trade, certain information (your username, profile photo, item photos, and listing details) is visible to other users of the Services. Chat messages are visible to your trading partner.
• Business Transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
• Legal Requirements. We may disclose your information where required by law or in response to valid legal requests from public authorities.
• Google Maps Platform. We use Google Maps APIs to enable location-based features. Our use of Google Maps APIs is subject to Google's Privacy Policy.

We do not sell your personal information to third parties. We do not share your personal information with advertisers.

In Short: We may use cookies and similar tracking technologies to collect and store information.

As a mobile application, Paxchange does not primarily rely on cookies. However, our backend infrastructure and any web-facing components of our Services may use cookies and similar tracking technologies (such as web beacons and pixels) to maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also use Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics, visit the Google Analytics opt-out page.

In Short: We offer products, features, and tools powered by artificial intelligence and machine learning technologies.

As part of our Services, we offer AI-powered features including:

• AI Item Identification — When you photograph an item, our AI analyzes the image to identify the item and suggest relevant details.
• AI Valuation — Our AI estimates fair market value for listed items using market data.
• AI Trade Insights — Our AI provides analysis and insights to help you evaluate proposed trades.
• Match Engine — Our AI matches users with compatible trade partners based on listing attributes and preferences.

We provide these AI features through third-party AI service providers, including Google Cloud AI (via OpenRouter). Your input data (such as item photos) and outputs may be processed by these providers to deliver the AI features. We do not use your personal data to train third-party AI models beyond what is required to deliver the service.

All personal information processed using our AI features is handled in accordance with this Privacy Notice.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. We will not keep your personal information longer than the period during which you maintain an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it. If deletion is not immediately possible (e.g., data stored in backup archives), we will securely store your personal information and isolate it from further processing until deletion is possible.

Upon account deletion, we will delete your personal information from our active databases within 30 days, subject to retention obligations required by applicable law.

In Short: We aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. These include:

• Passwords stored as bcrypt hashes — we never store plaintext passwords
• JWT-based authentication with token refresh mechanisms
• HTTPS encryption for all data in transit
• Secure cloud infrastructure with access controls
• Images stored in Cloudflare R2 with access-controlled URLs

However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

In Short: Depending on your location, you may have rights that allow you greater access to and control over your personal information.

In some regions (such as the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws, including the right to:

• Request access to and obtain a copy of your personal information
• Request rectification or erasure of your personal information
• Restrict the processing of your personal information
• Data portability (where applicable)
• Object to the processing of your personal information
• Not be subject to automated decision-making

You can make such requests by contacting us at support@paxchange.app.

Account Deletion

You can delete your account at any time directly within the app by navigating to Profile → Settings → Delete Account. You may also request deletion by contacting us at support@paxchange.app.

Withdrawing Consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us. This will not affect the lawfulness of processing that occurred before withdrawal.

Opting Out of Marketing

You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in any marketing email or by contacting us.

Push Notifications

You can opt out of push notifications at any time by disabling notifications for Paxchange in your device's settings.

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is no industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

In Short: If you are a resident of California, Colorado, Connecticut, or other US states with applicable privacy laws, you may have specific rights regarding your personal information.

Categories of Personal Information We Collect

Your Rights

You have rights under certain US state data protection laws, including:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data for targeted advertising, sale of personal data, or profiling

How to Exercise Your Rights

To exercise these rights, email us at support@paxchange.app or delete your account directly in the app at Profile → Settings → Delete Account.

Will Your Information Be Shared With Anyone Else?

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to users and other consumers.

In Short: You may have additional rights based on the country you reside in.

Australia

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint to the Office of the Australian Information Commissioner.

South Korea

If you are located in South Korea, we process your personal information in accordance with the Personal Information Protection Act (PIPA). You have the right to access, correct, delete, and withdraw consent for processing of your personal information. To exercise these rights, contact us at support@paxchange.app.

European Economic Area (EEA) and United Kingdom

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK data protection authority.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice periodically to be informed of how we are protecting your information.

If you have questions or comments about this notice, you may contact us at:

Paxchange
Email: support@paxchange.app
United States

Note: A full mailing address will be added upon company incorporation. In the meantime, all inquiries can be directed to the email above.

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.

To exercise these rights:

• In-app deletion: Go to Profile → Settings → Delete Account to immediately delete your account and data.
• Email request: Contact us at support@paxchange.app with your request. We will respond within 30 days.