Privacy Policy

Last updated 2026-10-27

DRAFT: have counsel review this before launch. It is written to meet Canada’s PIPEDA principles. Confirm the providers named below match what is actually in use.

Who is responsible

[OPERATOR LEGAL NAME], operating as Swapd (“we”, “us”) operates Swapd and is responsible for the personal information described here. Our privacy contact is hananqazi21@gmail.com.

What we collect

• Account: name, email, password (stored only as a salted hash), city, optional bio.
• Content you post: listings, photos, garage vehicles, messages, community posts and comments. Anything you put in these can contain personal information, so share only what you are comfortable making public.
• Technical: IP address and request logs, used for security, abuse prevention and rate limiting.
• Reports and moderation: reports you file or that are filed about you, and the actions we take.

We do not run advertising trackers or sell personal information. Location is the city you choose; we do not collect GPS location, and we remove location metadata (EXIF) from uploaded photos. We do not collect payment card details because we do not take payments.

Why we collect it, and consent

We collect, use and share your information only for the purposes listed below. By creating an account and using the Service you consent to this. You can withdraw consent by deleting your account, but we then cannot provide the Service to you. We ask for your consent again if we want to use your information for a new purpose.

How we use it

To operate Swapd: show your listings, let buyers and sellers message each other, send account emails (verification, password reset, message notifications), prevent fraud and abuse, enforce our Terms, respond to reports and legal requests, and comply with law.

Cookies

We use a strictly necessary session cookie to keep you signed in and a preference cookie to remember your city. We do not use analytics or advertising cookies. (If this changes we will ask first.)

Who sees it

Listings, photos, seller names, cities and community posts are public, including to search engines and people without an account. Anything public can be copied and may remain elsewhere even after you delete it. Messages are visible only to the two participants (and to moderators if a message is reported). Your email is never shown publicly.

Other users decide what to do with what you share with them. We are not responsible for how other users use your information.

Service providers and transfers outside Canada

We use providers to run the Service: server hosting and database (DigitalOcean, Toronto), image storage and DNS (Cloudflare), and email delivery (Resend). They process data only to provide those services to us. Some of them, or their backups and support staff, may handle data outside Canada (for example in the United States), where it is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities.

Disclosure to others

We disclose personal information only when you ask us to, when it is needed to run the Service as above, or when the law allows or requires it, for example to respond to a valid warrant, court order or lawful police request, to report suspected crime or fraud, to protect someone’s safety, or in a sale or reorganization of the business (the buyer must use it only as described here).

Retention

We keep your data while your account is open. When you delete your account, your profile, listings, messages and posts are permanently deleted from our database; backups are overwritten on our normal backup schedule [confirm the exact number of days once backups are set up]. We may keep limited records where needed for security, fraud prevention, dispute handling or legal reasons, and for as long as the law requires.

Your rights

You can view and edit your information and delete your account in Account settings. You may also email hananqazi21@gmail.com to ask for a copy of your personal information, to challenge its accuracy or completeness, or to withdraw consent. We will respond within 30 days, as required by law. We may need to verify your identity first, and may decline requests the law allows us to decline (for example information about other people). If you are unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Security

Passwords are hashed, sessions use signed httpOnly cookies, and traffic is encrypted in transit. No system is perfectly secure, and we cannot guarantee the security of information sent to or stored with us. Use a strong, unique password. We keep a record of every breach of security safeguards, and we will notify affected users and the Privacy Commissioner as required if a breach poses a real risk of significant harm.

Children

Swapd is for people 18 and older. We do not knowingly collect information from anyone younger, and will delete it if we learn we have.

Changes and contact

We will post updates here with a new date and notify you of material changes. Privacy questions or complaints: hananqazi21@gmail.com.