Privacy Policy

1. Introduction

Trade Routes ("we," "us," or "our") respects the privacy of our users ("you" or "your"). This Privacy Policy describes how we collect, use, and protect your information when you use our services via our website and connected platforms, including login via Google and Facebook.

2. Information We Collect

• Personal Data via OAuth Login: Google or Facebook User ID, Name, Email, and Profile Picture (if permission is granted).
• Profile Data: Game preferences, profile picture, user bio, username, and optional WhatsApp number (used solely for trade verification codes).
• User Activity: Posts, messages, feedback, card listings, tags, prices, and trading actions.
• Technical Data: IP address, browser metadata, session cookies.
• Usage Data: Pages and app screens you view, how far you scroll, how fast pages load, links and buttons you click, searches, how you arrived (referring site or campaign link), and device type. This is collected by our own analytics, stored on our servers, and never shared with third parties. Visitors in the EU and UK are asked before it is collected. Detailed usage events are deleted after a set retention period; only daily totals are kept after that. Deleting your account deletes your usage data.

3. How We Use Your Information

We use your information to:

• Authenticate and manage user accounts
• Facilitate trading, listing, and messaging features
• Respond to support requests and feedback
• Improve site performance and personalize user experience
• Protect the platform from misuse and abuse
• Review messages when needed to investigate reports, prevent fraud, and enforce our Terms of Service. Only staff can do this, and every time staff open a conversation it is logged

4. Data Storage and Security

All user data is securely stored in a PostgreSQL database hosted on Amazon RDS. Images such as profile pictures and listing photos may be stored on Amazon S3. We use secure HTTPS connections and limit access to protected resources to ensure your information remains safe.

5. Data Sharing

We use the following trusted third-party services to operate the platform:

• Google & Facebook (OAuth): Used for account login. Their privacy policies apply to the authentication flow.
• Stream Chat: Powers our in-app messaging. Messages are transmitted through Stream's infrastructure. See Stream's Privacy Policy.
• Amazon Web Services (AWS): Hosts our database (RDS) and uploaded images (S3).
• Scryfall: Used for card data lookups. No user data is shared with Scryfall.

We do not sell your personal information to any third parties.

6. Cookies

We use cookies to maintain session state, support user login, and enhance your experience. Our analytics keeps a random visitor ID in your browser's local storage (or the app's secure storage) so visits from the same device can be grouped. You may disable cookies in your browser settings, though some functionality may be impacted.

7. Children’s Privacy

Trade Routes is not specifically intended for minors under the age of 13. We do not knowingly collect data from children. If you believe a child has submitted personal information, please contact us for deletion.

8. Data Deletion

You may request deletion of your account and personal data by emailing us at kyle@traderoutes.cards. We will process deletion requests within 30 days. Note that some data (such as transaction records) may be retained as required by applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Major updates will be communicated to users via email or in-app notification.

10. Contact Us

For questions or concerns, contact us at: kyle@traderoutes.cards