Privacy Policy

1. Information we collect

Information you give us:

• Account details: username, email address, password (stored only as a salted hash), and optionally your state and ZIP code, which power the local features and appear as a general location on your listings.
• Content you post: listings, photographs, descriptions, prices, comments, feedback, wishlists, bulk card lists, shop details, and the messages you exchange with other members. Messages are private between the participants but are stored on our servers and may be reviewed when a report is made or the law requires.
• Support requests, including the email address you give if you write to us without an account.
• Membership purchases: our payment processors (Stripe, and PayPal when offered) collect your card or wallet details directly. MoxSwap never sees or stores full card numbers, expiry dates or security codes; we receive a customer identifier, the plan, amount, status and renewal date. We also keep the card brand, its last four digits, and the anonymous fingerprint the processor generates for it. That fingerprint lets us see when one card has paid for several accounts, which is one of the few reliable signals that a single person is running multiple accounts to leave themselves feedback. It cannot be used to charge the card, and it is reviewed by our staff rather than acted on automatically.

Information collected automatically:

• Log and device data: IP address, browser type, pages requested, timestamps and referring URLs, kept in server logs and used for security and debugging.
• Usage inside the app: views and impressions on listings (counted, not tied to who viewed), notification reads, and when you were last active (shown as 'Last seen' on your profile).
• Device location, only if you press a 'near me' control and your browser asks you to allow it. We use the coordinates for that request and, if you choose, keep them in a cookie for this device. We never infer location from your IP address.
• Cookies: a session cookie that keeps you logged in, a cookie for your chosen location, and the cookies our payment processors set during checkout. We do not use advertising cookies or third-party analytics trackers.

2. How we use information

• To run the Service: accounts, listings, search, messaging, notifications, memberships, card lists and shop pages.
• To keep the community safe: verifying email addresses, detecting fraud, counterfeit sales, scraping and abuse, enforcing our Terms, and responding to reports.
• To communicate: transactional email such as password resets, verification links, receipts, membership reminders and replies to your support requests. We do not send marketing email unless you opt in, and every marketing message will include an unsubscribe link.
• To improve the Service using aggregate statistics that do not identify you.
• To comply with law, respond to lawful requests, and protect the rights and safety of members and MoxSwap.

3. What other members can see

• Your public profile shows your username, avatar, membership badge, state, join date, last-seen time, active listings, feedback received, badges, wishlist and card list. Your email address, ZIP code and password are never shown publicly.
• Your listings show a city and state, derived from the ZIP you enter, so buyers can judge distance. They never show a street address.
• Members you message see your username and avatar and the content of the conversation.
• Shop pages (LGS plan) show the business name, address and details the shop owner chooses to publish.

4. Service providers we share data with

We share personal information only with providers who process it on our behalf under contracts that restrict its use, and only as needed to run the Service:

• Neon (database hosting, United States) stores account data, content and messages.
• Cloudflare (DNS, network security and R2 object storage) delivers the site and stores uploaded images; images are stripped of metadata such as GPS coordinates before storage.
• Vercel (application hosting) runs the app and keeps short-term request logs.
• Stripe and PayPal (payments) process membership fees under their own privacy policies.
• Resend (email delivery) sends transactional email and records delivery status.
• UptimeRobot (availability monitoring) checks that the site is reachable; it receives no personal data.
• A public ZIP-code lookup service (Zippopotam.us) converts a ZIP code you enter, or the one saved on your profile, into the approximate centre point of that ZIP so distance search and the local-shop signal work. It receives the ZIP code alone — never your name, account, address or device location — and each ZIP is looked up once and then cached by us. This lookup can be switched off entirely, in which case distance search falls back to matching on city and state.

We do not sell personal information and we do not share it with advertisers or data brokers. We may disclose information if required by law, subpoena or court order; to enforce our Terms; to protect the rights, property or safety of MoxSwap, our members or the public; or as part of a merger, acquisition or sale of the Service, in which case this Policy continues to apply until you are told otherwise.

5. How long we keep information

• Account data is kept while your account is open. When you close your account we delete or anonymise your profile, listings, wishlists, card lists and messages within 30 days, except as described below.
• We keep membership and payment records, ledger entries, billing events and support tickets for as long as tax, accounting and fraud-prevention rules require, typically seven years.
• Feedback you left for other members stays visible in anonymised form so their reputation is not erased by your departure.
• Server logs are kept for up to 90 days. Backups are kept for up to 35 days before deleted data ages out of them.
• We may keep information longer where needed to resolve disputes, enforce our Terms, or comply with a legal obligation.

6. Your choices and rights

• You can view and update your profile, contact details, ZIP, notification preferences and avatar from your Account page, and delete individual listings, wishlist items and card lists at any time.
• You can close your account from Account, Login and security. You can also email support@moxswap.com to request a copy of the personal information we hold about you, to correct it, or to have it deleted, subject to the retention rules above. We will verify the request came from you and respond within 30 days.
• You can decline device location; the app then uses only the ZIP on your profile, or nothing.
• Residents of California, the European Economic Area, the United Kingdom and other places with privacy laws may have additional rights, including to know what we collect, to object to or restrict processing, to data portability, and to complain to a supervisory authority. We honour these requests for all members regardless of residence, to the extent we are able. We do not sell or 'share' personal information as those terms are defined in California law, and we do not use it for cross-context behavioural advertising.
• Our legal bases for processing, where such a basis is required, are performance of our contract with you (the Terms), our legitimate interests in running a safe marketplace, your consent for device location and any marketing, and compliance with legal obligations.

7. Security

We protect information with encryption in transit (TLS), hashed passwords, single-use expiring links for password resets and verification, access controls on our systems, and logging of administrative actions. No online service is perfectly secure; if we learn of a breach affecting your information we will notify you and any regulator as the law requires.

8. Children

MoxSwap is for adults. We do not knowingly collect information from anyone under 18, and we close accounts we learn belong to minors. If you believe a child has given us information, contact support@moxswap.com.

9. International use

MoxSwap is operated from the United States and our providers store data there. If you use the Service from elsewhere, your information is transferred to and processed in the United States, where privacy laws may differ from those of your country.

10. Changes and contact

We may update this Policy. We will post the new version here with a new date and, for material changes, notify you by email or in the Service before it takes effect. Questions or requests: support@moxswap.com.