Privacy Policy

Last updated: 25 July 2026

1. Data we process

Depending on your use, we may process:

• email address, authentication and account identifiers;
• profile information you choose to provide;
• collection inventory, missing items, duplicates and statistics;
• trade offers, counteroffers, status and ratings;
• messages sent through the service;
• delivery or handover details for a specific trade;
• reports, blocked users and safety records;
• uploaded images where a feature allows them;
• device and notification identifiers, including FCM tokens;
• technical and security data required to operate the service.

2. Purposes

We use data to create and secure accounts, provide collection, messaging and trade features, send requested notifications, prevent abuse, investigate reports, answer support requests, maintain the service and comply with legal obligations.

3. Legal bases

Processing may rely on performance of the service contract, consent where required, legal obligations, and legitimate interests such as security, fraud prevention and support.

4. Visibility and sharing

Public profile and collection information is visible according to service settings. Messages and private handover details are intended only for the relevant trade participants and authorised administrators where access is needed for support, safety or legal compliance.

We do not sell personal data. SwapStash currently relies on Google Firebase, including Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging and Hosting.

5. International processing

Service providers may process data outside Slovenia or the EEA. Where required, appropriate safeguards are used.

6. Retention

Data is generally retained while an account is active and as needed to provide the service. After deletion, limited data may remain where reasonably necessary for security, dispute handling, legal obligations or protection against abuse.

7. Children and teenagers

SwapStash is not intended for children under 13. Users who cannot consent under applicable local law need permission from a parent or legal guardian.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection or portability. You may withdraw consent where applicable and complain to the competent data-protection authority.

9. Account deletion

See the account deletion page.

10. Website cookies

This public website does not use advertising cookies or third-party analytics. Firebase Hosting may process basic technical request data needed to deliver and protect the website.

11. Changes

We may update this policy as the service or legal requirements change. The current version and date will remain on this page.

12. Contact