iCat Studios
iCat Studios

SwapMap: Cards, Stickers, TCG

Privacy Policy

Your privacy matters to us

Back to all policies

This document is provided in multiple languages for your convenience. In case of any conflict or difference between language versions, the English text shall prevail.

Last updated: November 20, 2026

Application: SwapMap: Cards, Stickers, TCG

Developer: iCat Studios

At iCat Studios ("we", "us", "our"), we respect the privacy of users ("you", "your") of the SwapMap mobile application ("the App"). This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and your rights when using our App.

By using the App, you agree to this Privacy Policy.

1. Data We Collect

1.1 Account Information

When you use Sign in with Apple or Sign in with Google, we receive the following information from Apple or Google:

  • Email address (Apple provides a relay email if you select "Hide My Email")
  • First name and last name (Apple provides this only on first sign-in; Google provides it on every sign-in)
  • Provider User ID — a unique identifier used to recognize your account

1.2 Profile Information

Information you provide directly in the App:

  • Display name (visible to other users in listings, messages, and ratings)
  • Bio (optional, visible to other users)
  • Avatar (optional)
  • Region label (e.g. "Istanbul, Kadıköy") — a coarse, human-readable location label you set during onboarding
  • Approximate coordinates of your region — see section 1.4 for details on the privacy offset we apply
  • Country and preferred language
  • Pro subscription status — whether you have an active Pro membership and its expiration date

1.3 Collection and Listing Data

Data you generate while using the App:

  • Your collection inventory (which stickers/cards you own and how many duplicates, which ones you want)
  • Listings you publish (Sale, Swap, or Wanted), including title, description, asking price, currency, condition, and items included
  • Offers you make or receive, including their full history (rounds, requested items, offered items, cash amounts)
  • Conversations and messages exchanged with other users
  • Ratings and comments you give or receive
  • Reports you submit about other users, messages, or listings

1.4 Location Data

The App is location-based. We process location data as follows:

  • When you grant the location permission, we read your device coordinates once to suggest your region during onboarding and to center the map around you. We do not track your location in the background.
  • A reverse-geocode (city, district) is performed to suggest a human-readable region label.
  • Before storing your listing or profile coordinates on our servers, we apply a ~500 meter random offset so that your exact location is never published. The map pin shown to other users is the offset coordinate, never your real one.
  • You can deny or revoke the location permission at any time from your device settings. The App will continue to work; the map will simply use a default location until you provide one.

1.5 Camera and Sticker Scanner

The App includes an optional sticker scanner that uses your device camera to read sticker codes (such as "MEX5", "FWC1", or numeric codes for Adrenalyn-style collections):

  • Camera access is requested only when you open the scanner.
  • Image processing happens entirely on your device using on-device text recognition (Apple Vision on iOS, Google ML Kit on Android). No camera images are uploaded to our servers or to any third party.
  • Only the recognized text code (e.g. "MEX5") is sent to our server when you confirm and add the card to your collection.
  • You can deny or revoke camera access at any time from your device settings; the App's other features continue to function.

1.6 Device and App Information

  • Device ID (for anonymous session management)
  • Operating system (iOS/Android version)
  • App version and platform (version code, version name, and whether you are on iOS or Android) — used to provide version-specific support and identify compatibility issues
  • Push notification token — a unique token issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) so we can deliver new-message notifications, offer notifications, and important announcements. You can disable push notifications at any time from your device settings.

1.7 Advertising Identifier

The App may collect your Advertising Identifier (IDFA on iOS, GAID/Advertising ID on Android) only with your explicit consent:

  • On iOS, you will see an App Tracking Transparency (ATT) prompt the first time you launch the App. If you choose "Ask App Not to Track," the IDFA is not collected and our advertising partners receive only privacy-preserving information via Apple's SKAdNetwork.
  • On Android, the GAID is collected unless you opt out via Settings → Google → Ads → Delete advertising ID.
  • When collected, the Advertising Identifier is shared with our advertising partners listed in section 3.4 for ad attribution and frequency capping.

1.8 Automatically Collected Data

  • IP address — used for security purposes, including rate limiting on authentication endpoints and abuse prevention. We do not use IP addresses to build advertising profiles.
  • Error and crash reports — used to monitor app stability. Reports are filtered to exclude personally identifiable information.

2. How We Use Your Data

We use the collected data for the following purposes:

  • Account creation and management: To let you sign in and use the App
  • Marketplace operation: To publish your listings, match you with nearby collectors, and let you exchange offers and messages
  • Map and discovery: To display listings around you and let you search by region, collection, or card
  • Trust and safety: To process ratings, reports, and blocks, and to suspend accounts that violate our Terms of Use
  • Pro subscription management: To verify your subscription status and grant access to Pro features
  • Communication: To send important updates, offer and message notifications, and announcements about the App
  • Account security: To prevent fraudulent accounts and rate-limit suspicious activity
  • Advertising: To display advertisements within the App and measure their performance — see section 8 for details
  • Analytics and improvement: To analyze usage statistics anonymously and improve the App

3. Who We Share Your Data With

SwapMap does not sell or rent your personal data to third parties. We share data only with the trusted service providers and advertising partners listed below, and only to the extent necessary to operate the App.

3.1 Service Providers

  • Amazon Web Services (AWS) — Server and database hosting (Frankfurt, Germany)
  • Apple — Apple Sign-In authentication, Apple Push Notification service (APNs)
  • Google — Google Sign-In authentication, Firebase Cloud Messaging (push notifications on Android), Google Maps SDK (map rendering)
  • Apple StoreKit / RevenueCat — Processes Pro subscription purchases and renewals on iOS
  • Google Play Billing / RevenueCat — Processes Pro subscription purchases and renewals on Android
  • Sentry — Backend error and exception monitoring. Personally identifiable information filtering is enabled (no email, name, listing content, or message content is sent to Sentry).

These service providers only process data on our behalf and under our instructions.

3.2 Legal Requirements

Your data may be shared with authorities in response to a court order, legal investigation, or legal obligation.

3.3 Information Visible to Other Users

The following information is visible to other users:

  • Your display name, avatar, bio
  • Your region label (e.g. "Istanbul, Kadıköy") and the offset map pin (never your exact coordinates)
  • Your listings (title, description, items, price, condition)
  • Your ratings, trust score, and rating count
  • Messages and offers you send to a specific user are visible to that user
  • A Pro membership badge if you have an active subscription

The following information is never shown to other users:

  • Your email address
  • Your real first and last name
  • Your exact (un-offset) coordinates
  • Your device information
  • Your advertising identifier
  • Your subscription expiration date
  • The contents of your collection inventory (only the items you choose to put in a listing or offer are revealed)

3.4 Advertising Partners

The App displays advertisements through several advertising networks (sometimes called mediation). When you have consented to tracking, your Advertising Identifier and limited technical data may be shared with the partners below for ad delivery, attribution, and frequency capping. Each partner has its own privacy policy:

4. Where and How Long We Store Your Data

4.1 Data Storage Location

All user data is stored in Amazon Web Services (AWS) Frankfurt (eu-central-1) data centers. We use Amazon RDS PostgreSQL as our database service.

4.2 Retention Period

  • Active accounts: Your data is retained as long as your account remains active
  • Inactive accounts: Accounts that have not signed in for 2 years are automatically deleted
  • Deleted accounts: When you delete your account, your personal data is permanently deleted within 30 days (including backups). Messages you sent to other users may be retained in those users' conversation history in an anonymized form to preserve the integrity of their records.
  • Anonymous statistics: Anonymous aggregate statistics may be retained after deletion (contains no personal information)

5. Your Rights

Under GDPR (Europe) and KVKK (Turkey), you have the following rights:

  • Right of access: Learn what data we process about you
  • Right to rectification: Request correction of inaccurate or incomplete data
  • Right to erasure ("right to be forgotten"): Request deletion of your data
  • Right to restriction of processing: Limit how your data is processed
  • Right to data portability: Receive your data in a machine-readable format
  • Right to object: Object to data processing
  • Right to withdraw consent (advertising tracking): You may revoke ATT permission on iOS via Settings → Privacy & Security → Tracking, or reset/delete your advertising ID on Android at any time

How to Delete Your Account

You can delete your account in three ways:

6. Children's Privacy

SwapMap is not intended for users under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will delete that data as soon as possible.

For users between 13 and 18, we recommend reviewing this Privacy Policy together with a parent or guardian. Marketplace transactions between users — even in-person sticker swaps — should be supervised by a parent or guardian.

Parents or guardians who believe their child is using the App can contact us.

7. Data Security

We take industry-standard security measures to protect your data:

  • HTTPS encryption: All network traffic is encrypted using SSL/TLS
  • Passwordless authentication: We do not store passwords; all sign-ins are handled via Apple and Google
  • JWT-based session management: Sessions are managed with secure, temporary tokens
  • Rate limiting: Authentication and sensitive endpoints are rate-limited per IP to prevent brute-force and abuse
  • Access control: Database access is limited to authorized system accounts only
  • Location privacy offset: Listing and profile coordinates are stored with a ~500m random offset
  • On-device camera processing: Sticker scanner OCR runs on your device; no images leave your phone
  • Regular security updates: Our systems are kept up to date

However, please note that no method of transmission over the internet is 100% secure.

8. Advertising and Tracking

8.1 Advertising in the App

SwapMap is supported in part by advertising. The App displays ads through Google AdMob and additional networks via mediation (AppLovin, Liftoff/Vungle, Unity Ads, Meta Audience Network, InMobi). See section 3.4 for the full partner list.

Ads may include banner and interstitial formats. Pro members enjoy an ad-free experience.

8.2 App Tracking Transparency (iOS)

On iOS 14.5 and later, Apple requires us to ask for your permission before tracking you across apps and websites. The first time you launch the App you will see an App Tracking Transparency prompt:

  • If you select "Allow", your IDFA may be shared with our advertising partners for personalized ads, attribution, and frequency capping.
  • If you select "Ask App Not to Track", your IDFA is not collected. We use Apple's privacy-preserving SKAdNetwork framework for attribution, and ads you see will be non-personalized.

You can change your decision at any time in Settings → Privacy & Security → Tracking.

8.3 Android Advertising ID

On Android, your Google Advertising ID (GAID) may be used by our advertising partners. You can reset or delete your advertising ID at any time via Settings → Google → Ads. When deleted, ads will be non-personalized.

8.4 Cookies

The SwapMap mobile application does not use browser cookies. Tracking on mobile is governed by the platform-level mechanisms described above, not cookies.

9. International Data Transfers

Your data may be processed outside of your home country (AWS Frankfurt — European Union, and the data centers of our advertising partners listed in section 3.4, which may be located outside the EU). These transfers comply with the security standards required by GDPR and KVKK.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes take effect once published on this page, and the "Last updated" date at the top will be refreshed. Significant changes will be announced via in-app notification.

11. Third-Party Content and Trademarks

SwapMap is a community marketplace for collectors of physical sticker albums and trading cards. The App displays sticker codes, set names, player names, team names, league names, and similar identifiers to help users describe the items they own, want, or are trading. These names and any associated trademarks are the property of their respective owners — including but not limited to Panini Group, Topps, Match Attax, FIFA, UEFA, individual football clubs, national federations, players, and other rights holders.

SwapMap is not affiliated with, endorsed by, sponsored by, or in any way officially connected to any sticker manufacturer, trading-card publisher, sports league, federation, club, organization, or competition referenced in the App. The App does not sell or distribute any stickers or cards itself. All third-party names and trademarks are used solely for identification and descriptive purposes (nominative fair use) so that collectors can recognize and exchange the items they already physically own.

User-uploaded content (listings, photos, messages) is the responsibility of the user who posted it. SwapMap does not claim ownership of, and does not pre-verify, user-supplied content.

If you are a rights holder and believe that your trademark or copyrighted material is being used incorrectly within the App, please contact us at the email below. We will review the request and respond promptly, removing or replacing the content where appropriate.

12. Contact

For questions about this Privacy Policy or data processing requests:

Requests under GDPR or KVKK can be sent to the email address above or by mail. We will respond within 30 days.

© 2026 iCat Studios. All rights reserved.