Privacy policy
Last updated: 2 September 2026
Cardboardmarket helps you find cards near you and meet in person to swap them. This explains what we keep, why, and what you can do about it. It is written to be understood rather than to cover us.
Who is responsible
Asier Paz Martínez, tax number 23065951X, Calle Juan Carlos I, 8, 30590, Murcia, España. Privacy contact: [email protected].
What we keep, and why
| Data | What for | Legal basis |
|---|---|---|
| Email address | Signing in, confirming the account, and telling you what happens in your trades | Performance of a contract |
| Password | Only a one-way hash. The password itself is never stored | Performance of a contract |
| Display name | It is what other traders see | Performance of a contract |
| Your points on the map | Working out how far away cards are | Performance of a contract |
| Name for each point | Telling them apart when you save more than one. You write it, and only you see it | Performance of a contract |
| Search radius | Deciding which listings to show you | Performance of a contract |
| WhatsApp or Telegram (optional) | So other people can reach you outside the app, only if you turn it on. Saving it does not publish it: showing it is a separate switch you can turn off at any time. Somebody who is not signed in never sees the value, only that it exists | Consent |
| Listings, cards and wants | They are the service | Performance of a contract |
| Messages | Talking to the other person to arrange a meetup | Performance of a contract |
| Trades and meetups | The agreement between two people: what, where and when | Performance of a contract |
| Sessions | Keeping you signed in. Only a hash of the token is stored | Performance of a contract |
| Usage of the site | Knowing which screens are used, to improve the product | Legitimate interest |
| The photo you take when you scan a card | Reading which card it is, and improving the service. We keep the photo, what we read in it, and which of our suggestions you chose. It is a photo of a card: we do not publish it, we do not attach it to your listings, and nobody else sees it. If you want it deleted, write to [email protected] and we will | Legitimate interest |
| What you tell us when you report a problem | Fixing it and, if you leave an address, answering you. We keep your message, the page you were on and your browser | Legitimate interest |
Your location
This is the most sensitive part of the product, so it is worth being explicit.
- We store the points you set: from your browser, or by dropping a pin on a map. We never ask for an address.
- Those points never leave the server. They appear in no API response, not even indirectly.
- What others see is a distance, rounded to 100 m, and never below 1 km — anything closer reads "less than 1 km". A sub-kilometre distance locates a person far too well.
- We do not store a city, province, postcode or neighbourhood. They do not exist in the database.
A meetup's location is different: the two of you write it, and only the two of you see it.
Analytics
We want to know which screens get used. We do not want to know who you are.
- No cookies and no stored identifier. A visitor is a hash of a secret that changes every night, your IP and your browser. Yesterday's secret is deleted, so not even we can connect your visits on one day to another.
- Your IP is not stored. It is used to compute that hash and discarded.
- Paths are matched against a closed list, so an identifier in a URL cannot end up recorded.
- From the site that sent you here we keep only the domain, never the search.
- If you arrive from one of our adverts, we record which campaign brought you: a label from a closed list we define ourselves, so we can tell whether the advertising works. It identifies a campaign, never a person, and nothing is stored on your device to make it work.
- We also use Umami, a cookieless analytics service, served from our own domain. It receives an approximate country, region and city. It does not receive your coordinates: Cloudflare offers them and we have chosen not to send them. Umami Software, Inc. is in the United States and acts as a processor; the relationship is governed by their data processing agreement, which incorporates the European Commission's Standard Contractual Clauses for transfers.
This is why you will not see a cookie banner: there are no cookies to consent to, apart from your own session, which is what being signed in means.
Who we share with
Nobody, beyond what makes the thing work:
- Mailjet, to send you email.
- Umami, for the analytics described above.
- Bunny, which serves catalogue images. Those are pictures of cards, not of you.
We do not sell data and we do not profile you.
You will not see adverts inside Cardboardmarket. We do advertise outside it — on social media, so that people can find us — and the only thing that comes back from that is the campaign label described under "Analytics". Whoever shows our adverts receives nothing about you. If there is ever advertising in here, this page will say so before it happens.
How long
- Your account, for as long as you keep it.
- Sessions expire after 30 days.
- Email confirmation links expire in hours.
- Analytics does not expire on its own, but identifies nobody past the day it was collected.
- A settled trade is kept: it is the record of an agreement between two people, and it belongs to the other one as well.
- Problem reports are deleted once they are no longer useful, and within a year.
- Scan photos are kept for as long as they help improve the service. If you delete your account, they go with it; and if you would rather they went sooner, write to [email protected].
Your rights
- See and take your data: "Export" in your profile. JSON, including your exact point — the rounding protects you from other traders, not from yourself.
- Delete your account: in your profile. It removes your email, password, point, cards, wants and messages, and cancels open trades. How to do it, step by step: deleting your account.
- Settled trades are not deleted, and conversations continue to exist for the other person, though your messages are gone. They are entitled to their own record of what you agreed.
- Complain: to the Spanish data protection authority (aepd.es).
Payments
There are none. Money, if any, changes hands in person. We hold no payment details because we never ask for them.
Changes
If this changes, you will see it here with a new date.