Privacy Policy

1. Scope and accountability

This Policy applies to switchhands.ai, its French pages, and related SwitchHands marketplace services. SwitchHands is responsible for personal information under its control. The person exercising the highest authority for SwitchHands acts as Privacy Officer unless the role is delegated in writing.

Privacy Officer, SwitchHands, Montreal, Quebec, Canada — privacy@switchhands.store.

2. Information we collect and why

We collect information directly from you, automatically through your browser and hosting infrastructure, from authentication and email providers, and from other members when they communicate, review, block, or report an account.

3. Location, profiling, and automated features

SwitchHands first tries to infer an approximate city, region, and country at the network edge. If that is unavailable and you tap “Find my city with my phone,” your browser may request location permission. The coordinates are compared only in your browser with supported Canadian city centres, are never sent to SwitchHands, and are immediately discarded. Only the resulting city choice is remembered. Active-member visibility is off by default and requires your choice. Other members do not receive your email, raw IP address, coordinates, or exact location from your profile.

SwitchHands uses automated rules to match Wishlists with listings and to calculate trust points, tiers, and listing limits from confirmations, feedback, and ratings. These rules can affect trust badges, listing capacity, and what matches the service displays, but they do not establish identity, creditworthiness, or legal reliability. You may ask the Privacy Officer about the information used, the main factors and parameters, or correction of inaccurate information.

4. Cookies and browser storage

We currently use an essential HttpOnly session cookie that lasts up to 30 days, a random browser device identifier, a locale preference, and an area choice remembered in local storage for 10 days. These are used to sign you in, protect sessions, remember language and location choices, and prevent the repeated location prompt. You can clear cookies or site data in your browser, but doing so may sign you out, reset choices, or require a new email code. We do not currently use advertising cookies or sell information for targeted advertising.

5. When information is visible or shared

Information you choose to publish—such as display name, approximate city, profile signals, listings, photos, Wishlists, and reviews—may be visible to other users. Messages and offers are shared with the intended participant. Do not post an exact home address, financial credentials, identity documents, or information you do not want another member to receive.

We may disclose necessary information to:

• OpenAI/ChatGPT Sites and Cloudflare for deployment, hosting, content delivery, databases, object storage, and security;
• Supabase for email-code authentication and Resend for email delivery;
• Amazon Web Services, including Amazon Interactive Video Service (IVS) and IVS Chat, if the coming-soon Live feature is enabled and you choose to use it;
• professional advisers, insurers, auditors, or a buyer/successor in a legitimate business transaction, subject to confidentiality and applicable law;
• law enforcement, regulators, courts, emergency contacts, or other persons where authorized or required by law or reasonably necessary to respond to an urgent threat, fraud, abuse, or a legal claim; and
• other parties with your direction or valid consent.

We do not sell or rent personal information. We do not authorize service providers to use it for their own unrelated marketing.

Live is currently unavailable. If it is offered later, the interface will identify the audience and any recording status before you start broadcasting.

6. Processing outside Quebec and Canada

Some service providers may process or store personal information in other Canadian provinces, the United States, or other jurisdictions. Their laws may allow courts, law enforcement, or national-security authorities to access information. Where required, cross-border processing is subject to privacy-risk assessment and appropriate contractual or other protective measures. Contact the Privacy Officer for more information about relevant locations and providers.

7. Consent and your choices

Account creation requires the name, email, essential authentication data, and agreement record needed to provide and secure the service. Your manually entered city and presence visibility are separate optional choices. Refusing or withdrawing an optional choice does not prevent general browsing, although the related city or visibility feature will not work. You may withdraw consent to a use or disclosure where consent is the legal basis, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not invalidate lawful prior processing.

Live is currently unavailable, so SwitchHands does not request camera or microphone access for broadcasting. If Live is enabled later, access will remain optional and will begin only after you choose the control and grant browser permission.

8. Retention and deletion

We keep personal information only as long as reasonably necessary for the identified purposes and legal requirements. Email codes are valid for 10 minutes; related request and security records are normally removed during routine cleanup after 30 days. Session records expire after 30 days and the local area choice after 10 days. Authentication and email providers may retain account or request records under their configured retention and security obligations until deletion is requested or provider-side cleanup occurs. Account, listing, message, offer, feedback, and trust records are retained while the account or transaction history is active and until deletion is requested or they are no longer needed.

Live is currently unavailable and SwitchHands does not record or archive broadcasts. If Live is enabled later, this Policy and the interface will explain any recording, temporary media processing, service logs, chat retention, and moderation records before use.

After account closure, we may retain limited records reasonably needed for fraud prevention, safety, unresolved disputes, legal claims, regulatory obligations, and backup cycles. When the purpose is complete and no legal exception applies, information is destroyed or irreversibly anonymized using appropriate practices.

9. Safeguards and incidents

Measures include password-free email verification, hashed session tokens, HttpOnly and SameSite session cookies, HTTPS in transit, restricted database access, coarse location design, private email display, input limits, and abuse controls. No online service can promise perfect security. Use a secure email account and report suspected unauthorized access promptly.

We maintain a process to assess confidentiality incidents, reduce harm, preserve required records, and notify affected individuals and regulators when the law requires it.

10. Your privacy rights

Subject to applicable exceptions, you may request confirmation and access to personal information, correction of inaccurate or incomplete information, deletion, withdrawal of consent, and a copy of eligible computerized information in a structured and commonly used format. You may also ask questions about automated processing and submit a privacy complaint.

Send a request to privacy@switchhands.store. We may verify identity before responding and will respond within the period required by applicable law. If unresolved, you may complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada, as applicable.

11. Age restriction

SwitchHands is for people who have reached the age of majority where they live. We do not knowingly create accounts for minors. If you believe a minor has provided personal information, contact the Privacy Officer so the account and information can be reviewed and, where appropriate, deleted.

12. Changes to this Policy

We may revise this Policy as the platform or legal requirements change. We will publish the updated version and effective date and provide additional notice or seek renewed consent when required for a material new use. Previous versions may be requested from the Privacy Officer.