Your information, explained clearly.

1. Who we are

CardQuay is a registered Australian business name held and operated in New South Wales by WANG, LIYUAN, an individual sole trader (ABN 66 120 438 006). This policy is intended to reflect the Australian Privacy Principles where they apply and our commitment to transparent handling even where an exemption may be available.

2. Information we collect

Depending on how you use CardQuay, we may collect:

• account details, including email address, username, password-related authentication records, full name, phone number and postal address;
• verification information, including contact-verification results and any identity or ownership evidence requested for a trust-and-safety review;
• profile, listing and card information, including images, private inventory costs and ownership declarations;
• messages, offers, trade proposals, reports, complaints and customer-support correspondence;
• transaction information such as prices, receiving details selected by the seller, payment confirmations or evidence, disputes, shipping and tracking details; and
• technical information such as IP address, device and browser details, timestamps, security events, cookies and similar identifiers.

Safeguarded Trade checkout is currently disabled. Stripe may retain information from historical Sandbox service-payment tests or process a future Safeguarded service payment only after that service is enabled and the user chooses it. The card price remains a direct payment between members. CardQuay does not ask sellers to create a Stripe payout account. If a seller chooses bank transfer, CardQuay stores the receiving account details they enter, including the BSB and account number, so the agreed transaction can display those details to the relevant buyer. PayID details and payment evidence are also stored when users provide them. Never enter your online-banking password or one-time security codes.

Card scanning, device photos and optional backup

Live camera text recognition runs on your device. A camera frame is not automatically published as a listing. Photos you choose for listings, avatars or transaction evidence are uploaded when you save or submit that feature. The app prepares fresh copies of selected photos and does not request your device location to scan cards.

Sports reference samples are initially stored on your device. If you explicitly choose private cloud backup and confirm permission, CardQuay stores the sample photos, recognized text, identification issues, source and permission notes, batch labels and your correction history in your account. These backups are not public listings or a shared model-training catalogue. You can remove cloud copies separately from local copies. Removing the app removes device-local samples that have not been backed up.

When iOS push notifications are enabled, CardQuay stores the device notification token and its account/session association. Lock-screen messages are generic and do not include chat text, card prices or delivery details. You can turn off push alerts without closing your account.

3. How we collect information

We collect information directly from you through forms, uploads and communications; automatically when you use the service; from another user when needed for an order, trade or report; and from service providers used for identity, payments, fraud prevention and delivery.

4. Why we use it

We use personal information to create and secure accounts, verify seller eligibility, display public profiles and listings, support purchases and trades, deliver notifications, prevent fraud, investigate reports, resolve disputes, improve service reliability, meet legal duties and communicate essential policy or account changes.

5. What is public

Your username, display name, public profile information, listings, card images and marketplace activity you choose to publish may be visible to others. Your full name, email, phone number, identity documents and postal address are not displayed publicly by default. Information needed to complete a transaction may be shared with the other party at the appropriate stage.

6. Sharing and service providers

We may share information with the buyer or seller involved in a transaction; payment, identity, email, hosting, database, security, analytics and delivery providers; professional advisers; regulators, courts and law enforcement where required; and a successor if the business is restructured or sold. Providers currently used include Cloudflare for hosting, storage and database services, Supabase for account authentication, Resend for transactional email, Apple for optional iOS push delivery when enabled, and Stripe for historical Sandbox testing or a future optional Safeguarded service payment if enabled. Stripe handles payment information under its own terms and privacy notice.

We do not sell personal information. We do not share it for unrelated third-party marketing without permission.

7. Overseas processing

Technology providers may process or store information outside Australia, including in Singapore, Japan, the United States and other locations where they or their subcontractors operate. We take reasonable steps to select reputable providers and use contractual, technical and access controls appropriate to the information.

8. Storage, security and retention

We use role-based access, encrypted connections, managed authentication, access logging and other reasonable safeguards. No online system can be guaranteed completely secure. We retain information while your account is active and as reasonably needed for transactions, fraud prevention, disputes, taxation, legal compliance and enforcement. We then delete or de-identify it where lawful and practical.

9. Access and correction

You can update certain profile details in your account. You may also ask us for access to, or correction of, personal information we hold. We may need to verify your identity and may refuse or limit a request where the law permits, explaining the reason where required.

10. Deletion and account closure

You may request account closure or deletion. We may retain limited records connected with completed or disputed transactions, safety reports, fraud prevention, tax or legal obligations. Public content will be removed or de-identified where appropriate, subject to those needs.

An accepted in-app deletion request signs you out, revokes active sessions, hides available listings and removes access to private sports sample backups. Associated backup files are queued for deletion; storage failures may delay physical cleanup. Other account records remain subject to the review and retention requirements above. Copies already downloaded by another person cannot be recalled, and previously public photos may remain temporarily in caches.

11. Children

CardQuay is for users aged 18 or older. We do not knowingly create accounts for children. Contact us if you believe a person under 18 has provided personal information.

12. Complaints and changes

Send a privacy complaint to the contact above with enough detail for us to investigate. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner. We may update this policy and will post the new date and give reasonable notice of material changes.