Privacy policy.

Plain-English version: We collect what's needed to match you with a trade partner. We share only what's necessary, only with the matched person. We never sell your data. You can ask us to delete it any time.

What we collect

To match you with a buyer or seller, we collect:

• Your full name (used in match emails as your first name only - last name is stored but not shared)
• Email address
• Zip code (used to match by 3-digit zip prefix - we store all 5 digits but only the prefix is used for matching)
• Phone number (optional - only if you provide it)
• Meetup area preference (optional)
• Game listing details (title, condition, price, timeline, notes if any)

If you sign in with Google, we additionally receive your Google account email, name, and profile picture from Google's OAuth sign-in flow. We do not receive any other Google data (no contacts, no Drive, no calendar, no Gmail content).

We do not collect or store: government IDs, financial information, payment methods, social security numbers, photos of you, biometric data, location beyond zip code, or browsing history outside cartridgebond.com.

What we do with it

We use your information to:

• Match you with a compatible buyer or seller
• Send transaction-related emails (confirmations, match notifications, status updates, follow-ups, rating prompts)
• Provide customer support when you reach out
• Improve our matching algorithm and service quality
• Detect and prevent fraud, abuse, and violations of our Terms

We do not use your information for ad targeting, sell it to advertisers, or share it with data brokers.

Who we share with - and exactly what

When you and a counterparty are matched, we share only the following with that one matched user:

• Your first name (not last name)
• Your contact email
• Your meetup-area preference if you set one
• Your 5-digit zip code (so they know roughly where to meet)

We do not share: your full name, your phone number (even if you provided it), your exact home address, your past listings, or your trade history.

After a match, you may choose to share additional contact details directly with the other party - that's between you and them.

We never sell your information. If CartridgeBond is acquired, sold, or merged with another company, your information may transfer to the new operator under the same privacy commitments described in this policy. We will notify you via email at least 30 days before any such transfer.

How long we keep it

• Active listings: until the trade closes, you cancel, or 90 days of inactivity (whichever comes first)
• Completed trade records: 2 years (for fraud prevention, dispute resolution, and tax purposes)
• Account data: until you delete your account or 18 months of inactivity
• Customer support emails: 1 year after resolution

You can request deletion at any time (see "Your rights" below).

Cookies and tracking

We use minimal cookies for authentication (keeping you logged in via Google OAuth session). We do not use ad-tracking cookies, behavioral fingerprinting, or third-party tracking pixels. We do not currently run analytics on cartridgebond.com - if we add Google Analytics or a similar tool in the future, we will update this policy and notify users.

Your rights

You can request the following at any time by emailing cartridgebond@gmail.com:

• Know: see what data we have about you
• Correct: fix any inaccurate information
• Delete: remove your account and associated data
• Export: get a copy of your trade history in a portable format
• Restrict: limit how we use your data while a question is being resolved
• Opt out: stop receiving non-transactional emails (we'll always send transaction-related emails like match notifications)

We respond to requests within 14 days. Some data may be retained for legal purposes (fraud prevention, tax records) for up to 2 years even after deletion of an active account.

State privacy rights (California, Virginia, Colorado, and others)

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, or another state with comprehensive privacy law, you have specific rights under those laws. The rights described in "Your rights" above cover what those laws guarantee. Specifically:

• California (CCPA/CPRA): You have the right to know, delete, correct, and opt out of any "sale" or "sharing" of your data. We do not sell or share your data for cross-context behavioral advertising.
• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA): Similar rights to access, correct, delete, and port your data, and to opt out of targeted advertising and data sale. We do neither.

To exercise any of these rights, email cartridgebond@gmail.com. We do not discriminate against users who exercise their privacy rights.

Security

Authentication is handled by Google OAuth - we never see or store your password. Listing data lives in Google Workspace (Sheets), accessed only by the operator (currently the founder). Authentication tokens are stored in Google Apps Script Properties Service, which Google encrypts at rest. Emails are sent through Gmail using TLS encryption in transit.

No system is perfectly secure. If we discover a security incident affecting your data, we will notify you via email within 72 hours of confirming the breach, along with information about what was affected and what steps to take.

Minors

CartridgeBond is intended for users 16 and older. We do not knowingly collect personal information from anyone under 16. We do not direct any features at children, do not show personalized advertisements, and do not track behavioral patterns specific to minors.

If you believe we have collected information from someone under 16, contact us at cartridgebond@gmail.com and we will delete it immediately.

Changes to this policy

If we materially change this policy, we will notify active users via email at least 14 days before the change takes effect, and update the "Last updated" date at the top of this page. Continued use of the Service after changes means you accept the updated policy.

Contact

Privacy questions, requests, or concerns? Email cartridgebond@gmail.com. We try to respond to all messages within two business days.

Quick reality check: CartridgeBond is currently a Milwaukee-only beta operated by one person. Your data lives in a small set of Google services (Workspace Sheets, Gmail, Apps Script, OAuth). When we expand and add escrow/payments, we will update this policy with full disclosure of any new data flows or third-party processors before launch.