Privacy Policy
Effective date: 23 September 2026
TradeOff ("we", "us", "our") operates the TradeOff mobile application (the "App"). This policy explains how we collect, use, and protect your personal data when you use the App.
We are based in the United Kingdom and process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data We Collect
Account information
- Full name and email address (required to create an account)
- Password (hashed; we never store or see your plaintext password)
- Two-factor authentication enrolment status and recovery codes
Profile information
- Profile photo (compressed and resized on your device before upload)
- Bio / about text (up to 200 characters)
- Skills and interests you select
- Location (city/area, entered manually or detected via GPS with your permission)
- Service area radius (1-50+ miles)
Activity data
- Services you list, trade proposals, and completed trades
- Messages you send and receive
- Ratings and reviews you leave or receive
- Notification preferences
- Online status and last-seen timestamp
Device and technical data
- Device platform (iOS or Android) and OS version
- App version
- Push notification token (for delivering notifications via Firebase Cloud Messaging)
2. Data We Do Not Collect
- We do not use analytics or tracking SDKs
- We do not serve advertisements or share data with ad networks
- We do not collect contacts, call logs, or browsing history
- We do not use cookies (the App uses token-based authentication)
3. How We Use Your Data
- Provide the service: creating your account, displaying your profile, enabling trades and messaging
- Notifications: sending push notifications about trades, messages, and reviews (you control which types you receive)
- Safety and moderation: investigating disputes, enforcing our terms, and preventing abuse
- Improving the App: fixing bugs and understanding how features are used (using aggregated, non-identifying data only)
4. Legal Basis for Processing
- Contract: processing necessary to provide the service you signed up for (account, trades, messaging)
- Legitimate interests: safety, security, and fraud prevention
- Consent: location access, push notifications, and optional profile fields (you can withdraw consent at any time)
5. Who We Share Data With
We do not sell your personal data. We share data only with:
- Other users: your public profile, listed services, ratings, and messages are visible to users you interact with. You control visibility of your email, location, and online status via privacy settings.
- Supabase (infrastructure provider): hosts our database, authentication, file storage, and real-time services. Data is stored in the EU/UK.
- Firebase Cloud Messaging (Google): delivers push notifications to your device. Only a device token is shared; message content is not sent through FCM.
6. Data Storage and Security
- Data is stored in Supabase-managed PostgreSQL databases with row-level security policies enforcing data isolation between users
- All data in transit is encrypted via TLS
- Passwords are hashed using bcrypt
- Two-factor authentication is available for additional account security
- Admin access is restricted to authorised personnel with 2FA enforced
7. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it (e.g. transaction records for tax or legal purposes).
Cached data on your device is cleared when you sign out.
8. Your Rights
Under UK GDPR, you have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate data (you can edit your profile directly in the App)
- Erasure: request deletion of your account and data
- Restriction: ask us to limit how we process your data
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Withdraw consent: for location, notifications, or optional profile fields at any time via your device settings or the App
To exercise any of these rights, contact us at admin@tradeoff.uk.
9. Children
The App is not intended for anyone under 18 years of age. We do not knowingly collect data from children. If we learn that we have collected personal data from a child, we will delete it promptly.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via the App or by email. The "Effective date" at the top of this page indicates when the policy was last revised.
11. Contact
If you have questions about this policy or wish to exercise your data rights:
TradeOff
Email: admin@tradeoff.uk
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
TradeOff ("we", "us", "our") operates the TradeOff website at tradeoff.uk (the "Website"). This policy explains how we collect, use, and protect your personal data when you visit the Website.
We are based in the United Kingdom and process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data We Collect
Monthly roundup (mailing list)
If you sign up for our monthly email of new skills near you, we collect:
- Your email address
- The town you choose (Cheltenham, Gloucester, Stroud, Tewkesbury, Bishop's Cleeve or Other)
- The date and time you signed up and confirmed your consent
Skill requests
If you use the "What skill are you after?" form, we collect:
- The skill you are looking for
- The first half of your postcode only (for example GL50). We never ask for your full address, and if you enter a full postcode we discard the second half
- Your email address, only if you choose to give it
- Which page of the Website you sent it from
Giving an email address with a skill request does not add you to the mailing list.
Website analytics
We use Plausible Analytics to understand how the Website is used. Plausible is privacy-friendly and designed to comply with UK GDPR and PECR without cookies:
- It does not use cookies or store anything on your device
- It does not collect or store personal data, and cannot identify or follow you across websites
- Your IP address is used only momentarily to generate a daily-rotating anonymous identifier and is never stored
- It records aggregated information only: pages viewed, the referring website, campaign tags in the link you followed, browser, device type, operating system and country
- We also count a few anonymous actions, such as clicks on the App Store and Google Play buttons, form submissions (without their contents) and visits from our printed QR codes
Security logs
- To stop spam and abuse of our forms, your IP address is used to limit how many times a form can be submitted. This is held in a temporary file on our web server and discarded automatically
What we do not collect
- We do not use cookies
- We do not serve advertisements
- We do not use third-party tracking pixels or advertising trackers
2. How We Use Your Data
- Monthly roundup: to email you a summary of new skills on offer near you, about once a month
- Skill requests: to understand what people in your area are looking for, so we can invite people who offer those skills. If you gave an email address, we may reply to you about your request
- Analytics: to see which pages, links and campaigns are useful, using aggregated figures only
- Security: to prevent abuse and spam submissions
We will not share or sell your data to third parties for their own marketing.
3. Who Processes Your Data
- Resend (email provider): stores mailing list contacts and sends our emails, including skill-request notifications to our team. Resend acts as our data processor under a data processing agreement. Resend is based in the United States, so your details may be processed outside the UK
- Plausible Analytics (Plausible Insights OÜ, EU-hosted): provides our cookie-free website statistics. No personal data is stored
- Our web host: serves the Website and handles form submissions
4. Legal Basis for Processing
- Consent: the monthly roundup is only sent if you tick the consent box, and skill requests are sent voluntarily. You can withdraw consent at any time
- Legitimate interests: aggregated, cookie-free analytics to improve the Website, and IP-based rate limiting to prevent abuse
5. Data Storage, Security and Retention
- All data in transit is encrypted via TLS (HTTPS)
- Access is restricted to authorised personnel only
- Mailing list: we keep your email address and town until you unsubscribe or ask us to delete them
- Skill requests: we keep these for up to 12 months, then delete them or keep only anonymous totals (skill and area, without any email address)
- Pre-launch waitlist: if you joined our waitlist before launch, those details are kept only until you have been told about the launch, then deleted unless you create an App account
6. Your Rights
Under UK GDPR, you have the right to:
- Access: request a copy of the data we hold about you
- Erasure: ask us to delete your email address, town or skill requests
- Withdraw consent / unsubscribe: every monthly email has an unsubscribe link, or you can email us and we will remove you
- Object: object to processing based on legitimate interests
To unsubscribe, delete your data or exercise any of these rights, contact us at admin@tradeoff.uk.
7. Children
The Website is not intended for anyone under 18 years of age. We do not knowingly collect data from children.
8. Changes to This Policy
We may update this policy from time to time. The "Effective date" at the top of this page indicates when it was last revised.
9. Contact
If you have questions about this policy or wish to exercise your data rights:
TradeOff
Email: admin@tradeoff.uk
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).