Privacy Policy

Last updated: 16.08.2026

GDPR Compliant

Paperclip ("we", "us", "our") operates a peer-to-peer trading marketplace mobile application (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, how we store it, and your rights under the General Data Protection Regulation (GDPR) and other applicable laws.

1. Who We Are (Data Controller)

The data controller for the personal information processed through the App is:
Paperclip
Contact: contact@paperclip-trades.com

2. What Data We Collect

We collect the following categories of personal data when you use the App:

• Account information: first name, last name, username, email address, password (stored as a secure hash — we never store your plain-text password)
• Location data: your approximate address or GPS coordinates, used to calculate distances between you and other users' items
• Item listings: title, description, and photos you upload for items you wish to trade
• Chat messages: messages you send to other users within the App
• Trade interactions: which items you liked, proposed trades, and trade history

We do not collect payment information. Paperclip is a free trading platform with no financial transactions.

3. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): account data, location, listings, and messages are necessary to provide the trading service you signed up for.
• Legitimate interests (Art. 6(1)(f)): basic usage data processed to maintain security, prevent abuse, and improve the App.
• Consent (Art. 6(1)(a)): access to your device's photo library and precise GPS is only requested when you actively use those features and can be withdrawn at any time in your device settings.

4. How We Use Your Data

• Create and manage your account
• Show nearby items and calculate distances
• Enable trading proposals and chat between users
• Display your profile and listings to other users
• Send in-app notifications about trade activity
• Detect and prevent fraudulent or abusive behaviour

5. Data Storage & Third-Party Services

Your data is stored and processed using the following services:

• MongoDB Atlas (database) — hosted on AWS. Data may be stored in the United States. MongoDB Atlas is covered by Standard Contractual Clauses for international transfers. MongoDB Privacy Policy
• Railway (backend hosting) — our API server runs on Railway's infrastructure. Railway Privacy Policy
• Cloudinary (image storage & delivery) — photos you upload are stored on Cloudinary's CDN. Cloudinary Privacy Policy
• PostHog (product analytics) — hosted on AWS. The data is stored in an EU-hosted Datacenter (Frankfurt, Germany). PostHog is covered by Standard Contractual Clauses for international transfers where applicable. PostHog Privacy Policy

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, your profile, listings, and messages will be permanently deleted within 30 days. Images hosted on Cloudinary will also be removed within this period. Some anonymised aggregated statistics may be retained for longer to improve the service.

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): correct inaccurate data via the Settings screen or by contacting us
• Right to erasure (Art. 17): request deletion of your account and all associated data
• Right to restriction (Art. 18): request that we limit processing of your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent: for location and photo access, withdraw consent at any time in your device's app settings

To exercise any of these rights, email us at contact@paperclip-trades.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or the relevant Data Protection Authority in your EU member state).

8. Cookies & Analytics

We use PostHog (hosted in the EU) to understand how the app is used — which screens people visit, which features get used, and basic app interactions (taps, navigation). Events are tied to your account ID so we can see how individual users move through the app, but PostHog does not receive your password or payment information (we don't collect payment information at all). You can find PostHog's own privacy policy at https://posthog.com/privacy.

9. Children's Privacy

The App is not directed at children under 13 (or under 16 in the EU/EEA where applicable). We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

10. Security

Passwords are stored as bcrypt hashes and never in plain text. All data in transit is encrypted via HTTPS/TLS. Access to the database is restricted to authenticated backend services only. Despite these measures, no system is completely secure; if you suspect a security incident, please contact us immediately.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified within the App. The "Last updated" date at the top of this page will always reflect the most recent revision.

12. Contact

For any privacy-related questions or to exercise your rights:
Email: contact@paperclip-trades.com