Privacy Policy

Modeled on Grailed's Privacy Notice structure, rewritten to align with Alberta's Personal Information Protection Act (PIPA) — the private-sector privacy law that applies to a business operating out of Alberta.

14.1 Introduction

This Privacy Policy describes how FitSwap ("FitSwap," "we," "our," or "us") collects, uses, and discloses personal information when you use our website, mobile app, and related services. Where FitSwap's activities extend beyond Alberta, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply.

14.2 Information We Collect

Information You Provide to Us

Account information: name, email address, password, profile photo, location, date of birth (for age verification)
Closet/listing information: item photos, category, size, brand, condition, description
Communications: messages sent through in-app chat tied to a swap, support inquiries
Shipping information: your name, mailing address, and phone number, saved to your account so you don't have to re-enter it for every swap. Used to purchase real shipping labels through our shipping partner (see §14.5), and disclosed to your swap partner in the practical sense that it appears on the physical package and label they receive — FitSwap does not display it to them directly in the app.
Billing information: if you complete a swap by shipping, you'll save a payment method to cover the shipping cost and FitSwap's commission (see the Fees & Commission Disclosure). Your card details are collected and stored directly by our payment processor, Stripe — FitSwap never receives or stores your full card number.

Information We Collect Automatically

Log data: IP address, device/browser type, pages visited, date/time of visits
Usage data: items viewed, swaps proposed, general interaction patterns
Cookies: a strictly necessary session cookie that keeps you signed in — see the Cookie Policy for detail

14.3 Consent

Consistent with PIPA, FitSwap collects, uses, and discloses personal information only with the consent of the individual, and only for purposes a reasonable person would consider appropriate in the circumstances. You may withdraw consent at any time, subject to legal or contractual restrictions — withdrawing consent may limit or prevent your ability to use certain features (e.g., you cannot complete a swap without your shipping address being shared with your swap partner).

14.5 How We Share Information

With other users, as necessary to complete a swap — your shipping address is shared with your swap partner only once a swap is accepted, and only for that transaction
With service providers who perform functions on our behalf, under contractual obligations to protect your information, specifically:
- Stripe, Inc. — processes shipping-fee payments and refunds. Stripe receives your billing/card details directly; FitSwap only receives a reference token, never your full card number.
- Shippo — receives the shipping addresses of both participants in a shipping-fulfilled swap in order to purchase a real carrier label and provide tracking updates.
For legal reasons, if required to comply with a legal obligation, respond to law enforcement, or investigate fraud or policy violations — see the Law Enforcement & Data Requests Policy for how these requests are handled

We do not sell your personal information to third parties.

Stripe and Shippo may process data outside Alberta in the course of providing these services. This list is kept current — if FitSwap adds or changes a service provider that processes personal information, this section will be updated to reflect it.

14.7 Data Retention

We retain personal information only as long as reasonably necessary to fulfill the purposes described in this policy. Your shipping address and billing information are saved to your account (not collected fresh per swap) so they can be reused across swaps — they're retained until you replace them yourself in Account settings, or until you close your account, at which point they're deleted.

14.8 Your Rights Under PIPA

Request access to the personal information FitSwap holds about you (we'll respond within 45 days, as required by PIPA)
Request correction of inaccurate personal information
Withdraw consent to FitSwap's collection, use, or disclosure of your information
File a complaint directly with FitSwap, or with the Office of the Information and Privacy Commissioner (OIPC) of Alberta

14.10 Breach Notification

If a privacy breach occurs that a reasonable person would consider to pose a real risk of significant harm to an individual, FitSwap will notify the OIPC of Alberta in writing, as required by PIPA, and will notify affected individuals directly where required — even if only one individual is affected.

14.11 Children's Privacy

Consistent with our age policy, the Services are not directed to or available to anyone under 18. If we learn we've collected personal information from someone under this age, we will promptly delete it.

14.13 Contact Us / Privacy Officer

Under PIPA, organizations must designate someone responsible for privacy compliance. FitSwap's designated Privacy Officer is Mark Malthouse, reachable at privacy@fitswapapp.com. You may also contact the OIPC of Alberta directly at oipc.ab.ca.