Privacy Policy

Effective date: September 6, 2026

This policy describes how barter.game ("we") handles your "Personal Data" — information that is directly linked or can be linked to you. It applies to the Personal Data we process as the data controller when you use barter.game, including the website, the account app, community landing pages, and community banks (collectively, the "Services").

Personal Data we collect

From you

• Account data. When you register, we collect your email address and password. Passwords are handled by our authentication provider (Amazon Cognito) and are never stored in plaintext.
• User content. The communities you create and customize: community names, landing page text and colors, and the records your community's bank holds (member handles, balances, transactions).
• Support data. If you contact us, we collect the details you send us.

Automatically

• Usage data. With your consent (see "Cookies" below), we use PostHog analytics to collect data about your interactions with the Services: pages viewed, links clicked, device and browser information, session details, and coarse geolocation inferred from your IP address.
• Service logs. Our infrastructure automatically logs requests (IP address, date and time, pages requested) for security and operations.

From third parties

We do not buy or receive Personal Data about you from third parties.

How we use your Personal Data

• Service provision. To create your account, run your communities and their banks, and deliver the features you use.
• Communication. To send transactional email (account confirmation, password reset) via Amazon SES. We do not send marketing email.
• Safety and security. To detect and prevent abuse and to keep the Services secure.
• Analytics and improvement. With your consent, to understand how the Services are used and to improve them.
• Legal obligations. To comply with applicable law and to establish, exercise, or defend legal claims.

We practice data minimization and collect the minimum Personal Data required for these purposes.

Sharing of Personal Data

We do not sell your Personal Data. We share it only with:

• Service providers (subprocessors).
  • Amazon Web Services — hosting, database, authentication (Cognito), and transactional email (SES), in the United States (us-west-2 and us-east-1).
  • PostHog, Inc. — product analytics, in the United States. Only active after you accept analytics cookies.
  These providers process data on our behalf under contractual obligations of security and confidentiality.
• Competent authorities. We may disclose Personal Data in response to lawful requests or to protect our rights and safety.
• Corporate transactions. If barter.game is involved in a merger or sale, Personal Data may be transferred within the limits of the law and this policy.
• The public. Community landing pages and the bank discovery documents they link to are public by design. Do not put Personal Data in community content that you do not want published.

Cookies and tracking technologies

We use cookies and similar technologies (including browser local storage) for:

• Essential functionality. Keeping you logged in and storing your cookie consent choice. These do not require consent.
• Analytics (non-essential). PostHog sets a first-party cookie to distinguish visitors and sessions. We load analytics in an opted-out state and only enable it if you press "Accept" in the cookie banner. You can change your choice at any time via the "Cookie settings" link in the footer of every page.

You can also control cookies through your browser settings or a blocking extension; the Services work without analytics cookies.

Lawful bases for processing (EEA and UK)

• Contractual necessity — to provide the Services you signed up for.
• Legitimate interests — to secure and operate the Services, where not overridden by your rights.
• Consent — for analytics cookies. You may withdraw consent at any time via "Cookie settings".
• Legal obligation — where processing is required by law.

Your privacy rights

Depending on where you live, you may have the right to:

• access the Personal Data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data or limit its processing;
• object to processing;
• withdraw consent at any time, where processing is based on consent;
• receive your data in a structured, commonly used, machine-readable format.

You can delete your account — and the Personal Data tied to it — yourself, at any time, from the app ("Delete account" on the communities page). For any other request, email privacy@barter.game. We may need to verify your identity before acting. You also have the right to complain to your local data protection authority.

International data transfers

We store and process Personal Data in the United States, where our hosting and analytics providers operate. When we transfer Personal Data from the EEA, UK, or Switzerland to countries not recognized as adequate by the European Commission, we rely on the standard contractual clauses under Commission Implementing Decision 2021/914.

Security and retention

We use appropriate technical and organizational controls: bank private keys are encrypted with AWS KMS and exist in plaintext only in memory; storage buckets are private and served only through our CDN; API mutations require authenticated requests and are owner-checked. We retain Personal Data for as long as your account is active and as needed to meet legal obligations, resolve disputes, and enforce agreements.

Children

The Services are not intended for anyone under 16, and we do not knowingly collect Personal Data from children. If you believe a child has provided us Personal Data, contact privacy@barter.game.

Changes to this policy

We may revise this policy from time to time. For material changes, we will provide notice on this page at least 30 days before they take effect.

Contact

Questions or requests: privacy@barter.game.