Privacy Policy
Last updated: October 4, 2026 · Version 2.9
Your privacy controls: Do Not Sell or Share My Personal Information · Download my data · Delete my account
This Privacy Policy describes how YardSwaps LLC (“YardSwaps,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our mobile application, website, and related services (the “Platform”). We practice data minimization: we collect only what is needed to operate the Platform and measure how it is used (see Sections 2 and 3), never sell personal information, and never use the Platform to track you across third-party sites.
YardSwaps is a neutral marketplace. We do not handle, escrow, transmit, or guarantee payments between buyers and sellers (the only exception is Boost listing fees, YardSwaps Pro subscriptions, and dealer subscriptions, which are processed by Stripe — see Section 1). We do not act as a marketplace facilitator for sales tax purposes, and we are not a party to any transaction between users. Listings, messages, and transactions are between users; we provide only the software.
1. Information We Collect
Information you provide: Name, email address, and password when creating an account. Optional profile fields (profile photo, location, phone number, business name, bio). Listing data including photos, descriptions, pricing, and equipment specifications. Messages exchanged with other users. Payment information is handled entirely by Stripe— we never see, store, or have access to credit card numbers, bank accounts, or other payment instruments.
Age verification: At signup we ask for your date of birth solely to confirm you are at least 18 years old (see Section 11). We do notstore the birthdate; we validate the age gate and discard the value. Per CPRA §1798.140(ae) and equivalent state laws, we do not treat dates of birth as “sensitive personal information” because we never retain them.
Consent records:When you check the Terms-of-Service and Privacy-Policy consent boxes at signup, we record a timestamped “consent_recorded” event containing the time, your IP address, and your user agent. This creates an audit trail for Data Subject Access Requests and defends against later disputes about whether consent was given. The record is stored in our first-party analytics table and never shared.
First-party usage records:When you search on YardSwaps, we log the search words, the category, the number of results, and whether you used the app or the website, with your account ID when you are signed in, to measure what buyers look for. Search logs are deleted after 90 days. We also keep one “active today” record per signed-in account per day, for about 13 months, for usage statistics. IP addresses are not stored with either, both stay in our own database and are never shared, and both are deleted when you delete your account. When you open a listing we count one view per person per day toward its view count: signed in, we record the listing and date with your account ID; signed out, we count the visit without a cookie, using codes made from your IP address and browser type that change every day and are kept for at most 24 hours, so they can’t be traced back to you. Sellers see only totals, never who viewed, and view records are deleted after 180 days.
Information collected automatically:IP address (our servers use it only for rate-limiting, abuse detection, and security, and do not retain it beyond what crash logs and access logs require; on the website, HeyCatch also receives it and may use it to estimate your general location, see Section 3). Referral fraud check: when you create an account we keep a one-way, keyed code made from the network you signed up from (your IP address, or the first half of an IPv6 address) and, in the app, the device’s app identifier (iOS identifier for vendor, Android ID; not the advertising ID). We never store the IP address or the identifier itself, and we use the code only to withhold invite rewards when a new account shares the inviter’s device or network. It is deleted with your account. Deleted-account check: when an account is deleted we keep a one-way, keyed code made from its verified phone number, if it had one, for 30 days. If the account was suspended, or had open reports or scam warnings on its messages when it was deleted, we keep such a code for its email address and verified phone number for 1 year instead. We never keep the email address or number itself, the code isn’t linked to any other data, and we only ever compare it with the code made from an email or number someone signs up or verifies with. We use it only to stop that number from verifying another account and, in the second case, that email from opening a new account (by email, Google or Apple) until then, so a deleted account can’t simply be re-created to shed a suspension or reports. Device type and operating system (from crash reports). Search radius and location preferences (stored only in your browser’s local storage, not on our servers). On the website, HeyCatch records how every visitor uses the site, such as the pages you view, what you click, device and browser details, and, once you sign in, your account ID, email address, name, plan, and sign-up date; this does not depend on the cookie banner or any opt-out setting (see Section 3). If you accept optional analytics on the website, PostHog also records how you use the site (see Section 3). Cloudflare, which delivers the website, also counts page views and measures page speed for every visitor, without cookies (see Section 3). On the website’s sign-up and phone-verification forms, Cloudflare Turnstile checks that you are a person and not a bot (see Section 3). We do not use third-party ad-tracking cookies or pixels. We do not collect precise GPS coordinates on the web; the mobile app collects them only with your explicit permission and stores them on your device for search-radius use.
Information from third parties: When you sign in with Google, we receive your name, email address, and profile photo. When you sign in with Apple (iOS only), we receive your name and email (which may be an Apple private-relay address). We do not request additional permissions from these providers beyond what is shown on the sign-in screen.
What we do NOT collect:Social Security numbers, government ID numbers, bank account numbers, credit card numbers, health or fitness data, precise geolocation on the web, contacts, calendar entries, browsing history outside YardSwaps, audio recordings, biometric data, racial or ethnic origin, religious beliefs, union membership, sex life or sexual orientation, citizenship or immigration status, mental or physical health information, children’s data, or the contents of emails or SMS sent outside the Platform.
“Sensitive Personal Information” (CPRA, TDPSA, OCPA, MTCDPA, NJDPA): We do not collect any of the categories listed as sensitive personal information under the California Privacy Rights Act or the equivalent state privacy laws. The mobile app collects precise geolocation with your explicit permission and stores it on your device only; it is not transmitted to or retained by YardSwaps servers, so it is not treated as “sensitive personal information” in the regulatory sense.
2. How We Use Your Information
We use your information only to: operate and maintain the Platform; let users find and message each other; display listings within your chosen search radius; process Boost listing fees, YardSwaps Pro subscriptions, and dealer subscriptions (via Stripe); send account-related notifications you have opted into; run automated content moderation on listings (see Section 9 on automated decision-making); measure how the Platform is used, through HeyCatch analytics on every website visit and for sign-ups, listings, Boosts, and subscriptions, and through optional PostHog analytics you can decline (Section 3); detect and prevent fraud, abuse, and policy violations; and comply with legal obligations. We do not use your information for cross-site advertising, audience-building, or profile sales to third parties.
Chat safety checks: We automatically check chat messages for common scam patterns (for example requests for wire transfers, gift cards, deposits or verification codes) and for payment-app names or contact details shared in the chat, to show safety warnings and to flag accounts for review. Messages are not blocked. A flag records the kind of pattern and which conversation and message it was in, not a copy of the message. An account flagged in several conversations within a day is shown to YardSwaps admins for review. These checks run in the app and on our own servers (no AI or outside service reads your messages for them), are used only for fraud prevention and safety, and are never used for advertising.
3. Information Sharing
We do not sell, rent, lease, or trade your personal information. We do not share your data with data brokers, ad networks, or analytics partners outside the limited service providers (sub-processors) listed below.
With other users: Your public profile (display name, optional avatar, optional approximate location, dealer status) and the listings you post are visible to other users. Messages are visible only to conversation participants. Your email address, phone number, precise location, date of birth, and account creation date are never shown to other users.
With service providers (sub-processors): We share only the minimum data needed for each provider to perform its narrow function. Each is bound by a written agreement to process data only for the purposes below:
• Stripe (payment processing) — receives your name, email, and payment instrument for Boost listings, YardSwaps Pro subscriptions, and dealer subscriptions. We never receive your card or bank details. Stripe retains transaction records for 7 years for tax-compliance purposes.
• Google(authentication) — used only if you choose “Continue with Google”. Receives no data from us after the initial OAuth handshake.
• Apple (authentication, iOS app only) — used only if you choose Sign in with Apple. Receives no data from us; we verify the Apple-issued identity token and create your account.
• Amazon Web Services S3 (object storage) — stores listing photos. AWS does not access photo contents; storage is private and proxied through our servers with path-validation to prevent unauthorized access. We strip EXIF metadata from uploaded photos before storage, so embedded GPS coordinates in your camera roll are removed.
• Resend (transactional + marketing email) — receives recipient email addresses and message bodies for: account verification, password reset, message notifications, order updates, and any marketing emails you have not unsubscribed from. We maintain a suppression list to honor unsubscribes and bounces across all campaigns. Delivery logs are retained for 90 days.
• Twilio(text messages and phone checks): when you verify your phone number, in the app or on the website, we send it to Twilio to deliver a one-time code by text message. Before sending, Twilio may tell us the type of line (mobile, landline, internet or VoIP, and so on), its carrier and its country, so we can refuse numbers that can’t be verified. We use that answer only for that check and don’t store it.
• Anthropic Claude(AI listing help, price guidance, spec lookup and moderation) — when you add the first photos to a new listing on the Sell screen, those photos (up to 5) are sent to Anthropic automatically so the AI can fill in the listing details; this happens whenever AI scanning is available on your account, not only when you tap a button. When you tap Regenerate, the details you have entered (title, category, condition, brand, model, part number, year, hours, mileage, specs and description) are sent to write a description; no photos are sent. Listing details (title, category, condition, brand, model, part number, year, hours, mileage, specs and description, with the asking and sale prices of similar YardSwaps listings) may be sent to estimate a price range when there aren’t enough similar listings, and the brand, model, category and title are sent to look up the manufacturer’s spec sheet. When you submit a listing, its title, category, price and description are sent for content moderation to check for prohibited categories. Anthropic processes these requests under their data processing agreement and does not use them to train models. See Section 9 for opt-out rights on automated processing.
• Expo Push Service(mobile push notifications) — when you enable push notifications in the YardSwaps mobile app, the device push token and notification payload (title, body, deep-link URL) are sent through Expo’s push relay to Apple Push Notification Service (APNs) for iOS or Firebase Cloud Messaging (FCM) for Android.
• Web Push (VAPID)(browser notifications) — when you enable browser push, the notification payload is signed with our VAPID keys and sent directly to your browser’s push endpoint. No third-party relay.
• Sentry (error tracking) — receives crash reports and diagnostic stack traces. On the website it also records a replay of about 1 in 10 visits, and of any visit where an error occurs, with all text, form inputs, and images masked. We have configured Sentry with a beforeSend hook that strips Authorization headers, cookies, request bodies, sensitive query parameters (tokens, codes, passwords), email addresses, and IP addresses from every crash report and performance trace before it is transmitted; replays are masked as described above instead. User identifiers are reduced to an opaque ID. Crash data is retained for 30 days.
• PostHog (optional product analytics): our PostHog analytics receives event data tied to a random analytics ID (which pages you visit, which features you use, and what you click) only if you accept analytics (on the cookie banner, or by turning analytics on later) and have not opted out. We do not send it your account ID, so these events are not tied to your account. You can opt out at any time at /do-not-sell-or-share, and we automatically honor the Global Privacy Control (GPC) signal sent by browsers like Firefox, Brave, and DuckDuckGo. Analytics data is retained for 90 days.
• HeyCatch (product analytics): runs on every page of the website for every visitor. It is not controlled by the cookie banner, the analytics opt-out at /do-not-sell-or-share or in account settings, or Global Privacy Control: it runs whether you accept, decline, or ignore the banner. On the website it receives the pages you view (the page address, including any search words in it, and the page title, which can include a listing title or a seller’s public name, yours included if you sell), what you click (including the words and link address of the button or link, but never what you type into a form), how long you stay on a page and how far you scroll, device and browser details (such as browser, operating system, and screen size), and the link that referred you. Like any server your browser contacts, HeyCatch sees your IP address, and it may use it to estimate your general location. Once you sign in on the website, it also receives your account ID, email address, name, plan, and sign-up date, so your visits are linked to your account; when you sign out, the website starts a new anonymous visitor ID, although a separate random device ID stays the same until you clear this site’s data in your browser. Clicks on private content, such as your messages, offers, notifications, the personal details and billing plan in your account settings, and profile photos, are not recorded, although HeyCatch still sees that you opened those pages. HeyCatch does not start while a page address carries a one-time code from a password-reset, sign-in, or verification link; it waits until the code has been removed from the address. Its session recording is switched off. Your browser sends this data to in.heycatch.ai and loads HeyCatch helper scripts from there, one of which tags the requests your browser makes to our own servers with its visitor and session IDs.
Our servers also tell HeyCatch when you complete sign-up, publish a listing, buy a Boost, or start a subscription, with your account ID and details of the event (how you signed up, the listing’s category, the Boost tier, or the plan and whether it started with a free trial, and whether it happened on the website or in the app). At sign-up they also send your email address, name, and sign-up date, and your plan when a subscription starts or ends. These reports come from our servers, not your device, so they do not carry your IP address, and they cover the same actions in the YardSwaps mobile app, because the app uses the same servers. From app version 1.0.82 the mobile app also runs HeyCatch itself: it records the screens you open, taps (not inside chat, messages, offers, orders or your account screens, and never what you type), app opens and closes, an install ID the app creates, your device model, operating system, app version, language and time zone, and once you sign in links them to your account ID, email address, name, sign-up date and plan. We never send HeyCatch your phone number, your password, or the contents of your messages. To object to HeyCatch analytics, or to ask us to delete the HeyCatch data linked to you, email privacy@yardswaps.com.
• Cloudflare (website delivery and security): every request to the website passes through Cloudflare, which sees your IP address and the request itself. Cloudflare also adds its Web Analytics script to our web pages, which reports the pages you view, the page that referred you, your browser and device type, and how fast pages load. It uses no cookies or browser storage and runs for every visitor, so neither the analytics opt-out nor GPC turns it off.
• Cloudflare Turnstile(bot check, website only): on the sign-up form and the phone-verification form, Cloudflare’s Turnstile check runs in your browser to tell people from automated bots. It uses signals such as your IP address, your browser (user agent and connection details) and device characteristics. Under its Turnstile privacy terms, Cloudflare uses them to run the check and to improve its bot detection, not to identify, profile or advertise to you or to track you across sites.
• Redis (cache, rate-limit, OAuth state) — stores short-lived security tokens (typically 2 minutes to 1 hour) for sign-in flows and rate-limit counters. No durable personal data is stored here.
• Apollo (lead sourcing for outreach) — we pullbusiness contact information from Apollo’s database for cold-outreach marketing campaigns. We do not push your personal data to Apollo. If you receive a cold-outreach email and reply STOP or click unsubscribe, we add you to our suppression list and you will receive no further messages.
• SORO (hosted blog) — publishes the articles on /blog. Those posts live on SORO’s servers, and your browser loads them directly from app.trysoro.com, so for that one page view SORO can see your IP address, your browser user agent, and the page you came from. No account data, email address, listing, or message is ever sent to SORO, and the blog is the only page on this site that loads SORO’s script.
Legal requirements: We may disclose information when required by valid legal process (subpoena, court order, search warrant) or when we believe disclosure is necessary to protect the rights, property, or safety of YardSwaps, our users, or the public. We will notify you of any such request unless legally prohibited.
4. Data Retention
We retain your account data for as long as your account is active. If you delete your account (see Section 7), we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, tax, or regulatory purposes, and except the deleted-account code described in Section 1, which we keep for fraud prevention and security. Backup copies may persist for up to 90 days after deletion. Deleting your account does not automatically delete the analytics HeyCatch holds about you (Section 3); email privacy@yardswaps.com and we will ask HeyCatch to delete it.
Our own usage records:search logs — 90 days; daily “active” records — about 13 months; listing view records — 180 days; deleted-account codes — 30 days after deletion, or 1 year after a deletion with a suspension, open reports or scam warnings (Section 1).
Third-party retention periods:
• Sentry crash logs — 30 days
• PostHog analytics events — 90 days
• HeyCatch analytics: kept under HeyCatch’s own retention terms, and deleted for you when you ask us at privacy@yardswaps.com
• Resend email-delivery logs — 90 days
• Stripe transaction records — 7 years (for tax compliance, retained by Stripe)
• Cloud-stored photos — deleted with the listing they belong to
• Server logs (Railway) — 30 days
If you delete a chat message, the other person sees “Message deleted”, and we keep its text for up to 90 days so reports can be reviewed, then erase it.
Listings and messages may be retained in anonymized form (with all personal identifiers removed) for platform analytics and fraud-pattern detection.
5. Data Security
We use industry-standard security measures including:
• HTTPS encryption for all data in transit (HSTS enforced)
• Bcrypt password hashing (10 rounds); password recovery only through a link emailed to your address
• HTTP-only secure cookies for session management; encrypted SecureStore on mobile
• Token versioning so a password change immediately logs out every other session
• Per-account login lockout (10 failures / 15 minutes) and per-IP rate limiting
• Server-Side Request Forgery (SSRF) prevention on every image URL we process
• Content Security Policy (CSP) headers on every response; CSP violation reports go to an internal endpoint
• Cryptographic signature verification on all incoming webhooks (Stripe, Resend)
• Access controls limiting employee access to personal data on a strict need-to-know basis
No system is 100% secure, and we cannot guarantee absolute security. We will notify affected users in accordance with applicable state breach-notification laws if a breach occurs.
6. Cookies and Local Storage
We set only first-party cookies. Apart from the HeyCatch analytics cookie described below, none of them is shared with third parties:
• Session (token): keeps you signed in. HTTP-only, lasts up to 30 days, and is deleted when you sign out.
• Sign-in security (oauth_state, oauth_consent): short-lived (10 minutes) HTTP-only cookies set during Google sign-in to prevent cross-site request forgery.
• Referral (ys_ref): set when you open a friend’s invite link, so they can be credited if you sign up. HTTP-only, 30 days.
• App sign-in device (ys_dev): set only when the app starts Google sign-in, to carry the device’s app identifier to the new account’s referral fraud check (stored only as a one-way code). HTTP-only, 10 minutes, cleared at signup.
• Marketing attribution (ys_attr_*, ys_anon_id): set the first time you arrive from one of our marketing emails, recording which email brought you here and a random visit ID so we can measure which channels work. HTTP-only, 30 days.
Referral and marketing-attribution cookies are deleted once you create an account.
• Website analytics (ph_phc_oiDt…_posthog): set by HeyCatch (Section 3) when you visit the website, for every visitor. It does not wait for the cookie banner, and declining, the analytics opt-out, and GPC do not remove it. It holds a random visitor ID (and, once you sign in, your account ID), a session ID, whether you are signed in, and the address and referrer of the first page you viewed, which your browser sends to HeyCatch with its analytics events, and lasts up to a year. HeyCatch keeps the same data in local storage under the same name, together with its own settings and, once you sign in, the email address, name, plan, and sign-up date it was sent, plus short-lived session-storage entries whose names start with ph_phc_oiDt. Signing out clears your account details from these entries and starts a new random visitor ID; the random device ID they also hold stays until you delete them. You can delete them in your browser settings, but HeyCatch sets them again on your next visit.
We do not use third-party tracking cookies, ad cookies or conversion pixels, and we do not use browser fingerprinting to identify, track or advertise to you.The Cloudflare Turnstile bot check on the website’s sign-up and phone-verification forms uses browser and device signals only to tell people from bots and to improve that bot detection, not for advertising or tracking (Section 3); the analytics and error-reporting tools in Section 3 receive browser and device details as described there. The only session replays are Sentry’s masked replays (Section 3); HeyCatch and PostHog session recording are switched off. We use browser local storage to save your preferences (search radius, location, theme), your recently viewed items and recent searches, an unfinished listing draft, which tips and banners you have dismissed, your cookie-banner choice, an “analytics opt-out” flag if you have opted out of PostHog analytics, and, once you sign in, the account ID this browser last reported to HeyCatch (so a sign-out elsewhere also resets HeyCatch here). PostHog analytics are optional and are not loaded until you accept them on the cookie banner or turn analytics on later; if you do, PostHog keeps a random analytics ID in local storage, which declining or opting out deletes. HeyCatch analytics are not optional on the website: HeyCatch keeps its ID in the website-analytics cookie and storage entries listed above whatever you choose on the banner. You can clear local storage through your browser settings without affecting your account.
Global Privacy Control (GPC): We automatically honor the Global Privacy Control signal sent by privacy-respecting browsers. If your browser sends GPC, we treat it as your request to opt out of any sale or sharing of your personal information (which we do not do in any case), we will not load PostHog analytics at all on your visits, regardless of whether you have set the opt-out flag, and we do not set the marketing-attribution cookies. GPC does not turn off HeyCatch analytics, which runs for every visitor (Section 3).
7. Your Rights and Choices
Access and update: View and update your account information at any time from your profile settings.
Download your data (right to portability): Get a full JSON copy of every record we hold about you at /api/auth/export (must be signed in). The export includes your profile, listings, saved items, offers, orders, ratings, notifications, push subscriptions, and conversation history. Other users’ identities and message contents are masked to protect their privacy. It does not include the analytics HeyCatch holds about you; email privacy@yardswaps.com for a copy.
Delete your account: From Account → Privacy & data → Delete account (or Settings → Delete account in the app) you can permanently delete your account. If your account has a password, we ask you to re-enter it to confirm. If you sign in with Apple or Google, we email you a single-use confirmation link that works for 24 hours instead. An account with order history must be closed through support@yardswaps.com, because those financial records are kept. Deletion cascades through every record in our database for you (listings, messages, ratings, push subscriptions, etc.). HeyCatch analytics are deleted only on request to privacy@yardswaps.com. For 30 days after deletion, a phone number verified on the account can’t verify another account (1 year, together with the email address, when the account was suspended or had open reports or scam warnings); we keep only a one-way code for this (Section 1). See Section 4 for retention windows.
Opt out of PostHog analytics and data sharing: Visit /do-not-sell-or-share to globally disable PostHog analytics from this browser and record your opt-out of any sale or sharing of your personal information. We also automatically honor your browser’s Global Privacy Control signal for both. Neither setting turns off HeyCatch analytics on the website (Section 3); to object to HeyCatch analytics, or to ask us to delete the HeyCatch data linked to you, email privacy@yardswaps.com.
Location data: You can deny location permission or enter a manual location. The Platform works fully with manually entered locations.
Push notifications: Opt out at any time through your device or browser settings, or by toggling Push Notifications off in account settings.
Marketing emails: Every marketing email includes a one-click unsubscribe link. You can also email privacy@yardswaps.com to opt out. Transactional emails (password reset, security alerts, order updates) continue to be sent because they are required to operate your account.
8. California Privacy Rights (CCPA / CPRA)
If you are a California resident, you have these rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):
• Right to know — what personal information we collect, use, and share
• Right to delete — request deletion of your personal information
• Right to correct — request correction of inaccurate information
• Right to opt out of sale or sharing — we do not sell or share for cross-context behavioral advertising; the mechanism is at /do-not-sell-or-share
• Right to opt out of automated decision-making — see Section 9
• Right to limit use of sensitive personal information — we do not collect any sensitive personal information (Section 1)
• Right to non-discrimination — we will not discriminate against you for exercising these rights
Global Privacy Control: We honor the GPC signal as your request to opt out of the sale or sharing of your personal information. If your browser sends GPC, we will not run our PostHog analytics, regardless of any other setting. GPC does not turn off HeyCatch analytics, which runs for every website visitor (Section 3); you can object to it or request deletion of HeyCatch data at privacy@yardswaps.com.
To exercise these rights, contact privacy@yardswaps.com or use the self-service tools above. We will verify your identity and respond within 45 days. Authorized agents acting on your behalf must provide proof of authorization.
9. Other State Privacy Rights and Automated Decision-Making
Depending on where you live, you may have additional rights under state privacy laws including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Delaware (DPDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Tennessee (TIPA), Iowa (ICDPA), Minnesota (MNCDPA), Maryland (MDODPA), Kentucky (KCDPA), Rhode Island (RICDPA), and Florida (FDBR).
These laws generally give you the right to: (a) confirm whether we process your data and access it; (b) delete it; (c) correct inaccuracies; (d) obtain it in a portable format; and (e) opt out of the sale of personal data, processing for targeted advertising, or profiling that produces legal or similarly significant effects.
YardSwaps does not sell personal data, does not process data for targeted advertising, and does not run profiling that affects access to credit, employment, housing, education, insurance, or essential goods and services. The opt-out mechanism at /do-not-sell-or-share covers all of the above categories even though we do not actively engage in them.
Automated content moderation (AI):When you submit a listing, our system runs an automated check via Anthropic Claude to detect prohibited categories (consumer electronics, fashion, firearms, etc.). A listing may be auto-rejected or flagged for human review based on this check. This is not a “legal or similarly significant” decision under state-law definitions because (1) it only affects whether a single listing is posted, not your access to the Platform; (2) you can edit and resubmit; and (3) you can appeal by emailing support@yardswaps.com. We will not deny you essential goods or services based on automated processing.
How to exercise these rights: Email privacy@yardswaps.com with the right you wish to exercise and the state where you reside. We will respond within 45 days (extendable by 45 days under VCDPA, CPA, CTDPA, UCPA, DPDPA, and similar laws).
10. Email Communications and Marketing (CAN-SPAM)
YardSwaps complies with the federal CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and equivalent state laws for all commercial and transactional email.
Every marketing email from YardSwaps includes:
• An accurate, non-deceptive subject line
• A clear sender identity
• Our physical mailing address
• A working unsubscribe link with one-click opt-out (RFC 8058 List-Unsubscribe-Post)
• A reply-to address (hello@mail.yardswaps.com) that is monitored
Suppression list: When you unsubscribe, your address is added to a permanent suppression list that blocks future marketing sends. Hard bounces and spam complaints are also added automatically. Transactional emails (password reset, account security, order confirmation) continue to be sent because they are required to operate your account, but you can stop these by deleting your account.
Cold outreach: We send cold-outreach emails to business contacts sourced from Apollo as part of our growth efforts. These emails comply with CAN-SPAM and include the physical address, sender identity, and unsubscribe link required by law. If you receive a cold-outreach email and unsubscribe, you will not receive further marketing from YardSwaps.
SMS: We send text messages only to deliver the one-time code you request when you verify your phone number. These are transactional, never marketing; reply STOP to opt out. Message and data rates may apply.
Our physical address: YardSwaps LLC, 4717 Hondo Pass Dr PMB 3165, El Paso, TX 79904-1456
11. Children's Privacy and Age Gate
The Platform is restricted to users 18 years of age or older. At signup we require you to enter your date of birth, and we validate server-side that you are at least 18. We do not store the birthdate — we only use it to enforce the age gate, then discard the value.
We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 (Children’s Online Privacy Protection Act, “COPPA”). If we learn that we have collected information from a child under 18 despite the age gate, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at privacy@yardswaps.com.
We do not direct advertising to minors and we do not knowingly process data about minors for any purpose.
12. International Data Transfers
Our servers are located in the United States. If you access the Platform from outside the US, your information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer. We apply the same security protections regardless of where data originates. YardSwaps does not currently solicit users outside the United States and the Platform is designed for US-based equipment markets.
13. Marketplace Facilitator Status (Sales Tax)
YardSwaps is not a marketplace facilitator for sales-tax purposes in any state. We do not collect, remit, or report sales tax on listings or transactions between users. Sellers are solely responsible for collecting and remitting any applicable sales, use, excise, or other taxes, and for any required tax filings, licenses, or permits in the jurisdictions in which they operate.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will increment the version number at the top of this page and update the “Last updated” date on every change. We will notify you of material changes (new categories of data collected, new sub-processors, changes to your rights) through an in-app notice or email. Your continued use of the Platform after material changes take effect constitutes acceptance. We encourage you to review this policy periodically.
15. Contact Us
For privacy questions, data requests, or concerns:
Privacy team: privacy@yardswaps.com
Support: support@yardswaps.com
Web: yardswaps.com/contact
Mail: YardSwaps LLC, 4717 Hondo Pass Dr PMB 3165, El Paso, TX 79904-1456
We typically respond within 2 business days for general questions and within 45 days for formal Data Subject Access Requests.