Overview
Infinite Swap is a trading game published by Squiz Software Pty Ltd. It's available as an iOS app, an Android app, and a web build at infiniteswap.app.
This policy explains what data we collect when you use it, why we collect it, and how it's handled. We've written it to be readable — not to obscure anything.
Most of this policy applies equally to all three front-ends. Where there are differences (for example, the iOS Keychain vs browser localStorage, or Apple's App Tracking Transparency vs browser cookie controls) the relevant section calls them out.
What We Collect
| Data | How | Why |
|---|---|---|
| Device identifier |
iOS: SHA-256 hash of your device's Android: SHA-256 hash of a random UUID generated on first launch and stored in Android's encrypted shared-preferences store. Web: a random UUID generated by your browser on first visit and stored in Only the hash (or UUID) is sent to our server — we never see your raw device ID. |
Creates a persistent pseudonymous player identity without requiring an account, so you can keep your collection and leaderboard position across sessions on the same device. |
| Auth token |
Returned by our server on registration and stored in the iOS Keychain, Android Keystore, or browser Only a SHA-256 hash of the token is stored server-side. |
Authenticates subsequent API requests as you. |
| Display name | Auto-assigned by our server (e.g. "Trader #4821") | Used on leaderboards |
| Game activity | Trades made, items collected, locations visited, game outcomes (wins, losses, challenges) | Game state persistence, leaderboards, and analytics |
| IP address | Captured with every API request and stored in our request log | Server security, abuse prevention, request logging |
| Ad-related data (iOS / Android only) | Collected by Google AdMob SDK (see below) | Displaying advertisements in-app |
We do not collect your name, email address, phone number, precise location, contacts, photos, or any other personal information.
Browser storage (web only). On the web build we use your browser's localStorage to remember your player identity, auth token, display name, and audio mute preference. We don't set first-party tracking cookies. These storage entries are strictly necessary for the game to function (your saved progress is keyed against the player identity), so they're set without a consent prompt under the "strictly necessary" exemption of the EU ePrivacy Directive and UK PECR. Clearing site data in your browser will reset your player identity and start you fresh.
Why We're Allowed To Collect This (Legal Basis)
Under the EU General Data Protection Regulation (GDPR) and UK GDPR, every kind of data processing has to have a "lawful basis." Here's ours:
- Performance of a contract (Art. 6(1)(b)) — for the device identifier, auth token, display name, and game activity. These are necessary to let you play the game and have your progress saved across sessions.
- Legitimate interest (Art. 6(1)(f)) — for IP-address logging in our request log (server security and abuse prevention).
- Apple App Tracking Transparency governs whether Google AdMob can personalise ads on iOS using cross-app data. You can change this at any time in Settings → Privacy & Security → Tracking.
Your Rights
Player identity is pseudonymous — we don't hold your name, email, or any contact information. If you want a copy of the game data we hold against your player record, or you want it deleted, email us at the address in the Contact section below from any email account, and include your in-game display name (for example, "Trader Hawk #4821") and roughly when you first played. We'll locate your record manually and respond within 30 days. Deletion removes your game state, journal, leaderboard entries, public wiki attribution (items you first discovered, trades you were involved in, your player profile page), and the pseudonymous identifier itself; if you reinstall or revisit and play again, you'll start as a brand-new player.
If you're in the European Economic Area, the United Kingdom, or Switzerland, you also have the rights of access, rectification, erasure, restriction, portability, and objection under GDPR / UK GDPR, and the right to lodge a complaint with your local supervisory authority (the Information Commissioner's Office in the UK, your national Data Protection Authority elsewhere in the EU/EEA).
Advertising (Google AdMob, iOS & Android only)
On iOS and Android, the app displays banner and interstitial ads served by Google AdMob. AdMob may collect device identifiers and usage data to serve and measure ads. This is governed by Google's Privacy Policy.
Where required by Apple's App Tracking Transparency framework, the app will request permission before allowing AdMob to use your data for personalised ad targeting. You can change this permission at any time in Settings → Privacy & Security → Tracking.
If you opt out of tracking, ads will still be shown but will not be personalised based on your activity across other apps.
The web build at infiniteswap.app does not currently display ads.
AI-Generated Content
Item names, descriptions, offers, and Sal the Appraiser's commentary are generated by OpenAI's language models. Your in-game state — the current item you hold and the character and location you're interacting with — is included in prompts so the generated content makes sense in context.
No personally identifiable information is sent in any prompt. The game has no field for you to type into and we don't send your name, email, or device identifier.
AI-generated content is moderated server-side. Content that slips through can be reported via the flag icon on any item in-app.
Data Storage & Retention
Game data is stored in a database hosted in Singapore. The web front-end is served from Cloudflare's global edge network. AI text generation is processed by OpenAI in the United States. AI image and voice generation runs on Squiz Software's own infrastructure. Server-side request logs (including IP address) are retained for up to 90 days. Game state, collection, and leaderboard data is retained for the life of the app, or until you ask us to delete it (see "Your Rights" above).
Third Parties
- OpenAI — text generation for items, characters, and Sal's appraisals (server-side; no user PII shared). Privacy Policy
- Cloudflare — web front-end delivery (Cloudflare Pages), CDN, and DDoS protection. Privacy Policy
- Google AdMob — advertising on iOS and Android only. Privacy Policy
- Apple App Store and Google Play Store — distribution of the iOS and Android apps. Their respective privacy policies apply when you download or update the app.
We do not sell, rent, or trade your data with any third party for marketing purposes.
Children
Infinite Swap is rated 12+ on the App Store. We do not knowingly collect data from children under 13. If you believe a child under 13 has used the app, contact us and we will take appropriate action.
Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the app after changes are published constitutes acceptance of the updated policy.
Contact
Questions, concerns, or requests related to this privacy policy:
Squiz Software Pty Ltd · ABN 42 693 384 735 · Perth, Western Australia