Privacy policy

Last updated: 23 September 2026

This policy explains what personal data we process in the ComicSwap mobile app and on the comicswap.app website, for what purpose, for how long, and what you can do about it. It has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is the data controller

• Controller: Alberto Rodríguez Vázquez
• Spanish tax ID (NIF): 36080492R
• Address: Calle Tomás A. Alonso 193, 5.º G, 36208 Vigo (Pontevedra), Spain
• Contact email: soporte@comicswap.app

ComicSwap is a project developed by an individual. There is no company behind the app.

2. What data we process

2.1. Your account data

• Email address.
• Password. It is stored encrypted by Supabase's authentication service; we never have access to it.
• Username and, if you choose to add one, a profile picture.

2.2. Your collection data

• The comics you record: title, series, edition, issue number, publisher, language, condition and notes.
• The photos of your copies that you upload: the cover and, if you add them, condition photos (front and back).
• Your wish list.
• The copies you mark as available for sale or swap.
• The files you import from other apps or from your own spreadsheets, and their content.

2.3. Data derived from social use

• The expressions of interest you send and receive, and the resulting matches.
• The messages you exchange with other users through the chat.
• The contact ratings you give and receive.
• The reports and blocks you make.
• Your points balance within the app.

2.4. Technical data

• Device identifier and push notification token, if you enable notifications.
• Logs of app usage events, used to detect errors and produce aggregate statistics.

2.5. Camera

The app asks for access to the camera and the photo gallery to scan ISBN codes and photograph your copies. The photos you take of a cover or of a comic's condition are saved in that comic's record and, when you use the identification or valuation features, they are sent to the artificial intelligence provider described in section 2.7 for analysis. They are not used for any other purpose.

2.6. Payment data

You can subscribe to Premium in the app, through Google Play, or on the website, through the payment page of RevenueCat and Stripe. In both cases the payment is processed directly by the provider: we do not receive, see or store any bank card data.

2.7. Artificial intelligence features

ComicSwap includes several features based on artificial intelligence: the conversational assistant (ComicBot), the query agent, identifying comics from their cover, valuation from photos of their condition, and automatic completion of records (synopsis and missing details). When you use them, the text you write and the cover or condition photos you analyse are sent to Anthropic, the model provider, which processes them on our behalf for the sole purpose of generating the response. When completing records, only data about the comic is sent, never data about you.

Anthropic does not use that content to train its models, according to its commercial terms.

Even so, we recommend not writing unnecessary personal data in those conversations: the assistant is there to talk about comics.

Your conversations with the assistant are saved in your account so that you can look back at them, and they are deleted together with it. We only access their content when it is essential to resolve an issue you report to us or to investigate abusive use of the service.

3. For what purpose and on what legal basis

4. What we do not do

It is worth saying explicitly, because it defines the limits of our responsibility:

• We do not sell your data or pass it on to third parties for advertising or commercial purposes.
• We do not show advertising based on your profile.
• We do not take part in agreements between users. ComicSwap makes contact possible, but price, payment, shipping and delivery are agreed and carried out directly between the people involved, outside the app and under their own responsibility.
• We do not process users' bank details or postal addresses, precisely because we do not handle payments or shipments between users.
• We do not make automated decisions that produce legal effects on you, nor do we subject you to profiling with that scope. Moderation decisions (removing content, restricting or closing an account) are always reviewed by a person.

5. Who else has access to your data

5.1. Providers acting as data processors

• Supabase: database infrastructure, authentication, storage and server functions. This is where your account and collection information is kept.
• Hostinger: hosting of the comicswap.app website.
• Anthropic: provider of the artificial intelligence model behind the features described in section 2.7. It processes the text of your queries and the photos you analyse on our behalf and in accordance with its Data Processing Addendum, and does not use them to train its models.
• RevenueCat: management of your Premium subscription status and, for purchases made on the website, of the payment page. It receives a user identifier, the purchase data (product and start, renewal and cancellation dates) and, if you pay on the website, the email address you give when paying. It does not receive your card details.
• Expo: push notification delivery service. It receives your device token and the content of each notification.

5.2. Independent controllers

• Google Play: distribution of the app and collection of payment for Premium subscriptions taken out in the app. Google processes your account and payment data as a controller in its own right, in accordance with its privacy policy.
• Stripe: processing of payments for subscriptions taken out on the website. Stripe processes payment data as a controller in its own right, in accordance with its privacy policy.

5.3. External services consulted to identify and value comics

To retrieve records, covers, synopses and price references we consult the following sources: Biblioteca Nacional de España, Bibliothèque nationale de France, DILVE, Google Books, Open Library, Comic Vine and ISBNdb (bibliographic data); Brave Search (cover image search); eBay and Google Programmable Search (price references on second-hand markets); and Frankfurter (currency exchange rates).

These services only receive information about the comic (title, ISBN, publisher, series or issue number), never data that could identify you.

5.4. Other ComicSwap users

The rest of the community can see: your username, your profile picture if you have added one, the copies you mark for sale or swap, and the positive ratings you receive. Your email address and the rest of your collection are not shown.

5.5. Legal obligation

We may disclose data to judges, courts, law enforcement agencies or public administrations when a law requires us to do so.

6. Where your data is processed

Your account, your collection, your wish list and your conversations are stored on Supabase infrastructure, on servers located in Frankfurt (Germany), within the European Union. The comicswap.app website is hosted by Hostinger.

The external services we consult to identify comics receive only data about the copy (title, ISBN, publisher, series or issue number), never information that could identify you, so consulting them does not involve any transfer of personal data.

The text and photos you send to the artificial intelligence features are processed on the infrastructure of Anthropic, a company established in the United States. The same applies to the notification token processed by Expo and to the subscription data processed by RevenueCat, both established in the United States. These transfers are governed by the Standard Contractual Clauses approved by the European Commission, included in each provider's data processing agreement.

The distribution of the app and the collection of subscription payments are handled by Google Play and, on the website, by Stripe, which may process data outside the European Economic Area. Those transfers are covered by the Standard Contractual Clauses approved by the European Commission or by an adequacy decision. You can ask us for information about the safeguards applied by writing to soporte@comicswap.app.

7. How long we keep your data

• While your account is active, we keep your profile, your collection and your activity.
• Conversations with ComicBot are saved in your account so that you can look back at them, and are deleted together with it.
• When you delete your account, the data is erased within a maximum of 30 days, except for the exceptions described on the Delete account page.
• Messages sent to other users: they may remain visible in the other person's inbox after you delete your account, as happens with an email already sent, but without your name or your profile.
• Reports, blocks and moderation records: up to 12 months from their resolution, on the basis of our legitimate interest in the safety of the community. When the account is deleted, your identity in those records is replaced by an encrypted fingerprint that does not allow your email address to be recovered.
• Tax records for subscriptions: the period required by tax law, currently 4 to 6 years.
• Technical logs: 12 months.

8. Your rights

You can exercise the following rights at any time:

• Access: find out what data about you we process.
• Rectification: correct any data that is inaccurate.
• Erasure: ask us to delete it.
• Restriction: ask us to suspend its use while a complaint is being resolved.
• Objection: object to processing based on legitimate interest.
• Portability: receive your collection in a structured, commonly used format. You can download it yourself as a CSV file from Perfil → Importar y exportar (Profile → Import and export), without needing to write to us.
• Withdraw any consent you have given, without affecting the lawfulness of the processing carried out before.

To exercise them, write to soporte@comicswap.app stating the right you wish to exercise, from the email address linked to your account. We will reply within one month at the latest.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es) or with the data protection authority of the country where you live.

9. How to delete your account

You can delete your account and all your data at any time. The instructions are set out on the Delete account page.

10. Minimum age

ComicSwap includes features for communication between users. For that reason, use of the app is restricted to people over 16. If we detect an account belonging to someone under that age, we will delete it.

11. Security

We apply reasonable technical and organisational measures to protect your information: encrypted communications, passwords stored using irreversible derivation functions, access control to the database through row-level policies, and limiting access to data to the minimum needed to run the service.

No system is infallible. If a security breach occurred that posed a risk to your rights, we would inform you and notify the supervisory authority in accordance with Articles 33 and 34 of the GDPR.

12. Website and cookies

The comicswap.app website does not use analytics or advertising cookies, and does not install non-essential cookies in your browser. If we add any in the future, we will say so here and ask for your consent before installing them. If you write to us through the contact form or subscribe to the newsletter, we will use your email address only to reply to you or send it to you, and you can unsubscribe at any time.

Web importer. The "Importar colección" (Import collection) page lets you upload, from your computer, a file exported from another platform. To do so, you log in with your ComicSwap account: your email and password are sent directly to Supabase, never to the website's server, which neither receives nor stores them. The session is kept in your browser's local storage until you log out, and the file you upload is processed on our Supabase infrastructure and added to your account just as if you had imported it from the app. The website loads the Supabase library from the jsDelivr content delivery network and fonts from Google Fonts; those servers receive your IP address when serving the files, and no other data.

13. Changes to this policy

If we change this policy, we will publish the new version at this same address and update the date at the top. When the change is substantial, we will let you know within the app.