A privacy checklist for embedding third-party widgets
By the Swapply team · Last checked October 2026
Ten questions to ask before you put someone else's script in front of your users, with what a good answer looks like.
When you embed someone else's script, you vouch for it to your users. They don't see a third party; they see your app. So before you paste any widget, whether it's a chat bubble, an analytics tag or a cross-promotion card, it's worth ten minutes to know exactly what it does.
Ten questions to ask
- Does it set cookies? Ideally none. If it does, you should know their names, purpose and lifetime.
- What does it store about each visitor, and for how long? Look for a specific answer, such as "a hash for 24 hours", not "anonymous data".
- Does it load other scripts? Every extra script is another company in front of your users. The best answer is "no".
- Does it read anything from your page? It shouldn't need your page's content, form fields or user details to show a card.
- Is it isolated from your page? An iframe or Shadow DOM keeps its styles and scripts from clashing with yours.
- How big is it and how does it load? A few kilobytes, loaded asynchronously, so it can never block your page.
- Who decides what it shows? You should be able to restrict categories and block specific products.
- Is every product shown reviewed? Automated checks miss things. A human review is the strongest guarantee.
- What happens on a click? Tracking should be limited to attributing that click, with no profile built around it.
- Is there a privacy policy that names all of this? If the answers above aren't written down, they aren't commitments.
Verify it yourself
You don't have to take the vendor's word. Open your browser's developer tools on a page with the widget and check:
- Application → Cookies and Storage: anything new the widget wrote.
- Network: every request it makes, and to which domains.
- Elements: whether it renders inside a shadow root or iframe.
If what you see doesn't match the privacy policy, that tells you what you need to know.
How Swapply's widget answers
No cookies, no third-party scripts, nothing read from your page, rendered in a Shadow DOM, under 6 KB and loaded asynchronously. Per visitor it keeps a one-way hash of IP, user agent and date for 24 hours, to count one view a day, and on a click an anonymous click id for 7 days, to attribute a signup. Every app it shows has passed a human review. The details are in our privacy policy.
Comparing networks? Our cross-promotion network comparison covers who publishes what.
Questions people ask
Does a third-party widget need a cookie banner?⌄
It depends on what it stores and where your users are, so check with whoever handles your privacy compliance. A widget that sets no cookies and stores nothing on the device is far simpler to account for than one that does.
Can a widget read my page?⌄
A script you add to your page can technically read anything on it. That's why it matters what the vendor says it does, whether it renders in an isolated container like a Shadow DOM or an iframe, and whether you can see the code it loads.
Spotted something wrong or out of date? Email contact@swapply.app and we'll fix it.
More articles
Best cross-promotion networks for apps (2026)
CrossLynk, Ad Swap, Remora, EthicalAds Community Ads, SparkLoop and Swapply compared fairly: how each works, what it costs, and who each one actually suits.
Cross-promotion vs paid ads: which one fits a small app
When swapping audiences with other apps beats buying traffic, when it doesn't, and how to tell which stage you're at.
Where to place a cross-promotion widget in your app
Seven placements that get seen without getting in your users' way, and three that annoy people and earn nothing.
How credit-based ad exchanges work (and how to spot an unfair one)
Exchange ratios, network fees, bot filtering and matching: what to check before you trade impressions with strangers.
Try Swapply on your app
One script tag, a human review, 1,000 starter credits. Swapping is free; competitors can be blocked.
Add your app