Privacy policy

1. Who we are

Swapply ("we") operates swapply.app. We are the data controller for the data described here. Contact: contact@swapply.app.

2. Visitors: people who see the card

If you are using an app that includes the Swapply widget, this is everything that happens:

• One request from your browser to swapply.app/api/widget carrying the member's widget key. Like any web request, it includes your IP address and browser user-agent.
• A daily visitor hash. We compute a one-way SHA-256 hash of IP address + user-agent + today's date and store only its first 20 characters for 24 hours. Its sole purpose is to count one impression per visitor per host app per day. It cannot be reversed into your IP, and it changes every day.
• Click id. If you click a card, we generate a random id, store it with the two app ids for 7 days, and forward you to the app with ?ref=swapply&sw=<id>. If that app uses our optional conversion script and you sign up there, it reports the id back so the app owner can see "1 signup". We never learn who signed up.
• Browser storage. The widget stores the list of apps it received in sessionStorage for 10 minutes, and, for the floating layout, a "dismissed" timestamp in localStorage for 1 hour. The conversion script stores the click id in localStorage for 7 days. These are on your device only and are not cookies.

We do not set cookies, run fingerprinting, load third-party scripts, read anything from the host page, or build profiles of visitors. We do not know your name, email, or anything about you beyond the daily hash above. Aggregated counts (impressions, clicks, signups per day) are kept indefinitely; they contain no per-person data.

Legal basis (UK/EU GDPR): legitimate interest in operating a fair, fraud-resistant exchange with the minimum data possible. You can object by emailing us, though in practice there is nothing identifying to remove after 24 hours.

3. Members: founders and teams with an account

What we collect

• Account: email address (required to log in, one account per email), display name and avatar if provided by Google or X, your X username if you sign in with X.
• Sign-in provider ids: your Google account id or X user id, so later logins resolve to the same account. We do not receive or store your passwords; we never post on your behalf.
• Your apps: name, tagline, URL, logo URL, category, block list, status, widget key.
• Usage statistics: daily counts of impressions given/received, clicks, conversions, credit movements, and which member apps sent you clicks.
• Payments: if you buy credits, Stripe processes the payment. We receive the Stripe session id, amount, and the pack purchased. We never see your card number.
• Email we send: sign-in links (via Resend) and, rarely, messages about your app's review status. No marketing email without opt-in.
• Security logs: rate-limit counters for sign-in links (per email and per IP, 1 hour).

Why

To run your account, serve and measure the widget, keep the credit ledger honest, prevent abuse, and process purchases. Legal basis: performance of our contract with you, plus legitimate interest for abuse prevention.

How long

Account and app data: until you delete your app or ask us to delete your account. Daily statistics: up to 400 days. Sign-in links: 15 minutes. OAuth state: 10 minutes. Payment records: as required by tax law (typically 6 years).

4. Who else sees data

• Other members see your app's public listing (name, tagline, logo, URL, category) in widgets and the directory, and the number of clicks their app sent to yours. They never see your email or your users.
• Processors acting on our instructions: our hosting provider, our Redis database provider, Stripe (payments), Resend (email), Google and X (sign-in, only if you use them). Each is bound by a data processing agreement.
• Nobody else. We do not sell, rent, or share personal data with advertisers or data brokers, and we do not share visitor data with members beyond the aggregate counts.

5. International transfers

Our providers may process data outside the UK/EEA. Where they do, transfers rely on standard contractual clauses or an adequacy decision.

6. Your rights

You can access, correct, export, or delete your data, object to processing, or complain to your supervisory authority (in the UK, the ICO). Most of this you can do from your dashboard; for anything else email contact@swapply.app and we will respond within 30 days.

7. Security

Data in transit is encrypted (TLS). Sessions are signed tokens in HttpOnly, SameSite cookies. Widget click links are signed so they cannot be forged. We never store passwords. If we ever have a breach affecting you, we will tell you without undue delay.

8. Children

Swapply is for people running software products; it is not directed at children under 16 and we do not knowingly collect their data.

9. Changes

If we change this policy materially we will email members and update the date above. The current version always lives at swapply.app/privacy.