Privacy Policy
Your privacy matters. SWIM collects only what we need, shares nothing we don’t have to, and respects your rights under US law and the EU’s GDPR.
1. Information We Collect
Section titled “1. Information We Collect”Account information: Name and email when you sign up. Google Sign-In provides name and email only.
Payment information: Processed by Stripe. SWIM receives a transaction record but never your card number.
Drop and MBO activity: We maintain a ledger of your Drop balance, transactions, and MBO claims. This is part of the service.
Usage data: We use two analytics and monitoring tools:
- Umami Analytics — privacy-respecting, no cookies, no cross-site tracking. Collects aggregate data only: page views, general device type, approximate country.
- PostHog — product analytics that may collect individual behavioral data (page paths, feature interactions, session recordings). PostHog is consent-gated — it does not load unless you accept analytics in the consent banner.
Error monitoring: We use Sentry to capture application errors and performance traces. Sentry may collect your browser type, operating system, the page you were on when an error occurred, and a portion of the error stack trace. Sentry is consent-gated — it does not load until you accept “Error Tracking” in the consent banner.
Communications: We retain correspondence if you contact us.
2. How We Use Your Information
Section titled “2. How We Use Your Information”- To provide the service: account access, Drop ledger, purchase processing
- To communicate: transactional emails via Resend (order confirmations, password resets, verification)
- To improve SWIM: aggregate analytics only — no individual profiling
- To comply with legal obligations: as required by law
We do not use your data for advertising. We do not sell, rent, or trade your personal information.
3. Who We Share Data With
Section titled “3. Who We Share Data With”| Recipient | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing | Name, email, transaction amount |
| Resend | Transactional email | Email address, email content |
| Merchants | Order and sale records | Name, email, and shipping address (physical goods only) |
| Neon (PostgreSQL) | Database hosting | All stored account data |
| Cloudflare | CDN, infrastructure, DDoS protection | IP addresses (standard traffic) |
| PostHog | Product analytics | Page paths, feature interactions, session data |
| Sentry | Error monitoring | Browser type, OS, error traces |
We do not share with advertisers, data brokers, or advertising networks. We do not sell personal information.
A note on order visibility: merchants see your real name and email for every order in their portal’s order and customer records — this is necessary for them to manage and fulfill sales. You can choose to have order-notification emails address you by your handle instead of your name, in your Profile settings. That preference affects emails only — it does not change what a merchant sees in their own portal.
4. Merchant Data
Section titled “4. Merchant Data”If you operate a Stream on SWIM:
- You are the data controller for your customers’ personal information
- SWIM processes it as your data processor
- You must have a lawful basis to collect your customers’ data
- You must maintain your own privacy policy for your customers
5. Cookies
Section titled “5. Cookies”- Session cookies: Required for login. Expire on browser close.
- No tracking cookies. No advertising cookies. No cross-site tracking.
Our consent banner manages cookie preferences.
6. Data Retention
Section titled “6. Data Retention”| Data type | Retention |
|---|---|
| Account data | Active + 90 days post-deletion |
| Transaction records | 7 years (legal/financial requirement) |
| Analytics | Aggregate only — no personal retention |
| Communications | 2 years |
7. Your Rights
Section titled “7. Your Rights”All users: access, correct, and delete your personal data (subject to legal retention requirements).
EU/EEA users (GDPR): also: data portability, restriction of processing, right to object, right to lodge a complaint with your national DPA, and right to withdraw consent.
California users (CCPA/CPRA): right to know, right to delete, right to correct, and right to opt out of sale or sharing. In the preceding 12 months, we have not sold or shared any personal information as defined under the CCPA/CPRA. A “Do Not Sell or Share My Personal Information” link is available in the footer of every page.
To exercise these rights: [email protected]
8. Data Security
Section titled “8. Data Security”Encrypted connections (TLS 1.2+), hashed passwords (bcrypt), database access controls, and secrets management. If a breach affects your data, we will notify you as required by law.
9. Children’s Privacy
Section titled “9. Children’s Privacy”SWIM is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact [email protected] — we will remove it promptly. Users must be at least 18 to create an account or open a Merchant Workspace.
10. International Transfers
Section titled “10. International Transfers”SWIM operates from the US. EU/EEA data may be transferred to the US under Standard Contractual Clauses (SCCs) approved by the European Commission.
11. Changes to This Policy
Section titled “11. Changes to This Policy”We will notify you of material changes at least 30 days before they take effect. The version number changes with every update.
12. Contact
Section titled “12. Contact”- Privacy inquiries: [email protected]
- GDPR requests: [email protected]
- Mail: SWIM Technology LLC · 1309 Coffeen Avenue STE 1200 · Sheridan, Wyoming 82801
Version 1.2.0 · Updated July 15, 2026