Privacy Policy

Last updated 4 October 2026

This Privacy Policy explains how SKOTY (“swity”, “we”, “us”) collects and uses personal data when you use the swity app and the pages we host at swity.app. We are the data controller for that processing.

1. Who we are

• App author: SKOTY Tomasz Szykulski
• Aleje Jerozolimskie 109 lok. 70, 02-011 Warsaw, Poland
• NIP 5223382461 · REGON 545562954
• Privacy contact: privacy@swity.app

2. What we collect

• Account data: when you create an account with an email address we collect the name and email address you give us, and a password, which we store only as a hash and never in readable form. When you sign in with Apple instead we receive your name and email address (Apple may provide a private relay address). You choose a public handle, and we derive an approximate country from your device or App Store region. You may add optional profile details (role, location, bio, links, avatar).
• Sign-in check: from version 1.1 of the app, when you create an account, sign in, or reset or change your password with an email address, the app first runs Cloudflare Turnstile, an automatic check that a person and not a script is making the request. For that check Cloudflare receives your device’s IP address and basic technical information about the device and its browser. We use the result only to stop scripts from abusing these steps.
• Your email preferences: which kinds of email you have switched off, the language you use the app in, and, if you gave it, the moment you agreed to hear about what is new. Withdrawing that agreement removes the record of it.
• Interest list: if you leave your email address on our website to hear when swity opens up, we keep that address for that purpose only. It is deleted once we have written to you about access, or sooner if you ask.
• Content you publish: the photos, text and project details you upload. Published pages are public and can be viewed by anyone with the link.
• Usage & analytics: scans and views of your pages, coarse country derived from IP (not stored as a full IP), a rotating non-identifying visitor hash used only to de-duplicate counts, and basic technical logs.
• How the app is used: a small, fixed set of signals from the app itself, such as how far you got in first-time setup, when the plans screen was opened and which screen led there, and when publishing failed (with a short reason such as “network”, never your content or file names). We use these to fix what is confusing or broken. They are tied to your account, kept for six months, never shared, and are not used to build a profile of you or to follow you anywhere else.
• Website analytics: for the pages we run ourselves, we count visits using Vercel Web Analytics: which page was opened, where the visit came from, an approximate country, and the type of device. It is measured at our host’s edge and is cookieless: no cookie, no data stored on your device, and no identifier that could follow you to another website. We cannot tell who you are from it. We also keep our own count of visits to those pages: the page, where the visit came from, an approximate country worked out on our server, and a visitor code that changes every day and is used only to tell a repeat visit from a new one. No cookie is set and no full IP address is stored.
• Appreciate: if you tap the heart on a published page, your browser creates a random code for itself and keeps it, with the list of pages you appreciated, in its local storage. The code is sent with the tap so that each person counts once. It is not linked to an account. We also keep the code on our server, with the pages it appreciated and when it was last used, only so that each person counts once; taking a heart back removes that page from it. Clearing this site’s data in your browser removes only your browser’s copy.
• Safety & moderation data: reports you submit or that concern your content, and the outcome of any review. A report sent from the website records no account, and an email address only if you leave one for a reply; to limit abuse, the website keeps a salted hash of the sender’s IP address for up to two days.
• Subscription status: which plan you are on, when it renews or lapses, and an identifier that ties a purchase to your account. Apple is the seller for anything bought inside the app, so it takes the payment and we never receive or store card numbers.
• Notification tokens: if you turn on notifications, the token Apple issues so we can send them to your device. It identifies the install, not you, and it stops working when you turn notifications off.
• Audio: if you add a voice note or an audio clip to a page, the recording itself, exactly as with a photograph.
• Crash and diagnostic data: when the app or our website fails, what it was doing and where, and how long our web pages take to load. We use it to fix faults and nothing else.
• Support messages: what you write to us, and the bug reports you send from inside the app, including the diagnostic detail attached to them.

3. Why we use it, and our legal basis

• To provide the service and your account: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure, measure usage, and moderate content: our legitimate interests (Art. 6(1)(f)).
• To handle illegal content and respond to lawful requests: legal obligation (Art. 6(1)(c)).
• For anything optional we ask you to opt into: your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Who we share it with

We do not sell your data. We use service providers (processors) who process data on our behalf under contract:

• Supabase: Database, accounts and sign-in (EU).
• Cloudflare: Photo and audio storage, CSAM scanning, and Turnstile, the automatic check that a sign-up or sign-in in the app comes from a person and not a script (EU / global edge).
• Vercel: Hosting for swity.app, and cookieless website analytics (EU / global edge).
• Anthropic: Automated safety review of uploads before publishing (United States).
• Resend: Sending account and service emails (United States).
• RevenueCat: Keeping track of subscriptions bought through the App Store (United States).
• Sentry: Crash and error reports from the app and the website, and how long web pages take to load (EU (Frankfurt)).
• Google Workspace: Email for our @swity.app addresses, including messages you send us (Global).
• Apple: sign-in, at your choice, push notifications, and payment for anything bought inside the app.

Automated review. Before anything is published we send the photos and text to Anthropic’s Claude to check them against our guidelines. This is automated, and it can hide a project pending a human check. If it blocks a page, you can ask a person to review that decision from inside the app. Anthropic keeps a copy for up to 30 days and may access it for safety and security purposes.

Your published pages are public by design. When a page shows a map, your browser loads the map images from the OpenStreetMap Foundation, and when a page has a video, it loads the player from YouTube (Google); both receive your IP address and apply their own privacy policies. Some providers operate outside the EEA; where they do, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.

5. How long we keep it

• Account and content data: for as long as your account is active.
• When you delete a project or your account, we delete the associated data. Deleting your account also deletes the bug reports you sent, and we ask RevenueCat to delete its record of you. We keep a record that an account was deleted, without its name or handle, and records of past subscription purchases that are no longer linked to your account. We keep our log of the emails we sent you for up to 180 days. Residual copies may persist in encrypted backups for up to two weeks before rotating out.
• Where the law requires it (for example, evidence of illegal content, or accounting records), we retain the minimum necessary for the required period.

6. Your rights

Under the GDPR you can request access to, correction, deletion, restriction or portability of your data, and object to certain processing. You can delete your account in the app at any time. To exercise a right, contact privacy@swity.app. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), Poland.

7. Children

swity is not intended for anyone under 16. We do not knowingly collect data from children under that age.

8. Security

We use encryption in transit, access controls and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

9. Cookies

swity does not use cookies for advertising or tracking, and we do not share anything with ad networks. Our website sets no cookies at all, and our analytics are cookieless, which is why you are not asked to accept anything. The website stores nothing on your device unless you tap Appreciate, which keeps the random code and the list described above in your browser’s local storage, or open a page with a video, whose YouTube player may store data in your browser under YouTube’s own policy; the demo page also remembers, for one browser session, that you have seen its welcome note. In the app, your sign-in session is kept on your device.

10. Changes

We may update this policy; we will change the “last updated” date above and, for material changes, tell you in the app.

11. Contact

Questions about this policy or your data: privacy@swity.app.