Back to Swapness

Privacy policy

Last updated: 25 October 2026

Swapness is a small bartering app running as an invite-only beta in Amsterdam, the Netherlands. This page lists the personal data the app actually holds today, why it holds it, who else sees it, and how long it stays. It is written from the database and the storage buckets that are running. On every change, an automated check compares this page against the database schema and the deletion jobs held in our code. It reads every retention period stated here and looks for the mechanism that applies it. Two limits are worth knowing, because a check is only as good as what it can see. It reads each period in the sentence that states it, so a promise made across two sentences can pass it. And it runs without access to the live database, so the comparison with the data actually stored, and with the settings the app runs on, is done by hand, on no fixed schedule. If anything here is unclear, ask us.

Who is responsible

Swapness is built and run by one person, based in Amsterdam. That person is the controller of the data described here. For any question, request or complaint about this page, write to privacy@swapness.nl. Full company and postal details are published here before the app opens beyond the invite-only beta.

What we collect

Account details

Your email address, a username, a display name, and optionally an avatar and a short bio. If you set a password, it is stored by our authentication service as a hash, so it stays unreadable to us. Sign-in by magic link works without a password.

When someone likes one of your items, we email you about it at most once a day, with that person's first name and the title of the item they offer for it. So when you like an item, its owner can read your first name and the title of your item in such an email. If you have not swiped yet on a given day, we send you a reminder with items near you, every day, up to 30 days after your last visit, and then no more. You get at most one email a day, and you turn them all off in your settings.

Approximate location

Your city and postal-code area, plus a coarse point derived from them, used to show items nearby and to tell others roughly how far away an item is. Your street address stays with you: the app has no shipping and never asks for one. A precise meeting point is something you share yourself, in chat, with one person.

Listings, photos and alerts

The photos, titles and descriptions of the items you list, and the wishes and alerts you save to be told when something matching shows up. Photos of published items are visible to other members and are served from a public storage bucket, so anyone holding the link can open one.

Messages, and photos you send in chat

The messages you exchange with other members after a match, and the photos you send in chat. Those photos live in a private bucket and are served through short-lived signed links, so they stay inside the conversation. Chat video is switched off during the beta.

Automatic checks on messages

Every message you send is automatically checked before it is delivered. The check runs in two steps: a list of terms held in our own database, and, only for the cases that list marks as doubtful, a language model that reads the message text and returns a verdict. A message can be refused, and you are told so and can rewrite it. The verdict is used for that message alone. It has no legal effect on you and produces no automated decision about your account: suspending an account is a decision a person takes, after reading.

That model runs at OVHcloud, in France. The text of a flagged message is sent there to be judged and the verdict comes straight back. OVHcloud states that it does not store these requests and never uses them to train models, and nothing leaves the European Union. Until September 2026 the model ran on this project's own machine; this page was updated before the move, as it promised it would be.

Handover photos

When you complete a swap, each side photographs the item they receive, two to five photos each. They are the record of what actually changed hands, so they are kept as evidence if the other side later disputes the swap. They live in a private bucket, readable by the two people in that swap. A photo taken at a meeting point can show a doorway, a street or a living room: take the picture of the object, framed as tightly as you can.

Swipes, wishes and category affinities

Every swipe you make is stored: which item you liked or passed, and which of your items you offered for it. From those swipes the app builds a score per category, so the feed can lead with the kind of thing you keep saying yes to, and a graph of who would give what for what, which is what finds matches and loops. This history is yours alone and is shown to no other member.

Waiting list

The landing page has a waiting list, and it takes your email address and optionally your postcode before you have any account at all. We use both to decide who to invite next: a spot given to somebody too far from Amsterdam is a spot burned. Each submission also stores a salted one-way hash of the IP address it came from, for one hour, to cap how many entries a single source can push. Your address stays on that list until you are invited or until you ask us to remove it.

Reports and moderation records

If you report a member or an item, we store your report, what you wrote in it, and the name and reference of what you reported, so the case can be read and acted on. Every action taken afterwards is recorded too: what was decided, by whom, and why. A member who is reported is not told who reported them.

Notifications

The events the app raises for you (a match, a message, a swap step) are stored so your notification list can be rebuilt. If you turn on push notifications, your browser gives us a push endpoint, its keys and the user-agent of that browser, which together identify one device. You can withdraw that at any time in your browser or in the app.

IP address, device and sessions

Each time you sign in, our authentication service records the session: your IP address, the user-agent of your browser, and the times it was created and last used. It is what lets you stay signed in, and what lets us end a session that is no longer yours. Requests to the app also pass through our hosting and database providers, whose own access logs hold your IP address, a rough city and region derived from it, your internet provider and a browser signature. Those logs are theirs, kept under their own retention, and we cannot shorten them.

AI estimation

When you list an item, its photos are analysed to suggest a category, a title, a description and an indicative value. They are sent for that to OVHcloud, in France, which states that it does not store these requests and never uses them to train models. The copy sent for analysis is kept nowhere, nothing leaves the European Union, and your photos are not used to train third-party AI models. We keep a small counter of these calls per person and per hour, to cap what a single account can spend.

Product analytics

Inside our own database, and nowhere else, the app counts which screens you open. A row holds a date, the name of one screen, your account, and a number. The screen name comes from a fixed list of thirteen that the database refuses to add to: it is a name such as “feed” or “messages”, never a web address, so nothing records which listing you looked at or which conversation you opened. There is one row per screen per person per day, not one per tap, and the counter stops at a daily ceiling. We keep that detail for 90 days.

When those rows are removed, a running total is kept in their place: a date, a screen name, how many people and how many counts. That total carries no account and no name, and it stays, so the older picture does not disappear when the detail does.

The same database also counts when you hit one of the beta limits, and stores your name against it once if you raise your hand for Swapness Plus. Those rows tell us which limit is in people's way.

None of that reaches a third party, and none of it is used to profile you or to decide anything about your account. A PostHog integration is present in the code and switched off, with no key configured, so it sends nothing.

Counting visits to the pages themselves

The counters above only ever see people who are signed in, so they say nothing about the page that most people meet first. Since 8 September 2026 we also use Vercel Web Analytics, which counts page views across the whole site, the landing page included, and reaches our hosting provider rather than staying in our own database.

It sets no cookie and stores nothing on your device. Per view, it records the time, the page, where you came from, an approximate location from your IP address, your device type, and your browser and operating system. Vercel identifies a visitor by a hash computed from the request rather than by an identifier that follows you, and drops it again after a short window, so one visit cannot be joined to the next or to another website. Your IP address is used to derive that approximate location and that hash, and is not stored with the view.

We give no figure for that window here, deliberately. It is Vercel that applies it, on machines we do not run, so a number written on this page would be a promise we cannot keep or check. Vercel publishes it in its own privacy documentation for Web Analytics, and that is the copy that binds. Every other period on this page is one we apply ourselves, and an automated check refuses to let us write one we do not.

The page address is cut down before it leaves your browser. Vercel records the address of each page, and two of ours would carry an identifier in it. Every address is therefore reduced first to the shape of the screen: a conversation becomes “messages” and a member page becomes “member”, never the conversation or the person. Anything after a question mark or a hash sign is dropped whole, and a screen we have not listed is counted as “other”. So a visit never records which conversation you opened, whose profile you looked at, or what you typed into search.

We rely on legitimate interest for this, not on consent, and the reason is the paragraph above: nothing is written to or read from your device, and nothing here can identify you or follow you off this site. You can object to it under the rights section below. Advertising measurement with Meta and TikTok is a separate, optional choice described below.

Which parts of the landing page people use

On the landing page and its test variants we also count when someone sees, starts or submits the signup form, or receives an error. An acknowledgement means the server processed the request, not necessarily a new signup. We send Clarity the page variant, language, screen category and campaign codes from the link. These events never include an email address, postcode, entered text or advertising click ID. This extra measurement uses no visitor ID or device storage to link visits together.

Since 10 September 2026 the landing page also uses Microsoft Clarity. It runs on the Dutch and English landing pages, never on a screen you reach once you are signed in. It tells us which parts of the page people read, how far down they scroll and what they tap, so we can fix the page instead of guessing at it.

It runs without cookies. We have turned cookies off in its settings, and for visitors in Europe, the United Kingdom and Switzerland Clarity also applies that by itself. Nothing is written to or read from your device, so two visits cannot be joined together, and the session replay Clarity is otherwise known for is switched off and cannot run. What reaches Microsoft is one anonymous view at a time: the page, the time, what you scrolled and tapped, an approximate location from your IP address, and your device, browser and operating system.

It is on the landing page only, and that is a deliberate limit rather than a plan. A tool of this kind records the page it is placed on, so on a conversation it would record the conversation. It is therefore fenced in twice: it is installed on that one page, and the browser is instructed to refuse it everywhere else, so a mistake on our side is blocked rather than quietly obeyed. An automated check verifies both halves.

We rely on legitimate interest here too, for the same reason: nothing is stored on your device and nothing here identifies you. You can object under the rights section below. This cookie-free configuration is separate from the optional Meta and TikTok advertising measurement below.

Optional advertising measurement with Meta and TikTok

Our Dutch and English landing pages can use Meta Pixel and TikTok Pixel to measure visits and requests for beta access, and to improve our Facebook, Instagram and TikTok ads. “Advertising choices” names the providers enabled for your visit. Their scripts start only when you choose “Accept”. Before you accept, we load no advertising script and send no event to either provider. Choosing “Decline” or continuing without choosing keeps it off. You can request beta access either way.

After you accept, we send a page-view event and an event when our server acknowledges a request for beta access. An acknowledgement can also cover a repeated request or one limited to prevent spam. It does not tell either provider whether a new address joined the waiting list, and it is not a count of new members.

The enabled providers receive your IP address, browser and device information, the landing-page address and its advertising attribution information, and cookies they can access. Meta cookies may include _fbp and _fbc. TikTok cookies may include _ttp, ttclid and cookies beginning with ttcsid. Each provider may link this information with data it already holds, including a Facebook, Instagram or TikTok account. We do not add your email address, postcode, account identifier or form contents to the page-view and beta-request events. We do not enable automatic matching of form details.

Depending on its pixel settings, TikTok can also collect page metadata, button clicks, scrolling and page-performance information. This is additional to the page-view and beta-request events above, and also starts only after you accept advertising measurement.

We remember your advertising choice in this browser. When it expires or you clear it, we ask again. Adding a provider also requires a new acceptance: a choice made for Meta alone does not authorise TikTok. You can withdraw your choice using “Advertising choices” in the landing-page footer, or open your advertising choices. Withdrawal stops our future events and attempts to remove advertising cookies and pixel storage that this site can access. The page may reload to unload the pixels. This does not erase information either provider has already received or cookies on their own domains.

Meta explains its own uses and retention in its Privacy Policy and Cookies Policy. TikTok explains its own uses and retention in its Privacy Policy and describes its advertising cookies in its TikTok Pixel cookie information. Your advertising choice is separate from joining the waiting list and from the other analytics described on this page.

Why we may process it (legal basis)

  • To run the service (performance of a contract): your account, listings, swipes, matches, messages and handover photos exist so the app can do what you signed up for.
  • Legitimate interest: keeping the platform safe. That covers the automatic checks on messages, reports and moderation records, session records, and the caps that stop one account or one source from flooding the service.
  • Legitimate interest: knowing whether the app works. The screen counters described above tell us which screens people reach and where they stop, so we can fix the one that loses them. We count screens, not people: no profile is built, no decision is taken about an account, and no third party receives them. You can object: write to us and we remove your rows. The counting itself has an off switch we can use, and it turns it off for everyone, not for one account.
  • Consent: the waiting list, push notifications, optional Meta and TikTok advertising measurement, and any other optional feature that asks you first. You can withdraw consent at any time, and withdrawing it stops that processing from then on.

How long we keep it

Each line below has a mechanism behind it, running on our servers. Where there is no mechanism yet, the line says so instead of naming a comfortable number.

  • Account, listings, wishes, swipes and messages: for as long as your account exists.
  • Sign-in sessions, with their IP address and user-agent: a session ends after 14 days without use, and after 60 days in every case. An hourly job deletes the ended sessions, and the IP address goes with them.
  • Reports and moderation records: deleted 24 months after they are filed, by a job that runs every night, so repeated abuse can be recognised in between.
  • Screen counters: the rows that carry your account are deleted 90 days after the day they count, by a job that runs every night. Before it removes them, the same job writes a running total for that day, which carries no account and stays.
  • Photos of listings: deleted from storage when you withdraw or delete the listing.
  • Photos left over from a draft: a photo uploaded during a draft that is never published is picked up by a daily job after 72 hours. That job does not delete yet: it only writes the list of files it would delete, so we can read those lists before we switch the deletion on. Ask us and we delete yours in the meantime.
  • Photos you send in chat: kept as long as the conversation. A photo uploaded but never sent is picked up by the same daily job after 24 hours, and the same holds: the job writes the list and deletes nothing for now. Ask us and we delete yours in the meantime.
  • Handover photos: kept as long as the swap record they prove. There is no automatic deletion for them today, and the setting that would switch one on is turned off. Ask us and we delete yours.
  • Waiting list: your address stays until you are invited or you ask for it to be removed. The hashed IP of a submission is dropped when its one-hour window closes.
  • Provider access logs: kept by our hosting and database providers under their own retention. We hold no log archive of our own beyond what is described above.
  • If you ask us to delete your account: the deletion runs in two steps, so nothing is left behind. Your files are listed first, then removed from storage, and the account itself goes last. What belongs to somebody else stays without your name on it: a report filed against you, and the swap record of the person you swapped with. A swap you have already agreed to holds the request until it is finished or cancelled, so nobody vanishes in the middle of a handover.

Who we share it with

We do not sell your data. Other members only see what the app shows them: your public profile, your published items, your approximate distance, the messages you send them, and the handover photos of a swap you are part of. The following providers receive data for the purposes described here. Meta and TikTok receive advertising data only with your consent, under their own terms and privacy policies.

  • Supabase: database, file storage and authentication. This is where accounts, listings, messages, photos and session records live.
  • Vercel: hosting of the web app, and the counting of page views described above. Requests pass through it, so its access logs hold your IP address.
  • OVHcloud: the AI model that reads the photos of an item being listed and judges the messages flagged as doubtful, run in France. It receives those photos and the text of those messages, and states that it keeps neither and uses neither to train models.
  • Resend: delivery of the emails the app sends you (invitation, sign-in link, password reset, the mail that someone likes your item, and the reminder that your swipes are back). It sees your email address and the content of those emails.
  • PostHog: product analytics, prepared but switched off during the beta, as described above.
  • Microsoft Clarity: which parts of the landing page people use, as described above. It sees only that page, never a screen you reach once you are signed in.
  • Meta: optional advertising measurement on the Dutch and English landing pages, after you accept it. Meta's roles and use of these data are described in its Business Tools Terms, Controller Addendum and Privacy Policy.
  • TikTok: optional advertising measurement on the Dutch and English landing pages, after you accept it. TikTok describes its roles and uses of these data in its Business Products (Data) Terms, Jurisdiction-Specific Terms and Privacy Policy.

Hosting is in the EU where the provider offers it. We also hand data to an authority when the law requires it, and we say so here if it ever becomes routine.

Your rights

Under the GDPR you can ask to access, correct, export or delete your personal data, object to certain processing, or restrict it. Access and export are served by the app itself: it assembles a copy of your account, listings, messages, swipes and swap records, and we keep a line saying that an export was made, for you and when, so a repeated export can be spotted. Email us at privacy@swapness.nl and we answer within one month, which is the deadline the GDPR sets us. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Reporting illegal content (DSA)

Anyone can flag content they believe is illegal or against our rules. The route we can stand behind is the “Report” option on any item or profile: it files a case, and while a case is open the system raises an alert to us every hour until someone has read it. Every action taken on a report is recorded, and you can ask what happened to yours by writing to privacy@swapness.nl. We give no fixed handling time yet, because the beta is run by one person and a promise we cannot hold is worth less than this sentence. See also our Terms of use.