Swappix Privacy Policy

Effective date: April 7, 2026

Version: 1.1 (English)

---

1. Data controller

The personal data controller is:

• Legal name: [SPECIFY: sole proprietor / company — required for store listings and applicable privacy laws]
• Contact e-mail for privacy requests: support@goswappix.app

This Policy describes how we collect and process data when you use the Swappix mobile application (App) for Android and iOS and the website goswappix.app (Site) in connection with the Swappix service.

By using the App, you confirm that you have read this Policy. If you do not agree, please do not use the App.

---

2. Data we process

Depending on how you use the App, we may process:

2.1. Account and authentication

• E-mail address and password (the password is stored in encrypted form by the authentication provider).
• If phone sign-in is enabled: phone number and data needed for verification (SMS / call).
• Session access tokens required to keep you signed in.

2.2. Profile and reputation

• Nickname chosen at registration.
• Optional profile photo.
• Rating, statistics and in-app interaction history as implemented in the product.
• Identity verification data (e.g. verification photo) if you complete such a flow.

2.3. Content you create

• Exchange requests (route, amounts, currencies, notes and other form fields).
• Deal data (status, confirmations, meeting location where the product supports it, terms agreed in the interface).
• Chat messages and attachments if chat is synced with our servers; purely local messages stay on your device and may be removed when you delete the App or clear storage.

2.4. Location

• Location (coordinates and related data) may be processed when you use maps, nearby requests, meeting point features, or SOS / trusted contacts alerts, if you grant OS permission and enable the feature.

2.5. Technical data

• Device model, OS version, interface language.
• Analytics and automated crash reporting are not enabled in the current App build; this Policy will be updated if that changes.

2.6. Notifications

• Local notifications on the device may be used (without sending a push token to a remote provider).
• Remote push (e.g. Firebase Cloud Messaging) is not used in the current build; the Policy will be amended if we enable it.

---

3. Purposes

We process data to:

• provide the service (registration, profile, requests, deals, chats);
• protect users and enforce platform rules (including request moderation where applicable);
• respond to support requests;
• comply with legal obligations where applicable.

Swappix is an informational marketplace; exchanges of funds are carried out directly between users outside the App unless expressly stated otherwise in a separate agreement. Swappix does not accept, transmit, or hold money on users’ behalf.

---

4. Legal bases (EEA and similar jurisdictions)

For users in the European Economic Area and comparable regimes, processing may rely on:

• performance of a contract (use of the service);
• consent (e.g. location, notifications, marketing — if introduced);
• legitimate interests (security, abuse prevention) where compatible with your rights.

For users in the Russian Federation, processing is carried out in line with Federal Law No. 152-FZ on personal data, subject to local requirements.

---

5. Processors and third parties

We use the following categories of processors:

Service	Purpose	Policy
Supabase (Supabase Inc.)	Database, authentication, file storage (avatars, verification), API	https://supabase.com/privacy
OpenStreetMap (tiles via tile.openstreetmap.org)	Map display	https://operations.osmfoundation.org/policies/tiles/
Google Fonts (when fonts are loaded from Google)	UI typography	https://policies.google.com/privacy

Opening Google Maps or other map links is subject to those services’ policies.

The list of processors may change; the version published on the Site is authoritative for store listings.

We do not sell personal data to third parties in the usual “data broker” sense.

---

6. Storage location and transfers

Data may be processed on Supabase and other providers’ servers, including outside your country of residence (including the US and EU). By using the App you acknowledge this. Check your Supabase project region and extend this section if you need region-specific disclosures.

---

7. Retention

• Account and profile data are kept while the account is active.
• After account deletion, data is erased or anonymised within technical and legal limits (e.g. disputes, accounting).
• Backups may persist for a limited period.

For category-specific retention, contact support@goswappix.app.

---

8. Your rights

You may request:

• access to your personal data;
• rectification of inaccurate data;
• erasure (“right to be forgotten”) within legal and technical limits;
• withdrawal of consent where processing is consent-based;
• to lodge a complaint with your local data protection authority.

Contact support@goswappix.app. We will respond within a reasonable time under applicable law.

---

9. Children

The App is not intended for anyone under 16 (or the digital consent age in your jurisdiction if higher). We do not knowingly collect children’s data. If you believe a child has provided data, contact us and we will take steps to delete it.

---

10. Security

We use organisational and technical measures (including HTTPS, access control, database policies). No internet transmission is 100% secure.

---

11. Changes

We may update this Policy. The new version is effective when published at this URL unless stated otherwise. Material changes should be communicated in-app or by e-mail where feasible.

---

12. Contact

E-mail: support@goswappix.app

[Add postal address and company details where required for your jurisdiction.]

---

Google Play checklist

1. Host this document at a stable HTTPS URL.
2. Enter the same URL in Play Console → App content → Privacy policy.
3. Complete the Data safety section according to actual data collection (see repository checklist).

Replace all bracketed [...] placeholders before going to production.