Privacy Policy

Last updated: [Effective date]

This policy explains what personal data Swaff collects, why, who we share it with, how long we keep it and your rights. It covers the Swaff app and these web pages.

1. Who we are

The controller of your personal data is [Company name] (company number [Company number], registered office [Registered address]), which runs Swaff ("we", "us"). We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].

For anything about your personal data, email info@swaff.uk.

2. The data we collect

Account details. Your email address, your password (stored only as a secure hash), your display name and, if you add one, your profile photo. If you sign in with Apple or Google, we receive a verified token from them with an account identifier, your email address (with Apple this may be a private relay address) and your name; if you haven't chosen a display name, we use that name as your display name, which other members can see - you can change it in Settings.

Listings and photos. The fragrance, price, size, how full the bottle is, condition, whether the box is included, the batch code, swap options and the photos you upload. For each photo we also store fingerprints (a cryptographic hash and a "perceptual" hash) so we can spot the same photo being reused on another member's listing. If our automatic photo check refuses a photo (see section 4), we don't store the photo, but we keep a record that you tried to upload it: when, whether it was for a listing or your profile, and the categories the check found.

Your activity. Offers, counter-offers, trades, payments status, shipping carrier and tracking numbers you enter, receipt confirmations, disputes and the information you give in them, reviews you write and receive, reports you make, members you block, and catalogue entries (fragrances or brands) you add.

Delivery address. The UK delivery address you save (full name, address lines, town or city, county if you add one, and postcode), so a bottle you buy or swap for can be posted to you. We check the postcode exists using postcodes.io, an open data postcode service (only the postcode is sent - see section 5). When a trade is agreed we copy it onto that trade, so a later change to your saved address doesn't redirect a parcel already on its way. Only the member who has to post a bottle to you sees it - on that trade's screen, once the trade is paid (or straight away for a swap with no money), until they mark it posted. It is never shown on your profile, your listings or in messages and notifications. Admins can see trade records when handling a dispute or a legal request.

Messages. The messages you send and receive in Swaff conversations, and the deal events shown in them.

Your taste profile. Your wanted list (and any maximum price you set), your collection ("bottles I own"), your Discover swipes (liked, skipped, "I own this"), and the scent preferences you choose (styles you wear and favourite notes).

Payments. Card payments and payouts are handled by Stripe. We don't see or store your full card number. We store the Stripe identifiers linked to your account (your Stripe customer and, if you receive money, your Stripe Express account), whether your payouts are set up, and a record of each payment: amount, fee, status, refunds and transfers. When you set up payouts, Stripe collects identity and bank details directly from you; we don't receive copies of your identity documents.

Device and technical data. If you allow notifications, your device's push token and platform (iOS or Android) and your notification settings. When you use Swaff our servers process your IP address and request details to keep the service running and secure (for example rate limiting), and we keep server logs that include account identifiers and errors. If crash reporting is switched on, crash reports with technical details of the error and your device and app version (see section 5).

What we don't collect. Swaff doesn't ask for or store your phone number, date of birth or location - you never need to share your phone number or address in chat. We don't use advertising identifiers or third-party advertising or analytics trackers.

3. Why we use your data, and our lawful bases

We don't send marketing emails, and we don't sell your personal data.

Where we rely on legitimate interests, we have considered your interests and rights. You can object (section 9).

4. Personalisation and automated checks

Personalisation. Swaff uses your own activity on Swaff - your wanted list, your collection, your Discover swipes and your scent preferences - to rank listings on the "For you" home page, to choose and order the fragrances in Discover, and to tell you when bottles you might want are listed. This is a simple set of rules applied to your own choices; it uses no data from outside Swaff and no advertising profiles. It only changes the order things are shown in: it never hides listings from you, and it never affects prices, offers or trades. "Newest" order is always one tap away. Your taste profile is private, except as described below.

What other members can learn. Some features use your choices to help other members, without naming you:

• "Wanted right now" and demand tags show how many people want a fragrance and the highest price offered - never who, and a price only when at least two people have set one.
• Owners of a fragrance are told that people want it - never who.
• Swap matches: if you own a fragrance another member wants and they own one you want, both of you may be shown the match with each other's display name and those two bottles, so you can propose a swap. Either of you can hide a match for good.

Automated checks. To protect members, Swaff automatically checks:

• messages, before they are sent: messages with contact details or suggesting payment outside Swaff, and messages with slurs, threats or sexual harassment, are not sent; messages that may be hurtful get a prompt to think again;
• listings: some listings are held for a person at Swaff to review (for example an unusually low price, wording that suggests a replica, a photo already used on another member's listing, or a new account listing a high-value bottle);
• catalogue entries and batch codes: offensive words and contact details are refused;
• photos, before they are stored: every listing photo and profile photo is checked automatically for nudity or sexual content, swimwear or underwear, graphic violence, self-harm, gore and hate symbols. A photo that fails the check is not stored or shown, and you are asked to use another photo. If the check can't run at that moment, the photo isn't stored and you can try again. If you repeatedly upload photos that fail the check, a person at Swaff is told and may review your account.

The photo check uses Amazon Rekognition (see section 5). The other checks use word lists and simple rules, not outside services. Decisions to remove a listing after review, to warn a member or to suspend an account are taken by people at Swaff, not automatically. We may add further automated safety checks in future; if they change how decisions about you are made, we will update this policy.

5. Who we share data with

• Other members: your display name, profile photo, listings and their photos, reviews and average rating are public to members. The member you trade with also sees your messages, offers, the shipping carrier and tracking number you enter, and receipt and dispute updates.
• Stripe (Stripe Payments UK, Ltd. and its group) processes payments, refunds and payouts and verifies sellers who receive money. For identity checks and fraud prevention Stripe acts as a separate controller under its own privacy policy.
• Google (Firebase Cloud Messaging) delivers push notifications to Android and iOS devices, and Apple (Apple Push Notification service) delivers them to iPhones. A notification can contain the sender's display name, the fragrance and the text of a new message.
• Apple and Google sign-in: if you choose Sign in with Apple or Google, they confirm your identity to us. Their own privacy policies apply to your account with them.
• Sentry (Functional Software, Inc.), if crash reporting is switched on, receives crash and error reports from the app and our servers. These contain technical diagnostics - such as the error and where in the code it happened, the app version, device model and operating system, and the screens or requests that led up to it - not the contents of your messages, request contents or passwords. We configure it not to send IP addresses, user details or what you tap or type on screen, and we remove postcodes and address searches from these reports.
• WorldPosta hosts our servers and database, including uploaded photos, in [Hosting location].
• Amazon Web Services (Amazon Web Services EMEA SARL and its group) runs our automatic photo check (Amazon Rekognition, in its London region). Each photo you upload is sent to it for the check before we store it; the photo is not stored in our AWS account, and only the check's result comes back to us. AWS acts as our processor. Under AWS's terms it may keep the images it processes as needed to provide and maintain the service; we have asked AWS not to use them to improve its own services, using the opt-out AWS offers.
• postcodes.io (an open data postcode service maintained by Ideal Postcodes): when you enter or save a delivery address, we send only the postcode to it - never your name or the rest of your address - to check the postcode exists and to suggest your town and county. Requests come from our servers, not your device, so it doesn't see your IP address.
• Google (Places API): if you use "Start typing your address" on the delivery address form, what you type in that box is sent to Google as you type, to suggest matching UK addresses, and the address you pick is looked up with Google to fill in the form. Your name and the rest of the form are not sent. Requests come from our servers, not your device, so Google doesn't see your IP address; they are grouped by a random session code that isn't linked to your account. Google processes this under the Google Maps Platform terms. You can enter your address by hand instead.
• Email provider: when we send account emails (such as email confirmation or password reset), we use an email service provider to send them.
• Professional advisers, authorities and others where the law requires it, to protect members or Swaff from fraud or harm, or in connection with a sale or restructuring of our business.

Our service providers act on our instructions under contracts that protect your data.

6. International transfers

Some of these providers (including Stripe, Google, Apple, Sentry and Amazon Web Services) are based in, or process data in, the United States or other countries outside the UK. Where personal data leaves the UK we make sure it is protected as UK law requires - for example by relying on UK adequacy regulations (such as the UK-US data bridge for certified companies) or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact info@swaff.uk for more information.

7. How long we keep your data

We keep your account data while your account is open. You can delete your account at any time in Settings → Delete account (not while a trade is in progress or a dispute is open).

Delivery addresses. You can change your saved address at any time, and remove it when no offer or trade in progress is sending you a bottle. The copy on a trade is deleted 90 days after the trade is completed or cancelled - long enough to deal with a lost or damaged parcel, a dispute or a card chargeback, and no longer.

When you delete your account we remove: your email address, password and Apple / Google sign-in links, your display name (replaced by "Deleted user") and profile photo; your saved delivery address and the copies of it on your trades; your wanted list, collection, Discover swipes, scent preferences, swap matches, blocks, notifications, notification settings and push tokens. Your live listings are taken down and pending offers are cancelled. You are signed out on every device.

What we keep after deletion, and why. Some records involve other members or are needed for legal, financial or safety reasons. They are kept against an anonymised account (shown as "Deleted user"), no longer linked to your email or sign-in:

• completed and cancelled trades, offers, payment and refund records and the Stripe identifiers linked to them, including shipping carriers and tracking numbers - for accounting and tax, refunds, chargebacks and legal claims. Financial records are kept for at least 6 years;
• reviews you wrote and received, which stay on the other member's profile and in ratings;
• messages in your conversations, which the other member can still read, and listings with their photos that were part of those conversations or trades;
• reports, disputes and moderation decisions - to keep Swaff safe and handle any follow-up.

We keep these only for as long as we need them for those purposes, then delete or anonymise them.

Server logs are kept for up to about a month. Data cached on your device is described in section 8.

If your account is suspended, we keep your data so that we can handle trades, disputes and appeals and prevent the same person rejoining.

8. Data stored on your device

The app stores your sign-in tokens securely in the iOS Keychain or Android Keystore. To open instantly, it keeps a copy of your profile and recently loaded screens (such as listings and your inbox) in the app's private storage for up to 7 days; this is cleared when you log out. The app doesn't use cookies, and these web pages don't set any.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected - you can change your display name and profile photo in the app;
• have your data erased - delete your account in the app, or ask us;
• restrict how we use your data in some circumstances;
• data portability: receive data you gave us in a commonly used, machine-readable format;
• object to our use of your data based on legitimate interests, including the personalisation in section 4.

To use these rights, email info@swaff.uk from the email address on your account. We will reply within one month. You can also switch push notifications off at any time in your device settings or in Settings → Notifications.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

10. Security

All traffic between the app and our servers is encrypted (HTTPS). Passwords are stored as secure hashes, never in plain text, and card details are handled by Stripe. Delivery addresses, messages, tracking numbers and dispute and report details are also encrypted in our database. Photos you upload can be seen by other members, so avoid photos that show your address, face or other personal details.

11. Children

Swaff is for adults. You must be 18 or over to use it, and we don't knowingly collect data from children. If you believe a child has an account, contact info@swaff.uk and we will delete it.

12. Changes to this policy

We will update this policy when Swaff or the law changes. If a change is significant we will tell you in the app or by email. The date at the top shows when it last changed.

13. Contact

[Company name], [Registered address]. Privacy questions: info@swaff.uk. Everything else: info@swaff.uk.