Privacy Policy
Your privacy matters. SWIM collects only what we need, shares nothing we don’t have to, and respects your rights under US law and the EU’s GDPR.
1. Information We Collect
Account information: Name and email when you sign up. Google Sign-In provides name and email only.
Payment information: Processed by Stripe. SWIM receives a transaction record but never your card number.
Drop and MBO activity: We maintain a ledger of your Drop balance, transactions, and MBO claims. This is part of the service.
Usage data: We use two analytics and monitoring tools:
- Umami Analytics — privacy-respecting, no cookies, no cross-site tracking. Collects aggregate data only: page views, general device type, approximate country.
- PostHog — product analytics that may collect individual behavioral data (page paths, feature interactions, session recordings). PostHog is consent-gated — it does not load unless you accept analytics in the consent banner.
Error monitoring: We use Sentry to capture application errors and performance traces. Sentry may collect your browser type, operating system, the page you were on when an error occurred, and a portion of the error stack trace. Sentry is consent-gated — it does not load until you accept “Error Tracking” in the consent banner.
Communications: We retain correspondence if you contact us.
2. How We Use Your Information
- To provide the service: account access, Drop ledger, purchase processing
- To communicate: transactional emails via Resend (order confirmations, password resets, verification)
- To improve SWIM: aggregate analytics only — no individual profiling
- To comply with legal obligations: as required by law
We do not use your data for advertising. We do not sell, rent, or trade your personal information.
3. Who We Share Data With
| Recipient | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing | Name, email, transaction amount |
| Resend | Transactional email | Email address, email content |
| Merchants | Order fulfillment (physical goods) | Name, email, shipping address |
| Neon (PostgreSQL) | Database hosting | All stored account data |
| Cloudflare | CDN, infrastructure, DDoS protection | IP addresses (standard traffic) |
| PostHog | Product analytics | Page paths, feature interactions, session data |
| Sentry | Error monitoring | Browser type, OS, error traces |
We do not share with advertisers, data brokers, or advertising networks. We do not sell personal information.
4. Seller Data
If you operate a Stream on SWIM:
- You are the data controller for your customers’ personal information
- SWIM processes it as your data processor
- You must have a lawful basis to collect your customers’ data
- You must maintain your own privacy policy for your customers
5. Cookies
- Session cookies: Required for login. Expire on browser close.
- No tracking cookies. No advertising cookies. No cross-site tracking.
Our consent banner manages cookie preferences.
6. Data Retention
| Data type | Retention |
|---|---|
| Account data | Active + 90 days post-deletion |
| Transaction records | 7 years (legal/financial requirement) |
| Analytics | Aggregate only — no personal retention |
| Communications | 2 years |
7. Your Rights
All users: access, correct, and delete your personal data (subject to legal retention requirements).
EU/EEA users (GDPR): also: data portability, restriction of processing, right to object, right to lodge a complaint with your national DPA, and right to withdraw consent.
California users (CCPA): right to know, right to delete, and right to opt out of sale. We do not sell personal information.
To exercise these rights: [email protected]
8. Data Security
Encrypted connections (TLS 1.2+), hashed passwords (bcrypt), database access controls, and secrets management. If a breach affects your data, we will notify you as required by law.
9. Children’s Privacy
SWIM is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact [email protected] — we will remove it promptly. Users must be at least 18 to create an account or open a Merchant Workspace.
10. International Transfers
SWIM operates from the US. EU/EEA data may be transferred to the US under Standard Contractual Clauses (SCCs) approved by the European Commission.
11. Changes to This Policy
We will notify you of material changes at least 30 days before they take effect. The version number changes with every update.
12. Contact
- Privacy inquiries: [email protected]
- GDPR requests: [email protected]
- Mail: Kollabs Technologies LLC · 1309 Coffeen Avenue STE 1200 · Sheridan, Wyoming 82801
Version 1.1.0 · Updated May 19, 2026