Privacy Policy

1. Introduction

Welcome to Sway. Sway is operated by Pixrupt ("we," "our," or "us"), which is the data controller for the personal information described in this policy. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

2. Information We Collect

Personal Information

We collect personal information that you voluntarily provide to us when you register on the app, including:

• Name and email address (via Google or Apple Sign-In)
• Profile information (username, profile picture)
• User-generated content: photos and short video clips (up to 5 seconds, recorded without sound) you add to your Sways, reactions (a face and the selfie you answer with), and the reason you give when you miss an hour, including any text you type for it
• Sway details: the Sways you create or join, the people in them, their times, the weekdays a Sway repeats on (each repeat is a new Sway with the same people), your reminder hours and the time zone they run in
• Subscription status: whether you have Sway+. Payments are handled by Apple or Google; we never see your card details

Automatically Collected Information

When you use our app, we automatically collect certain information, including:

• Device information (device type, operating system, unique device identifiers)
• Usage data (features you use, time spent in the app)
• Log data (IP address, access times, error logs)
• Crash and error reports, which can include your account ID, email address and IP address
• A push notification token, if you allow notifications

Camera and Photo Library Access

Sway requires access to your device's camera and photo library to capture and upload photos to your Sways. We only access photos that you explicitly choose to share within the app. All photos are stored securely and are only visible to members of your Sway sessions.

Location

Sway asks for permission to use your location while you set up and once more after your first few shots, and you can switch it on or off in Profile. With your permission, the place of a shot is read at the moment you take it and saved with it, so the shot shows where it was taken and a Sway can be drawn on a map. Location is never collected in the background, and refusing permission never stops you from taking a photo; the shot is simply left off the map. Locations are visible only to members of that Sway.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Facilitate photo sharing within Sway sessions
• Generate split-screen videos from your photos
• Draw a Sway's day on a map, including the route between shots, when its shots carry a location
• Send you reminders and updates about your Sways (with your permission)
• Improve and optimize our app and services
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following situations:

• With Sway members: Photos and clips you add are visible to all members of the Sway you joined.
• Service providers: We may share your information with third-party service providers who perform services on our behalf: hosting and cloud storage, authentication, analytics, crash reporting, subscription management, push notifications, email delivery and map routing. Each one is listed in section 9.
• Legal requirements: We may disclose your information if required by law or in response to valid requests by public authorities.
• Business transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred.

5. Data Storage and Security

We use industry-standard security measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure cloud storage with Cloudflare R2
• Authentication via secure OAuth providers (Google, Apple)
• Signed, time-limited links for every photo and video

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, regulatory, or security purposes.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a structured format
• Objection: Object to processing of your personal information

To exercise these rights, please contact us at the email address provided below.

8. Children's Privacy

Sway is not intended for children under the age of 13 (or the applicable age of digital consent in your country). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately, and we will take steps to delete such information.

9. Third-Party Services

Sway uses the following third-party services:

• Google Sign-In: Signing in with a Google account (Privacy Policy)
• Apple Sign-In: Signing in with an Apple account (Privacy Policy)
• Hetzner: Hosting our servers and database in Germany (Privacy Policy)
• Cloudflare R2: Storing photos, clips and videos (Privacy Policy)
• PostHog: Product analytics: which features are used, linked to your account ID, name and email. Processed in the United States (Privacy Policy)
• Sentry: Crash and error reports, which can include your account ID, email and IP address. Processed in the European Union (Privacy Policy)
• RevenueCat: Managing Sway+ subscriptions bought through Apple or Google, linked to your account ID (Privacy Policy)
• Expo: Delivering push notifications to your device (Privacy Policy)
• Resend: Sending account emails, such as account deletion confirmations (Privacy Policy)
• OpenRouteService: Drawing the road route between the locations of a Map mode Sway. Only the coordinates of consecutive shots are sent; no account, name or photo goes with them (Privacy Policy)

We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies.

10. International Data Transfers

Our servers and database are in Germany. Some of the service providers listed in section 9, including PostHog, RevenueCat, Expo and Resend, process data in the United States or other countries outside your own. Where the law requires it, these transfers rely on the providers' data processing agreements and the European Commission's Standard Contractual Clauses or an equivalent safeguard.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: