Privacy Policy

1. Who we are

This policy explains how Swifolio (“Swifolio”, “we”) handles personal information when you use swifolio.com, Swifolio Pro and the Swifolio MCP (the “Service”). We are the controller of that information. Contact: [email protected], the mailing address we provide on request to [email protected].

2. What we collect

From your sign-in provider (Google or GitHub)

When you sign in, your provider sends us your name, email address, whether it’s verified, your profile photo link and your account ID with them. We also store the sign-in tokens and permissions (scopes) your provider returns, which Better Auth, our sign-in software, keeps with your account. We ask only for your basic profile and email, and we don’t use those tokens to read or change anything else in your Google or GitHub account.

When you use your account

• Sessions: a session token, the IP address and browser user agent it was created from, and when it was created, updated and expires. An account can have up to 3 sessions at once.
• Saved designs: which designs you saved, and when.
• API keys: the name you give each key, its first characters, when it was made and last used. We store only a one-way hash of the key itself, never the key.
• Connected AI tools: when you connect an AI tool such as claude.ai or ChatGPT, we store the tool’s registration (its name, website and redirect addresses), your approval of it, and the access and refresh tokens issued to it, with their scopes and expiry.
• MCP requests: what your AI tool asks for (for example a search or a design’s code) is processed to answer it. We don’t store the content of those requests in our database, except that fetching a design’s code is recorded in the download log below; a count of recent requests per account is kept in memory for about a minute for rate limiting.
• Download and security log: each time a design’s code is delivered to you, whether shown in the code tab, downloaded as a .zip or fetched by your AI tool through the MCP, and each time a delivery is refused under our fair-use limits, we record your account ID, the design, how it was delivered, the time, your IP address, the country Cloudflare reports for that address, your browser’s user agent and, for the MCP, which API key prefix or connected tool was used. From this log we may raise internal security flags on an account (for example for unusually many downloads, automated tools, or one account used from many places at once) and pause downloads while we look.
• Code fingerprints: code delivered to you is watermarked to your account. We keep a record linking each watermark to your account ID and the design, so that if a copy turns up elsewhere we can tell which account it was licensed to.

When you subscribe

When billing is enabled, we create a customer record for you at Stripe when your account is created, with your name, email and Swifolio account ID, so you can subscribe in one step. When you subscribe, Stripe collects your payment details and billing address. We receive and store your Stripe customer ID, plan, monthly or yearly billing, subscription status, the current period’s dates, and any trial or cancellation dates. We never receive or store your full card number.

Analytics

We use PostHog to understand how the site is used: pages viewed, clicks and other interactions, session recordings of how you move around the site (form inputs are masked), your browser, device and screen, the page that referred you, and an approximate location derived from your IP address. Once you’re signed in, these events are linked to your account ID, name, email and whether you’re on Pro. PostHog sets a cookie and uses your browser’s storage to recognise your visits. If your browser sends a Global Privacy Control signal, PostHog isn’t loaded at all. You can also block or clear these cookies in your browser’s settings.

When you contact us

Your email address and whatever you write to us.

Automatically, for security and operations

Like any web service, our server and Cloudflare, which carries traffic to it, process technical data such as IP addresses, request times, URLs and browser details to deliver pages, block abuse and fix errors. These records are used only for security and operations. The country in the download log comes from a header Cloudflare adds to each request, worked out from your IP address; we don’t use any other location service, and it’s never more precise than the country.

We don’t collect sensitive information (such as health, biometric or precise location data) and don’t ask for it.

3. Why we use it, and our legal bases

For people in the EEA and UK, the GDPR and UK GDPR require a legal basis for each use:

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Fair-use limits can automatically slow or pause new downloads for a while; a person reviews every pause, and suspending or closing an account is always decided by a person. If you think a pause is wrong, email [email protected].

4. Who we share it with

We share personal information only with the service providers that help us run Swifolio, each limited to what it needs:

Our server and database are self-hosted on hardware we control in the United States, reached only through Cloudflare. Email to and from us runs on our own mail server.

AI tools you connect. When you connect Claude, ChatGPT, Cursor or another AI tool, it receives what you approve on the consent screen (such as your name and email) and the designs and code it fetches for you. That tool’s provider handles that data under its own privacy policy, not ours.

We may also disclose information if the law requires it, to protect rights, safety or property (including enforcing our Terms), or as part of a merger, acquisition or sale of the business, in which case this policy will continue to apply to your information.

We don’t sell your personal information, and we don’t share it for cross-context behavioural advertising. We don’t use advertising cookies.

5. How long we keep it

• Account data (profile, sign-in records, saved designs, API keys, connected tools): while your account exists. When you delete your account, it is deleted from our live database, and from backups within 30 days.
• Sessions: a session expires 7 days after it was last used, and is deleted when you sign out, when you sign in on more than 3 browsers or devices (the oldest goes), or when you delete your account. Expired sessions and sign-in records are deleted by a regular cleanup.
• Download and security log: 90 days, then deleted by a regular cleanup, along with any security flags raised from it. Entries we need for an open dispute or to enforce our agreements may be kept until that’s resolved.
• Code fingerprints: for as long as code we delivered could be redistributed, including after your account is deleted, because the Code License’s restrictions outlive the account. The record holds only your account ID, the design and the watermark, not your name, email or IP address.
• AI tool tokens: access tokens expire after about an hour; refresh tokens and approvals last until you disconnect the tool in Settings, they expire, or you delete your account. Expired tokens, and registrations from AI tools that were never approved, are deleted by a regular cleanup.
• Billing records: Stripe keeps payment and invoice records for as long as tax, accounting and anti-fraud rules require, even after you cancel.
• Analytics: up to 1 year for events and up to 30 days for session recordings.
• Emails with us: as long as needed to help you, and up to three years after.

6. Cookies and similar technologies

We don’t use advertising cookies. You can block or delete cookies in your browser’s settings; the strictly necessary ones are needed to sign in and pay.

7. Security

We protect your information with encrypted connections, signed and short-lived access tokens, hashed API keys, access checks on every request for paid content, limits on sessions and downloads, and administrator access limited to the owner, with recent sign-in required. No method of transmission or storage is perfectly secure, so we can’t guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires.

8. International transfers

Swifolio is based in the United States, and your information is processed in the United States and wherever our providers operate. If you are in the EEA, UK or Switzerland, your information is transferred to the US. Where our providers receive it, they rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK Addendum, or the EU-US Data Privacy Framework.

9. Your rights

Everyone

Wherever you live, you can ask us to:

• give you a copy of your personal information, in a portable format;
• correct it (your name can be changed in Settings → Profile; your email comes from your sign-in provider);
• delete your account and personal information;
• stop analytics, by sending Global Privacy Control or blocking PostHog’s cookie in your browser.

To export your data or delete your account, email [email protected] from the address you sign in with. We may ask you to confirm it’s you. We reply within 30 days (45 days for US state-law requests, which we may extend once where the law allows). Deleting your account doesn’t cancel a Stripe subscription by itself, so cancel Pro first in Settings → Billing, or ask us to do both. We may keep information we must keep by law, or need to resolve disputes, prevent fraud or enforce our agreements.

EEA and UK (GDPR and UK GDPR)

You also have the right to restrict or object to our processing (including processing based on legitimate interests), to withdraw consent at any time without affecting earlier processing, and to complain to your local data protection authority (in the UK, the Information Commissioner’s Office). We’d appreciate the chance to help first.

California and other US states

Under the California Consumer Privacy Act as amended by the CPRA, and similar laws in other states (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon), you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing for cross-context behavioural advertising, or its use for targeted advertising or profiling; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.

• Categories we collect (in the last 12 months): identifiers (name, email, account IDs, IP address); commercial information (subscription and purchase records); internet or other electronic network activity (sessions, usage, and analytics with consent); and approximate geolocation derived from IP. Sources: you, your sign-in provider, Stripe and your browser. Purposes and recipients are described in Sections 3 and 4. Retention is described in Section 5.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioural advertising, and haven’t in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
• Sensitive personal information: we don’t collect it or use it to infer characteristics about you.
• Global Privacy Control: we honour GPC signals by not loading analytics.
• Authorised agents: an agent may make a request for you with your signed permission; we may ask you to confirm your identity directly.
• Appeals: if we decline your request, you can appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.

10. Children

The Service isn’t directed to children. You must be at least 13 to use it (16 in the EEA and UK). We don’t knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you believe a child has given us personal information, email [email protected] and we will delete it.

11. Changes to this policy

We’ll update this policy as the Service changes; the “Last updated” date shows the current version. If a change is material, we’ll tell you by email or on the Service before it takes effect, and ask for your consent again where the law requires.

12. Contact

Swifolio, the mailing address we provide on request to [email protected]. Email: [email protected]. See also our Terms of Service.