HEAD → mainPRIVACY.md2026-10-18
Privacy
What tswap collects, why, who it shares it with, how long it keeps it, and how to get it back or have it deleted. Written to meet Québec’s Law 25 and to be read in five minutes.
01
Who is responsible
tswap is a Shadowlabs project. The person in charge of the protection of personal information can be reached at contact@testswap.app. Questions, access, correction and deletion requests go there; we reply within 30 days.
02
What we collect
Account: your email address (to send sign-in codes and the notifications you choose), and your Google account’s email if you sign in with Google.
X identity: your handle and, from your public X profile, your display name, picture, follower count, account creation date and verified mark. We read your public profile once to check the code in your bio and then on request; we never get your X password or access to your account.
Phone check (optional): the number is used to send one code and is kept only as a one-way fingerprint so the same number cannot be used twice.
What you post and test: listings, icons and screenshots (re-encoded, with their hidden metadata removed), check-ins, proof screenshots, screen recordings, feedback, reviews, and the Google email you give a builder to join a closed test (shared only with that builder).
Website tests: the tswap snippet on a tested site reports only that a test-link visit started and how long it lasted. It never records keystrokes, form contents or other visitors.
Safety signals: hashed fingerprints of the device and network you use, to catch duplicate and fake accounts.
Payments: Stripe handles your card; we keep the order, the amount and its status, never card numbers.
03
What we don’t do
No advertising, no selling or renting data, no tracking across other sites, no location tracking. Analytics (Umami) are cookieless, count page views on public pages only and keep no personal data.
04
Who we share it with
Other members see what is public by design: your handle, picture, profile, listings, public reviews and badges. Builders see the proof and feedback you send them.
Service providers that process data for us only: DigitalOcean (servers, database and files), Resend (email), Twilio (text messages), Stripe (payments), Cloudflare Turnstile (bot check), Google Safe Browsing (checking the address of a listed website) and a public X profile reader (fxtwitter).
These services, and our servers, are in the United States (DigitalOcean NYC3). Information is therefore stored outside Québec; we chose providers whose protection is comparable and keep what they receive to the minimum.
05
How long we keep it
Screen recordings: deleted 30 days after the test is approved. Unfinished uploads: deleted within a day.
Notifications and device fingerprints: 180 days. Website-test sessions: 90 days. Tour progress and private activity: 1 year. Text-message log: about 13 months. Audit trail: 2 years.
Everything else stays while your account exists, and goes when you delete it (below).
06
Your rights
Settings → Your data: download everything tied to your account as a file, or delete your account.
Deleting your account removes your profile, listings and their tests, the tests you joined, uploads, recordings, feedback, reviews, credits and orders, and signs you out everywhere. What stays: the audit trail of actions, which holds an account number but no name and is purged after 2 years; Stripe’s own payment records, which Stripe keeps as the law requires; and, only if you were banned, the handle, email and hashed phone and device that keep a banned person from coming back.
You can also ask us at contact@testswap.app to access, correct or delete your information, or to stop a use you never agreed to. You may complain to the Commission d’accès à l’information du Québec.
07
Cookies
One sign-in cookie, and two small preferences (language and light or dark theme). No advertising or tracking cookies.
08
Changes
If this page changes in a way that matters, we tell members by email or in the app before it applies.