Privacy

Who is responsible

Swaipen UF is the controller of the personal data described here. Swaipen UF is a student company in Sweden’s Ung Företagsamhet programme. Contact people: Philip Einarsson and Jacob Beskow.

Address: Swaipen UF, c/o Sunnerbogymnasiet, Axel Roothsgatan 13, 341 41 Ljungby, Sweden. The school hosts the company and is not itself the controller.

Questions about your data, or requests for access, correction or deletion: privacy@swaipen.com. Help with the app: support@swaipen.com.

What information do we use in the app?

Account and profile

We process your account ID, username, display name and the profile details you choose to provide. Other signed-in members can find your profile by name or username in people search and see your public name and profile photo, as well as seeing you in shared rooms. If you register with email, our authentication provider Supabase also handles your email address and sign-in credentials. Confirmation and password reset emails are sent through an email delivery service we use for that purpose, which receives your email address and the message content. With Apple sign-in, we receive the identifier and profile details that you and Apple share. Apple may provide a relay address instead of your regular email address. We never receive your Apple password.

Swipes, saved titles and taste

We store the movies and shows you mark as Watch, Must watch, Seen or Nope, together with the title ID and when you made the choice. Your choices and taste preferences shape Today’s pick and your taste profile. Swaipen uses automated ranking for viewing suggestions, but makes no decisions about you with legal or similarly significant effects.

Shared rooms

When you create or join a room, we process the room code, host, participants, settings, room swipes and shared matches. Participants can see each other’s profile details and the room’s choices and results. Share a room code only with people you want to watch with.

Guest mode

Guest mode creates a temporary account ID with Supabase without an email address. Your swipes and rooms are linked to that ID, so guest mode does not mean everything stays on your phone. Your guest choices can be transferred if you create a regular account.

Profile photo

Adding your own photo is optional. Only the image you pick with the iOS photo picker is uploaded; we do not get access to your photo library. The photo is stored at a public image link and can be viewed by anyone who has that link, so choose an image you are comfortable sharing.

Notifications and technical information

If you enable push notifications, we process a device push token, your account ID, language and notification preferences to deliver the right message to your device through Apple. The Friday movie-night reminder is scheduled locally on your phone. If you separately opt in to Swaipen product announcements, we also use your push token, account ID, language and announcement preference to send optional news about the app. This marketing use relies on your consent, which you can withdraw in the app’s notification preferences without affecting your account or ordinary room messages. The services that deliver the app’s content and sign-in also handle technical connection information, such as IP addresses and request logs, for operation, troubleshooting and security.

When you contact us

We process your email address, your message and any information or images you send, so we can help you. Never send passwords. If you used social features in earlier test versions, saved friend relationships, groups and messages may also remain linked to your account.

The website and web rooms

The film previews, Wheel and Draft on the homepage are local demonstrations. Those demo choices reset when you reload. The room-code form takes you to a real Tonight room at /t/; joining and swiping there is not a local demonstration.

Joining a web room creates or reuses a Supabase guest account without an email or password. We save its account ID, your chosen display name, membership and votes on our backend. Room participants see your name and the room’s results. Your browser stores a sign-in session, chosen name, last room code and the version of the policy you agreed to, so you can return. Reloading, leaving a room or clearing browser storage does not delete the backend account or its data. Clearing the browser’s sign-in data can also prevent you from accessing that guest account again.

The public website and its web-room files are hosted by Simply.com. Simply receives connection information such as IP addresses and request details to serve the site and protect it against abuse. Supabase receives the information needed to authenticate guests and run the room. There are no advertising pixels or analytics scripts in the homepage. Trailers in real rooms are delivered by YouTube as described below; the homepage demos do not load its player.

Browser-only guests can request access or deletion by emailing privacy@swaipen.com. Keep the guest reference shown on the join screen or under Room options, along with the room code. Keep the original browser session available while we verify ownership. A reference locates a record; it is not by itself proof that you own it. Never send passwords, sign-in tokens or browser-storage contents. See help for web guests.

Why do we use this information?

We use the account, profile, swipe and room information needed to provide the service you choose to use: sign-in, saved titles, personal suggestions and shared matches. The legal basis is performance of our agreement to provide the service to you.

We use relevant information to protect accounts, prevent abuse, keep the service and website available and handle support, on the basis of our legitimate interest in a secure and working service. We limit processing to what each purpose requires. Where a law requires processing, we rely on that legal obligation.

You decide whether to enable notifications and can withdraw permission in iOS Settings. We do not sell your personal data, and Swaipen does not use your movie choices for its own targeted advertising.

Who receives the information?

The app’s database is hosted in Supabase’s Western Europe (Ireland) region. Supabase provides sign-in, the database, profile-photo storage and real-time room updates. Simply.com hosts the public website and Tonight web-room files. OpenAI Sites is used for website development and previews; it is not the host of this Simply deployment. Apple provides app distribution, optional Apple sign-in and push notifications. These providers process information according to their roles and terms. People in Swaipen UF who need information for operation or support may have access to it. We may also disclose information to comply with the law or a valid request from an authority.

Trailers and external links

Trailers are delivered by YouTube. Swaipen uses YouTube API Services to show trailers in the official player with YouTube’s privacy-enhanced mode. The native iPhone player uses a nonpersistent web container; the web-room player runs in your ordinary browser, where YouTube may use browser storage. If a trailer cannot be embedded, you can choose to open it in YouTube. When the player loads, Google/YouTube may receive technical information, information about the video being shown and information through cookies or similar technology. This can include browser or device identifiers, approximate location inferred from the IP address, player interactions, ad impressions and technical diagnostics. YouTube may show advertising and handles information under the Google Privacy Policy and the YouTube Terms of Service. You can turn off automatic trailer playback in Settings → Trailers.

Posters and other catalogue information may load from TheTVDB and related image services, so your device connects to the provider delivering the image. The app’s title pages may retrieve Swedish streaming options through our backend and the Streaming Availability API via RapidAPI. That request contains the title’s identifier and country, not your Swaipen account or saved swipes, and the answer is kept in a shared cache, normally refreshed after a week; older results may be shown if a lookup fails. If you open a streaming service or the search link to JustWatch Sweden, that service’s own privacy information applies. These outbound links do not include your account or saved swipes.

Processing outside the EU/EEA

Providers may process information in other countries, including outside the EU/EEA. Safeguards may include European Commission adequacy decisions or Standard Contractual Clauses. Contact us for information about the recipients and safeguards that apply to your data. Provider information is available from Simply.com, Supabase, Apple and Google.

How long is information kept?

Your account, profile and saved viewing choices are kept while you use the account, or until you remove them or the account. Room information is kept for the room’s function and results; a room code expiring does not by itself delete all history. Technical logs and support requests are kept as long as needed for troubleshooting, security, handling the request or a legal obligation. The purpose, the type of information and the status of the matter decide the retention period.

How to delete your account

In the app, open Profile → Settings → Delete account. You can export your verdicts there before you confirm. Deletion removes the account and its profile, saved choices and own room information from the active service, including profile photos you uploaded. Deletion cannot be undone.

The same option is available in guest mode. Delete before leaving guest mode if you want the data removed; signing out or uninstalling the app does not delete server data. Contact us if you cannot access the account. We may need to check that a request comes from the right person before we disclose or delete information.

Your rights

Under the data protection rules that apply, you can request access to your data, correction, deletion, restriction of processing and a copy of data covered by data portability. You can object to processing based on legitimate interests and withdraw consent for future processing. Withdrawal does not affect processing that already took place.

Email privacy@swaipen.com. We answer within the time the GDPR allows, normally one month. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

Changes to this policy

We update this page when the app, the website or our processing changes. The date at the top shows the latest version, and we will tell you about material changes in a way that suits the change.