SwapThing Privacy Policy

Last updated: June 16, 2026

SwapThing helps people list items or services they have and find things they may want to swap for. This policy explains what information SwapThing collects, how it is used, and what choices users have.

📥 Information we collect

• Account information: email address, public handle, display name, password hash, account status, and optional profile details.
• Marketplace content: listings, descriptions, categories, images, wishlists, offer activity, and related metadata.
• Security information: login events, IP address, user agent, MFA challenge records, audit logs, and rate-limit events.
• OAuth information: if Google sign-in is enabled and you choose to use it, SwapThing may receive your Google account identifier, email address, and basic profile information needed to create or link your account.

⚙️ How we use information

• Provide account access, authentication, and marketplace features.
• Display public marketplace listings, profiles, and swap-related information.
• Protect the service from abuse, fraud, spam, and unauthorized access.
• Operate moderation, support, safety, and legal compliance workflows.
• Improve reliability, usability, and security of the application.

🤝 Information sharing

SwapThing does not sell personal information. Information may be shared only when needed to operate the service, comply with law, prevent abuse, protect users, or complete features that a user requests.

🌐 Public content

Listings, public handles, listing images, item descriptions, and public profile information may be visible to other users and visitors. Do not put private information in public listing fields.

🔎 Google user data

If Google OAuth is enabled, SwapThing only requests the basic account information needed for sign-in. Google user data is used for authentication and account linking. SwapThing does not sell Google user data or use it for unrelated advertising.

🗄️ Data retention

Account, listing, audit, and security records may be retained as long as needed to operate SwapThing, resolve disputes, enforce policies, prevent abuse, or comply with legal obligations. Demo/local development data may be reset during development.

🔐 Security

SwapThing uses reasonable technical controls such as password hashing, CSRF protection, session controls, security headers, audit logs, and MFA-related workflows. No system can be guaranteed completely secure.

✅ Your choices

• You may choose what to include in public listings and profile fields.
• You may request account or listing changes through the site owner/operator.
• You may stop using OAuth sign-in and use another available login method if supported.

✉️ Contact

For privacy questions or account data requests, email privacy@swapthing.org. For security disclosures or unsafe behavior, email security@swapthing.org or abuse@swapthing.org. General support is available at support@swapthing.org.