Swapizy

Privacy Statement

Last updated: July 24, 2026

This Privacy Statement explains how Utopia Applications LLC (“Swapizy”, “we”, “us”) collects, uses, stores, and discloses personal information when people in New Zealand use the Swapizy app, website, and related services. It is intended to meet the transparency requirements of the New Zealand Privacy Act 2020.

Agency and Privacy Officer

The agency responsible for your personal information is:

Utopia Applications LLC, 5830 E 2nd St, Ste 7000, PMB 24144, Casper, WY 82609-4308, United States

Our designated Privacy Officer oversees privacy requests, complaints, access and correction requests, and liaison with the Office of the Privacy Commissioner. Contact the Privacy Officer at support@utopiaapplications.com.

What Swapizy does

Swapizy is an item-swapping app. Users add items, choose one active item for exchange, browse nearby items, like or dislike items, and chat after a mutual match. Swapizy does not process payments or sell listed items.

Personal information we collect

We collect information needed to provide and protect the service:

  • Account and sign-in information: phone number, email address, username, profile photo, profile description, internal user ID, Google or Apple sign-in identifier when selected, account status, and authentication records.
  • Verification and anti-abuse information: SMS verification state and attempts, request times, IP address, rate-limit events, and related security signals.
  • Listing information: titles, descriptions, categories, photos, ownership, active and removal state, creation time, reports, and moderation state.
  • Swap activity: likes, dislikes, mutual matches, selected categories, active-item relationships, and related listing metadata.
  • Chat information: participants, messages, message metadata, read state, item details shown in chat, and attachments such as photos, videos, and audio contained in videos.
  • Precise location: latitude, longitude, and selected search radius. Other users receive a distance estimate, not your stored coordinates or exact address.
  • Device and notification information: Firebase Cloud Messaging token, Firebase installation or app-instance identifiers used for push delivery, device platform, app version, and limited delivery or diagnostic data generated by the push provider.
  • Product analytics and campaign information: app-instance identifier, first opens, sessions, screen and app interactions, the sign-in method selected, app version, operating system and device type, acquisition source, and approximate country or region inferred by the analytics provider.
  • Support, privacy, and safety information: reports, reviews, support messages, formal content notices, contact details supplied with a notice, screenshots or details you send, moderation decisions, blocks, and safety notes.
  • Technical information: request metadata, server and security logs, timestamps, response status, app user agent, error information, website CDN/security logs, a country-level region signal supplied by our CDN, and the regional-site preference stored in your browser.

We normally collect this information directly from you, your device, your chosen sign-in provider, or your use of Swapizy. We may also receive information from another user who reports content or conduct, from a service provider supporting the functions above, or from a lawful authority.

We do not sell personal information. Swapizy uses Firebase Analytics for aggregate product measurement and campaign attribution and optimisation. We do not send phone numbers, email addresses, stored precise location, listing content, or chat content to Firebase Analytics, and we do not set an account user ID in Analytics. The app does not configure Firebase Analytics to collect Apple’s IDFA or Android’s Advertising ID, and advertising-personalisation signals are disabled. Swapizy does not serve advertising, build advertising profiles, or track users across other companies’ apps or websites.

Why we collect and use it

We collect and use personal information to:

  • create, authenticate, and secure accounts;
  • verify phone numbers and provide Google or Apple sign-in;
  • show relevant items within selected categories and radius;
  • process likes, dislikes, matches, reviews, and chats;
  • store and deliver user-requested media;
  • send service and safety notifications;
  • provide support and respond to privacy, legal, and content-host complaints;
  • review reports, enforce rules, and block prohibited interactions;
  • automatically screen listing text and photos for prohibited or unsafe content and route uncertain results to human review;
  • prevent spam, fraud, account evasion, and unsafe behaviour;
  • maintain backups, monitor availability, and diagnose errors;
  • understand onboarding and general app usage and measure the effectiveness of campaigns;
  • open the appropriate regional website and remember a visitor’s manual market choice;
  • comply with valid legal obligations and protect legal rights.

If requested information is marked optional, you may choose not to provide it. Some features cannot work without the information they require, such as nearby discovery without a location or an account response without a working contact method.

Notice, permissions, and authorisation

Before registration, the app presents links to this Privacy Statement and the Terms of Use. By choosing to continue and create an account after receiving this notice, you authorise the collection, use, storage, and overseas processing needed to provide Swapizy as described here. The operating system separately asks for permission before the app accesses location, camera, microphone, photos, or notifications.

You may revoke an optional permission through your device, delete your account, or contact us. Revocation is not retroactive and does not prevent processing required to comply with law, protect users, investigate abuse, or resolve an existing dispute.

Service providers and other recipients

We disclose personal information only as needed to operate Swapizy, follow a valid legal requirement, or protect users and the service. Recipients may include:

  • Our hosting provider, which runs the backend and database and stores native chat data and video attachments.
  • Cloudflare Pages and CDN, which deliver the website; Cloudflare Images, which stores and delivers item, profile, and chat images; and Cloudflare R2 when enabled for restricted backup storage.
  • Cloudflare Workers AI, which analyses listing text and photos for marketplace-safety signals.
  • OpenAI, whose moderation API analyses listing text and photos for broad safety categories.
  • Stream, when Stream chat is enabled or needed to support legacy chat data.
  • Prelude, which sends and verifies SMS codes.
  • Firebase Cloud Messaging and Firebase Installations, which support push notifications; and Firebase Analytics, which provides aggregate product analytics and campaign measurement.
  • Google Sign-In and Apple Sign In, when you choose the corresponding sign-in method.
  • Apple and Google, which distribute the mobile apps and may process store, device, and diagnostic information under their own terms.
  • Professional advisers, courts, regulators, Netsafe, or law-enforcement bodies when disclosure is legally required or reasonably necessary to address fraud, abuse, safety, or legal claims.

Storage and disclosures outside New Zealand

Swapizy is operated by a United States company. Our primary service infrastructure and several providers process personal information in the United States and other countries. Those countries may not provide exactly the same remedies or protections as New Zealand.

Where an overseas provider acts only as our storage or processing agent, we require it to handle information for the service and under appropriate security and confidentiality controls. Where Information Privacy Principle 12 applies to a disclosure, we take reasonable steps to use a recipient subject to the New Zealand Privacy Act, comparable privacy safeguards, or contractual protections. If those grounds are unavailable, we rely on your express authorisation only after informing you that the recipient may not be required to protect the information in a way that, overall, provides safeguards comparable to the New Zealand Privacy Act.

Automated listing safety checks

When you create or edit a listing, its title, description, category, and photos may be sent to OpenAI and Cloudflare Workers AI for automated safety analysis. Swapizy does not intentionally include your phone number, email address, stored coordinates, or chat history in these listing checks. We store the resulting categories, confidence context, moderation status, and an audit history so that we can review decisions and protect the service.

A new or edited listing may remain hidden while a check is running. If an automated check finds a prohibited-content signal or cannot complete reliably, the listing is hidden from other users and placed in a private human-review queue. An AI result alone does not permanently reject a listing or ban an account; an authorised human makes those enforcement decisions. You may request human reconsideration by contacting support.

Retention and account deletion

We keep information while an account is active and for as long as reasonably needed for the purposes described above. Verification codes and pending uploads are short-lived. Operational, security, formal complaint, and moderation records are retained according to their purpose, and backup copies expire through normal rotation. Pseudonymous analytics events are retained according to the configured Google Analytics retention settings and may remain in aggregate, non-identifying reports.

The website’s swapizy_market preference cookie expires after 180 days. It contains only the selected market code. Country-level routing is used to choose a regional page, not to determine a precise location.

When you delete an account in the app, we immediately disable normal access, revoke refresh and push tokens, remove items from discovery, clear stored location and public profile details, remove account images from active storage where technically possible, anonymise chat display details, and freeze related chats.

Direct identifiers such as phone number, email, and social sign-in IDs may remain restricted for up to 180 days to prevent fraud, preserve report integrity, and stop ban evasion. They are then deleted or detached through scheduled cleanup unless a longer period is required by law, a valid legal request, an active dispute, a safety review, or an abuse investigation. De-identified chat, item, match, report, and audit context may be retained when needed to protect another user’s records, investigate safety issues, or establish legal claims. Backups may contain older copies until normal rotation completes.

See Delete account and data for the available deletion methods and additional details.

Access, correction, and other choices

You may ask us to confirm whether we hold personal information about you, obtain access to it, and correct information that is inaccurate. You may also ask for deletion, object to an optional use, revoke a permission for future collection, or request information about why information is held and who may receive it.

Many corrections and account deletion are available directly in the app. For another request, contact our Privacy Officer at support@utopiaapplications.com. We may verify control of the account before acting. If we do not make a requested correction, you may ask us to attach a statement of the correction sought where the Privacy Act requires it.

If you believe we have not resolved a privacy concern, you may complain to the New Zealand Office of the Privacy Commissioner.

Privacy breaches

We maintain a privacy-breach response process. If a breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless a lawful exception applies.

Security

We use measures designed for the nature and risk of the information, including HTTPS, restricted administrative endpoints, access controls, short-lived access tokens, rotating refresh tokens, rate limits, monitoring, backups, and provider security controls. No online service can guarantee absolute security.

Children

Swapizy is for adults and is not intended for anyone under 18. Do not create an account if you are under 18. Contact us if you believe a minor provided personal information.

Changes

We may update this statement as the service, providers, or legal requirements change. We will update the date above and provide additional notice or request renewed authorisation when required for a material change.

Contact

Privacy Officer, Utopia Applications LLC
5830 E 2nd St, Ste 7000, PMB 24144
Casper, WY 82609-4308, United States
support@utopiaapplications.com