Swapizy

Privacy Policy

Last updated: July 24, 2026

This Privacy Policy explains how Utopia Applications LLC (“Swapizy”, “we”, “us”) processes information when you use the Swapizy app, website, and related services.

Data controller

The entity responsible for processing personal data is:

Utopia Applications LLC, 5830 E 2nd St, Ste 7000, PMB 24144, Casper, WY 82609-4308, United States

support@utopiaapplications.com

What Swapizy does

Swapizy is an item-swapping app. Users add items, choose one active item for exchange, browse nearby items, like or dislike items, and chat after a mutual match. Swapizy does not process payments or sell listed items.

Information we process

We process information needed to provide and protect the service:

Account and sign-in data: phone number, email address, username, profile photo, profile description, internal user ID, Google or Apple sign-in identifier when selected, account status, and authentication records.
Verification and anti-abuse data: SMS verification state and attempts, request times, IP address, rate-limit events, and related security signals.
Item data: titles, descriptions, categories, photos, ownership, active and removal state, creation time, reports, and moderation state.
Swap activity: likes, dislikes, mutual matches, selected categories, active-item relationships, and related item metadata.
Chat data: participants, messages, message metadata, read state, item details shown in chat, and attachments such as photos, videos, and audio contained in videos.
Precise location: latitude, longitude, and selected search radius. Other users receive a distance estimate, not your stored coordinates or exact address.
Device and notification data: Firebase Cloud Messaging token, Firebase installation or app-instance identifiers used for push delivery, device platform, app version, and limited delivery or diagnostic data generated by the push provider.
Product analytics and campaign data: app-instance identifier, first opens, sessions, screen and app interactions, the sign-in method selected, app version, operating system and device type, acquisition source, and approximate country or region inferred by the analytics provider.
Support and safety data: reports, review text, support messages, screenshots or details you send, moderation decisions, blocks, and safety notes.
Technical data: request metadata, server and security logs, timestamps, response status, app user agent, error information, and website CDN/security logs.

We do not sell personal information. Swapizy uses Firebase Analytics for aggregate product measurement and campaign attribution and optimization. We do not send phone numbers, email addresses, stored precise location, listing content, or chat content to Firebase Analytics, and we do not set an account user ID in Analytics. The app does not configure Firebase Analytics to collect Apple’s IDFA or Android’s Advertising ID, and advertising-personalization signals are disabled. Swapizy does not serve advertising, build advertising profiles, or track users across other companies’ apps or websites.

Before registration, the app presents links to these privacy disclosures and the Terms. By choosing to continue and create an account, you consent to the processing and international transfers necessary to provide Swapizy as described here. The operating system separately asks for permission before the app accesses location, camera, microphone, photos, or notifications.

You may revoke consent by changing an optional permission, deleting your account, or contacting us. Revocation is not retroactive and does not prevent processing required to comply with law, protect users, investigate abuse, or resolve an existing dispute. Some features cannot work without the data they require, such as nearby discovery without a location.

How we use information

We use information to:

create, authenticate, and secure accounts;
verify phone numbers and provide Google or Apple sign-in;
show relevant items within the selected categories and radius;
process likes, dislikes, matches, reviews, and chats;
store and deliver user-requested media;
send service and safety notifications;
provide support and respond to privacy requests;
review reports, enforce rules, and block prohibited interactions;
automatically screen listing text and photos for prohibited or unsafe content and route uncertain results to human review;
prevent spam, fraud, account evasion, and unsafe behavior;
maintain backups, monitor availability, and diagnose errors;
understand onboarding and general app usage and measure the effectiveness of campaigns;
comply with valid legal obligations and protect legal rights.

Service providers and recipients

We disclose data only as needed to operate Swapizy, follow valid legal requirements, or protect users and the service. Recipients may include:

Our hosting provider, which runs the backend and database and stores native chat data and video attachments.
Cloudflare Pages and CDN, which deliver the website; Cloudflare Images, which stores and delivers item, profile, and chat images; and Cloudflare R2 when enabled for restricted backup storage.
Cloudflare Workers AI, which analyzes listing text and photos for marketplace-safety signals. Cloudflare states that Workers AI customer content is not used to train AI models or improve Cloudflare or third-party services without explicit consent.
OpenAI, whose moderation API analyzes listing text and photos for broad safety categories.
Stream, when Stream chat is enabled or needed to support legacy chat data.
Prelude, which sends and verifies SMS codes.
Firebase Cloud Messaging and Firebase Installations, which support push notifications; and Firebase Analytics, which provides aggregate product analytics and campaign measurement.
Google Sign-In and Apple Sign In, when you choose the corresponding sign-in method.
Apple and Google, which distribute the mobile apps and may process store, device, and diagnostic data under their own terms.
Professional advisers, courts, regulators, or law-enforcement bodies when disclosure is legally required or reasonably necessary to address fraud, abuse, safety, or legal claims.

These providers act under their own privacy terms and may process data in the United States and other countries where they operate.

Automated listing safety checks

When you create or edit a listing, its title, description, category, and photos may be sent to OpenAI and Cloudflare Workers AI for automated safety analysis. Swapizy does not intentionally include your phone number, email address, stored coordinates, or chat history in these listing checks. We store the resulting categories, confidence context, moderation status, and an audit history so that we can review decisions and protect the service.

A new or edited listing may remain hidden while a check is running. If an automated check finds a prohibited-content signal or cannot complete reliably, the listing is hidden from other users and placed in a private human-review queue. The owner can see that the listing is under review. In the current process, an AI result alone does not permanently reject a listing or ban an account; an authorized human makes those enforcement decisions. You may request human reconsideration or appeal an enforcement decision by contacting support.

Automated systems can be wrong. We use several checks, keep an audit trail, and provide human review to reduce the effect of false positives. We may preserve or escalate evidence where reasonably necessary for child safety, imminent harm, illegal activity, a valid legal request, or another serious safety matter.

International transfers

Swapizy is operated by a United States company. The service providers listed above may process information outside your country of residence. By creating an account after receiving this notice, you consent to transfers needed to provide the service. We use access controls, encryption in transit, contractual provider protections, and other safeguards appropriate to the data and risk.

Retention and account deletion

We keep data while an account is active and for as long as reasonably needed for the purposes described above. Verification codes and pending uploads are short-lived. Operational, security, and moderation records are retained according to their purpose, and backup copies expire through normal rotation. Pseudonymous analytics events are retained according to the configured Google Analytics retention settings and may remain in aggregate, non-identifying reports.

When you delete an account in the app, we immediately disable normal access, revoke refresh and push tokens, remove items from discovery, clear stored location and public profile details, remove account images from active storage where technically possible, anonymize chat display details, and freeze related chats.

Direct identifiers such as phone number, email, and social sign-in IDs may remain restricted for up to 180 days to prevent fraud, preserve report integrity, and stop ban evasion. They are then deleted or detached through scheduled cleanup unless a longer period is required by law, a valid legal request, an active dispute, a safety review, or an abuse investigation. De-identified chat, item, match, report, and audit context may be retained when needed to protect another user’s records, investigate safety issues, or establish legal claims. Backups may contain older copies until their normal rotation completes.

See Delete account and data for the available deletion methods and additional details.

Your choices and rights

Subject to applicable law, you may request:

access to the personal data associated with your account;
correction or updating of inaccurate data;
deletion or cancellation of data;
objection to or restriction of particular processing;
revocation of consent for future processing;
information about the purposes and potential recipients of processing.

Many corrections and account deletion are available directly in the app. For another privacy request, email support@utopiaapplications.com. We may verify control of the account before acting. You may also use any complaint or privacy-protection remedy available from a competent authority or court under applicable law.

Security

We use measures designed for the nature and risk of the data, including HTTPS, restricted administrative endpoints, access controls, short-lived access tokens, rotating refresh tokens, rate limits, monitoring, backups, and provider security controls. No online service can guarantee absolute security.

Children

Swapizy is for adults and is not intended for anyone under 18. Do not create an account if you are under 18. Contact us if you believe a minor provided personal data.

Changes

We may update this policy as the service, providers, or legal requirements change. We will update the date above and provide additional notice or request renewed consent when required for a material change.

Contact

For privacy, legal, support, moderation, or account-deletion requests: