Swapsy privacy policy

Last updated: 17 October 2026
Applies to: the Swapsy: Bike Swaps app for iPhone and Android (version 1.1)

Previous version (1.0)

At a glance

• Swapsy is run by SteadyGen Ltd. We're responsible for your personal data under UK data protection law.
• We only collect what's needed to swap, buy and sell bikes safely: your account, profile, bikes, requests and deals, chats and feedback.
• Your email address and home are never shown to other riders. They see roughly how far away you are, like "~7 mi away", and your county.
• Number plates are partly hidden, for example "AB21 •••". Once a deal is agreed, the full plate of the bike you're giving is also sent to the other rider's app. This version of the app still shows them only the hidden version, so ask each other for the full plate in the chat if you want to check it before you meet.
• Frame numbers are private. Only you can see your bike's frame number until you agree a deal. Then the rider you agreed it with can see it, so you can check it together at the handover.
• No money goes through Swapsy. The price of a sale, or any cash top-up in a swap, is paid face to face at the handover, in cash or by bank transfer between you. We never see your bank or card details.
• Some checks are automatic, such as request limits, a day's wait before a new account can buy, and requests closing after 7 days without a reply. A person always decides on suspensions and removals (see section 6).
• We don't use adverts or analytics, we don't track you, and we never sell your data.
• Your data is stored with Google Firebase in London. Google's sign-in service runs in the US, and on Android, notifications are sent through Google's push service (see sections 2.10 and 7).
• You can edit your profile or delete your account in the app at any time. Some records you share with other riders, such as finished deals and feedback, stay after you leave, for 6 years after the deal ends (see section 8).
• Swapsy is for adults only (18+).

1. Who we are

Swapsy is run by SteadyGen Ltd, a company registered in England and Wales (company number 17441777).

• Registered office: 47 Norris Close, St. Albans, AL2 1UN
• Email: info@steadygen.co.uk
• Website: steadygen.co.uk

SteadyGen Ltd is the controller of the personal data in Swapsy. That means we decide how it's used and we're responsible for it. We've paid the data protection fee to the Information Commissioner's Office (ICO). ICO registration number: ZC270943. Our founder, James Howes, is responsible for data protection.

In this policy, "we" and "us" mean SteadyGen Ltd, and "you" means anyone using the Swapsy app.

2. What we collect, why, and our lawful basis

The law says we need a lawful basis for each use of your data. We rely on these:

• Contract: the data is needed to provide the service you signed up for.
• Legitimate interests: the use is something riders would reasonably expect, such as keeping Swapsy safe, and it doesn't override your rights. You can object to these uses (see section 10).
• Legal obligation: the law requires us to keep or share something.

Location and notifications on your phone only work if you give permission. You can change that at any time in iPhone Settings > Swapsy, or on Android in Settings > Apps > Swapsy.

2.1 Your account

What we collect: your email address, your password, how you sign in (email or Apple), your username, the date you joined, whether your email is verified, your confirmation that you're 18 or over, and which version of our Terms of Use you accepted, and when. When we update the terms and ask you to accept the new version in the app (as we do for version 1.1), we record the new version and the date in the same way.

• The date you joined is also used to check that your account is at least a day old before you can send a request to buy a bike (see section 6).
• Your password goes straight to Google's sign-in service (Firebase Authentication), which stores it in scrambled (hashed) form. We never see it.
• If you use Sign in with Apple, Apple gives us your email address and, if you choose to share it, your first name. If you picked "Hide My Email", we get a private relay address instead. We use your first name as your display name and suggest a username from it, and you can change both.
• The Android app only offers email sign-in. If you signed up with Apple on an iPhone and your Apple account uses your real email address (not a Hide My Email address), you can set a password with Forgot password? and sign in with that email on Android.
• Google's sign-in service also logs when you sign in, your IP address and your device type, to protect accounts from misuse.

Why: to create and protect your account, check your email address, reset your password, apply the 18+ rule, keep a record that you accepted our terms, and keep out fake, scam or banned accounts.
Lawful basis: contract; legitimate interests (account security, and keeping under-18s and banned riders off Swapsy).

2.2 Your profile

What we collect:

• your username (required)
• your first name (optional)
• a profile photo (you need one before you can list a bike, send a request to swap or buy, or chat)
• a bio (optional, up to 300 characters)
• your county
• your founding member badge, if you have one

We also show your rating and how many deals you've completed. We work these out from feedback: other riders see the number of your finished deals that have feedback (from either of you). On your own profile, the count also includes finished deals nobody has left feedback on yet.

Why: so riders know who they're dealing with and meet the right person.
Lawful basis: contract; legitimate interests (trust and safety between riders).

2.3 Your location

Location is optional. You can let the app use your phone's location (only while you're using the app), or type a town or postcode instead.

• It's rounded straight away. On an iPhone, the app asks for a position accurate to about a kilometre. On Android, it only asks for approximate location (never precise location). Either way, the app rounds the position to about 1 km before saving it, and names it after the nearest town in the app's built-in list.
• If you type a place, the app looks it up in its own list of towns and postcode districts. If the place isn't there, the app asks your phone's map service to find it: Apple's on an iPhone, or on Android the phone's geocoding service, which Google provides on most Android phones. It receives what you typed. We save the place's rounded position and name, not your postcode.
• What's saved, and who sees it: your profile and each of your bikes have a location, kept in two copies:
  • Only you see the detailed copy: the ~1 km position and the town name.
  • The public copy is coarser: the position is snapped to a grid of roughly 5 km (about 3 miles) and shows your county, with no town name. Other riders' apps use it to work out distances.
• What other riders see: an approximate distance, such as "Under 2 mi away" or "~25 mi away", and your county. On the map, bikes are grouped into zones of about 3 miles, never pinned.
• When you browse, distances are worked out on your phone. Your current location isn't sent to us unless you save it to your profile or a listing.
• If you choose a town by hand, your phone also remembers it.
• Swapsy is UK only. Riders and their bikes must be in the UK.

Why: to show bikes near you and how far away other riders are, and to keep swaps local.
Lawful basis: contract. You control location access in iPhone Settings > Swapsy > Location, or on Android in Settings > Apps > Swapsy > Permissions, and you can type a town instead.

2.4 Your bike listings

What we collect:

• Photos: 4 to 12, covering the whole bike, both sides, the odometer or display (if it has one) and any damage

• The bike: make, model, year, type, mileage, engine size (or motor power and battery range), condition and your description

• Paperwork: MOT status and expiry, service history and notes, and V5C status

• Road use and your answers about it: whether the bike is road legal or off-road only; for electric bikes, whether the motor can move the bike faster than 4 mph without pedalling; for electric motorbikes, whether it has been derestricted; for off-road bikes, your confirmation that it isn't road legal; and whether you have proof of purchase (yes or no)

• How you want to deal: Swap only, For sale at a fixed price, or For sale or swap, and whether a swap-only bike is "Open to swap offers"

• For a bike for sale: the asking price. Up to 3 of your bikes can be for sale at once, so we also keep a small record, only you can open, of which of your bikes are using those 3 places

• For a swap: the estimated value; what you'd swap for (types, makes, engine size, the most cash you'd add, how far you'd travel and any notes); and whether you offer delivery or collection

• Sale status: whether the bike has a swap or sale agreed, and whether it has been swapped or sold on Swapsy

• The number plate and frame number (see 2.5) and the location (see 2.3)

• Photo data: before uploading a photo, the app shrinks it and saves it again. This removes hidden information that phone photos usually carry, such as the GPS position where the photo was taken. Don't include anything you don't want made public, like your house number or other people's faces.

• Who can see photos: listing and profile photos are public, and anyone with a photo's link can open it.

• Who can see listings: only you (and Swapsy support) can see a draft. Anyone using the app can see live listings, including the asking price and your answers about road use and proof of purchase, whether or not they're signed in. A bike with a swap or sale agreed stays visible, greyed out, until the deal is finished or cancelled.

• Make and model can't include contact details. The app and our security rules refuse a make or model that looks like a phone number, an email address or a link.

Why: to list your bike, show it to riders who want to swap or buy, match it with possible swaps, keep Swapsy for private riders, and make clear which bikes aren't road legal.
Lawful basis: contract; legitimate interests (keeping Swapsy for private riders, and preventing fraud and unsafe riding).

2.5 Number plates and frame numbers

• Where they're kept: your bike's full number plate and its frame number are saved in records that only you and Swapsy support can open. They're never in the public listing.
• What listings show: only the first four characters of the plate, for example AB21 •••. Very short plates are hidden completely. Frame numbers aren't shown at all.
• Frame numbers: off-road bikes and electric bikes need one, and road bikes can have one. Only you can see your bike's frame number until you agree a deal. Then the rider you agreed it with can see it, so you can check it together at the handover. It appears on their handover checklist until the deal is finished or cancelled.
• Who else sees the plate:
  • When a deal is agreed, the full plate of the bike they're getting is sent to the other rider's app, until the deal is finished or cancelled. This version doesn't display it to them. They still see the partly hidden plate.
  • Swapsy support can see full plates and frame numbers.
• No checks: this version of Swapsy doesn't check vehicle history or frame numbers, so your plate and frame number aren't sent to HPI, DVLA, DVSA, BikeRegister or anyone else. Swapsy never says a bike is "verified".
• Stolen bikes: if we have good reason to think a plate or frame number belongs to a stolen bike, we can flag that listing so it can't go live again. The flag is on the listing, not the plate or frame number. You can't remove it yourself. If you think we've got it wrong, contact us.

Why: to make handover checks possible and keep stolen bikes off Swapsy.
Lawful basis: contract; legitimate interests (preventing theft and fraud).

2.6 Requests, deals and chat

What we collect:

• each request: whether it's to swap or to buy, the bikes, the price or any cash top-up, who pays it, and when it was sent. The first message is written by the app from these details, and the names of the bikes are saved when the request is sent, so they can't change afterwards. (Deals made with older versions of the app may also have a note the sender typed.)
• each counter-offer: the new terms, and who sent them
• whether the rider who was asked has replied, and when the chat opened
• when the request will close if nobody replies or the chat goes quiet (see below)
• for an off-road bike: your confirmation that you understand the bike you'd receive isn't road legal, and when you gave it
• when a request or counter-offer is accepted and the terms are agreed
• the meetup: date, time, the public place and any notes
• who tapped "Deal complete", and when. When a sale is complete, the bike is marked Sold.
• declines, withdrawals and cancellations, with the reason chosen (before the chat opens, only the app's fixed reasons can be used), and any problem reported on the deal
• chat messages, when they were sent and whether they've been read, plus automatic lines such as "Swap agreed. These terms are now final."

Payments: there are no in-app payments. The price of a sale, or any cash top-up in a swap, is paid face to face at the handover, in cash or by bank transfer between you. We never see bank or card details, and we don't record how you paid. The deal does record the agreed price and the bike, and the App Store lists this record of your sales and purchases as "Purchase History". If you type bank details into the chat once it's open, they're stored with the chat like any other message (see section 8), so only share them when you're together at the handover.

Chat opens after a reply: in a new request, nobody can type anything until the rider who was asked accepts, sends a counter-offer or replies. Our security rules enforce this.

Request limits: to stop riders being pestered or scammed, our server checks a few limits before it creates a request (see section 6). It counts your open requests from your deals. To count the requests you've sent in the last 24 hours, it keeps a small record of when you sent them. No app can open that record, and it's deleted automatically about 2 days after your last request.

Requests that close on their own: a request closes automatically if the rider who was asked doesn't reply within 7 days, or, once you're chatting, after 7 days with no new messages or offers. It also closes if one of its bikes is agreed in another deal or is no longer listed. Both riders get a notice, and an automatic line goes into the chat.

Scam warnings: when you send a message, the app checks it on your phone for common scam signs, such as a phone number, an email address, a link, or words like "deposit", "pay upfront", "courier" or "friends and family". If it finds one, it adds a warning to the chat that both of you see.

Inbox notices: when you do something in a deal (send a request, reply, send a counter-offer, agree, send a message, suggest a meetup, leave feedback), the app or our server puts a notice in the other rider's in-app inbox. The notice includes your name. A notice about a new request uses fixed wording, such as "Dan would like to buy your bike.", never the request itself. For a chat message, the notice includes the first 140 characters, and is only sent once the chat is open. If the other rider has allowed notifications, it's also sent to their phone as a push notification (see 2.10).

Quiet deals: the app cancels an agreed deal automatically if it goes quiet for 3 days and nobody has confirmed the handover. If only one of you confirmed, our support team reviews the deal instead. The 3 days always run until at least 48 hours after a meetup you've both agreed.

Why: to run swaps and sales, keep a record you can both rely on, keep requests fair, and keep people safe.
Lawful basis: contract; legitimate interests (request limits, scam warnings, safety and sorting out problems).

2.7 Feedback

After a completed deal, each rider can leave 1 to 5 stars and an optional comment of up to 280 characters.

• Feedback is public. It shows on the profile of the rider it's about, linked to the rider who left it.
• Feedback can't be edited once it's posted.
• We can remove feedback that breaks our rules.

Why: so riders can trust each other.
Lawful basis: legitimate interests (a fair, visible reputation system).

2.8 Reports, blocks and keeping Swapsy safe

• Reports: we keep what you reported (a bike, a profile or a deal), the reason (for example "Trader posing as private seller" or "Asked for a deposit or early payment"), your details (up to 2,000 characters) and the date. Reports go to Swapsy support, not to the other rider. The exception is a problem reported on a deal: the other rider is told that a problem has been reported on that deal, but not the reason or details. If you report it from version 1.0 of the app, the reason and details are also saved on the deal, so the other rider may see them.

• Our notes: when we deal with a report or a problem, we record what we decided and any notes.

• Blocks: we keep who you blocked and when. We don't tell the other rider, but their app needs to know about the block to hide you, so it isn't completely secret.

• Suspensions: when we suspend an account, we mark the profile as suspended and take its live bikes and bikes in an agreed deal off Swapsy until the suspension is lifted. We keep a record of the account ID and the date, even if the account is later deleted. So that deleting the account doesn't lift the suspension, we also keep the username of a suspended account that's deleted (nobody else can take it) and a coded form of its sign-in email and, for Sign in with Apple, of its Apple ID. The code is a one-way hash (SHA-256), not the address itself, and our team may also record it for the email when we suspend an account. A new account can't be set up with that email or Apple ID. Someone who signs up with a different email or Apple ID isn't caught by this, and our team deals with that by hand.

• Word filter: the app checks what you write, on your phone, against a short list of slurs and swear words. It won't accept slurs anywhere, won't publish swearing in usernames, names, bios, listings or feedback, and replaces swear words in deal chats with asterisks. Usernames can't include "Swapsy", "SteadyGen" or words such as "admin" or "support", and nor can names (except our own team's); our database rules also refuse these when a username or name is saved. Nothing you type is sent anywhere for the word check itself.

• No contact details in names: the app and our database rules refuse a display name, make or model that looks like a phone number, an email address or a link, so contact details can't reach another rider before a reply.

• Flags for our team: our admin screen flags things for a person to look at, such as:

  • a bike valued far below similar bikes
  • a brand-new account listing a bike worth £8,000 or more
  • a rider reported by two or more people
  • chat in a reported deal that asks for a deposit, early payment or moving off Swapsy
  • listing text that says a bike is derestricted, says "off-road only" on a bike with a number plate, or suggests a children's size or pit bike

  A flag only prompts a closer look. A person always decides what happens.

• Trader checks: Swapsy is for private riders. Our admin screen lists riders who have completed 6 or more deals in the last 12 months, with how many bikes they have for sale now. Our team may email a rider on the list to ask whether they buy and sell bikes as a business. Being on the list doesn't mean you've done anything wrong, and a person always decides what happens.

Why: to protect riders, stop scams and stolen bikes, keep Swapsy for private riders, and enforce our rules.
Lawful basis: legitimate interests; legal obligation, when we must share information with the police or other authorities.

Some reports, such as a suspected stolen bike or a scam, may accuse someone of a crime. We use them only to keep Swapsy safe and to help the police. The law allows us to handle this kind of information for preventing or detecting unlawful acts and for preventing fraud (Data Protection Act 2018, Schedule 1, paragraphs 10 and 14).

2.9 Saved bikes, bike alerts and settings

What we collect:

• the bikes you've saved
• your bike alerts: whether you're looking to swap, buy or either, what you're looking for, the most cash you'd add or the most you'd pay, how far you'd travel, and any notes
• which notifications you've turned on

Only you can see these. Matching bikes to your alerts happens on your phone.

Lawful basis: contract.

2.10 Notifications

If you allow notifications, Swapsy sends your deal updates (new requests, replies, counter-offers, chat messages, agreed deals, closed requests, deal updates and feedback) to your phone as notifications. Everything also appears in your in-app inbox, which is stored with your account. On an iPhone the app icon shows how many unread items you have; on Android, most phones show a dot on the icon instead.

• iPhone: notifications arrive even when the app is closed. While you're signed in with notifications allowed, the app saves your iPhone's push token (a code from Apple that lets us send notifications to Swapsy on that phone), whether it's an App Store or test build, the app version and when it was last refreshed. Our server code (Google Cloud Functions, in London) sends each notification through Apple's push notification service.
• Android: Android 13 and later ask for permission when you sign up, and again from the inbox or notification settings if you said not yet. For now, the app checks your inbox while it's running and shows a notification for each new item; nothing extra is stored. When we switch on notifications that arrive while the app is closed, Google's Firebase software on your phone will create a Firebase installation ID and a push token (codes that let Google's Firebase Cloud Messaging deliver notifications to Swapsy on that phone). The app saves the push token with "android", the app version and when it was last refreshed. Our server sends each notification through Firebase Cloud Messaging. We don't store the installation ID ourselves.
• Who can see it: only you can open your phone's registration in the app; our server reads it to send your notifications. Each notification shows the other rider's name and what happened. Notices about new requests use fixed wording, never the request itself. For a chat message it shows the first 140 characters, so this text can appear on your lock screen. If a message looks like a scam sign, or seems to contain bank details such as a sort code or account number, the notification says "Open the chat to read it" instead of showing the text.
• Your choices: turn each type off in Swapsy's notification settings, or turn notifications off in iPhone Settings > Swapsy > Notifications, or on Android in Settings > Apps > Swapsy > Notifications. Signing out deletes this phone's push token, and deleting your account deletes them on every phone. Match alerts aren't sent to your phone in this version.

Lawful basis: contract.

2.11 Technical information

• No tracking: we don't use analytics, advertising or tracking tools, we don't track you across other apps or websites, and we don't sell your data.
• Google: when your phone connects to Firebase, Google receives your IP address and basic connection details, as with any online service. Google says its sign-in service keeps logged IP addresses for a few weeks.
• On your phone:
  • On an iPhone, your sign-in token and a copy of your own profile are kept in the iPhone's secure Keychain, so you stay signed in when you lose signal. On Android, they're kept in the app's private storage, which other apps can't open and which is left out of Android backups and phone-to-phone transfers.
  • The app also remembers a few settings, such as a town you chose and your distance filter.
  • Signing out or deleting your account clears the sign-in details.
• Apple: if "Share With App Developers" is turned on in your iPhone's settings, Apple may share crash reports and app usage statistics with us. You can turn it off in Settings > Privacy & Security > Analytics & Improvements.
• Google Play: if your Android phone shares usage and diagnostics data with Google, Google Play may show us crash reports and app performance statistics. You can turn this off in your phone's Google settings.

Lawful basis: legitimate interests (running the app and keeping it secure).

2.12 If you contact us

If you email us, we keep your email address, what you tell us and our reply.
Lawful basis: legitimate interests (answering you and keeping a record).

What we don't collect

• bank or card details, or how you paid at the handover
• ID documents, V5Cs or receipts. You check each other's photo ID, V5C and proof of purchase in person when you meet, and none of it goes through Swapsy. For proof of purchase, we only record your yes or no answer.
• your contacts, your exact GPS position or your home address
• vehicle history check results (not in this version)

We don't ask for sensitive information, such as details of your health, religion or ethnic background. Please don't put it in your bio, listings or chats.

3. Where your data comes from

• You: when you sign up, fill in your profile, list a bike, send or answer requests, chat, leave feedback or report something.
• Your phone: if you allow location, or when you choose photos.
• Apple: if you use Sign in with Apple.
• Other riders: requests, counter-offers, chat messages, feedback and reports that involve you.
• Google's sign-in service: sign-in records and IP addresses.
• Our support team: notes and decisions about reports, problems and trader checks.
• Our server: request limits, request expiry and automatic closing, and the notices and chat lines that go with them (see section 6).
• People without an account: anyone can report a bike by email from a listing's Report this bike screen, which shows the listing's ID to include. We keep what they send us (see 2.12).

4. Who can see what

Anyone using Swapsy, even without an account, can see:

• your public profile: username, first name, profile photo, bio, county, join date, founding member badge, rating, number of completed deals, and whether the account is suspended
• feedback about you, and who left it
• your live bikes and bikes with a swap or sale agreed, with all listing details (including the asking price, how you want to deal, your road-use answers and whether you have proof of purchase), the partly hidden plate and an approximate distance. Never the frame number.
• your swapped, sold or withdrawn bikes, if they have a direct link to them
• which of your bikes is in a deal with which other rider's bike (bikes in an agreed deal, swapped or sold carry the deal reference). Someone comparing listings could work out whose bikes were swapped for each other. A sale names only the seller's bike, so listings don't show who bought it.

The other rider in a deal with you can also see:

• the whole deal: the request, counter-offers, the price or cash top-up, any notes on older deals, off-road confirmations, meetup details, confirmations, decline and cancellation reasons, and that you have reported a problem on that deal (if you reported it from version 1.0 of the app, also the reason and details you gave)
• your chat messages, and the inbox notices your actions send them
• once a deal is agreed, and until it's finished or cancelled: the frame number of the bike you're giving them (shown on their handover checklist), and its full plate (sent to their app, although this version only displays the partly hidden plate)

Only you can see:

• your email address and how you sign in
• your detailed (~1 km) location and town name
• the full plates and frame numbers of your bikes (until you agree a deal)
• your drafts, saved bikes, bike alerts, notification settings and inbox
• which of your bikes are using your 3 places for bikes for sale
• your phone's push notification registration (our server uses it to send your notifications)
• the list of your completed deals (others only see the number, as described in 2.2)
• which version of the Terms of Use you accepted, and when
• who you've blocked (see 2.8 for the one exception)

Swapsy support (SteadyGen staff) can see and do:

• In the app: our team can see all listings (including drafts and removed bikes), all public profiles, all reports, full plates and frame numbers, and the trader checks list (2.8), and can open any deal and its chat. We only open a deal's chat if it has been reported, a problem has been raised on it, or the law requires it.
• Actions: support can suspend accounts, remove listings, settle problems on deals, remove feedback and email riders about trader checks.
• In Firebase: our team can look at stored data directly, including email addresses. We only do that for support, safety or legal reasons.

5. Who we share data with

We use these service providers to run Swapsy:

Google acts as our processor, under its data processing terms. Microsoft holds our emails for us under its data protection terms. For Sign in with Apple, push notifications, Apple Maps and the App Store, Apple also follows its own privacy policy.

On Android, the geocoding service and Google Play are provided under Google's own privacy policy, in the same way Apple provides Apple Maps and the App Store.

We may also share information:

• with the police or other authorities, when the law requires it or to help prevent or investigate crime, such as a stolen bike or fraud
• with professional advisers, such as our solicitor or accountant, when needed
• with a buyer, if SteadyGen or Swapsy is ever sold or merged. We'd tell you if this happened.

We never sell your data or share it with advertisers.

Coming later, not in this version:

• Stripe, to hold cash top-ups safely until both riders confirm (escrow)
• the DVSA MOT History service, to check a bike's MOT record from its plate

These will mean sharing some data with new providers. We'll update this policy and tell you in the app before we turn any of them on.

6. Automatic checks

Some things happen automatically, so Swapsy stays fair and safe and the same rules apply to everyone:

• Before a request is created, our server checks that your account is set up (email verified, 18+ confirmed, profile photo, the current Terms of Use accepted) and not suspended or blocked, and the limits: up to 5 requests waiting for an answer, one per bike, 10 new requests in any 24 hours, 30 days before asking about the same bike after a decline, and 7 days after withdrawing a request.
• Buying: your account must be at least a day (24 hours) old, worked out from the date you joined.
• Bikes for sale: up to 3 at once.
• Requests close on their own after 7 days with no reply, or 7 days with no new messages or offers, or when one of their bikes is agreed in another deal or is no longer listed (2.6).
• Names and bike details that look like a phone number, an email address or a link are refused (2.8).
• Scam warnings, admin flags and quiet-deal cancellations (section 2).

When a check stops you, the app tells you why and, where there's a wait, when you can try again. None of these checks decides anything about you beyond what you can do in the app at that moment. A person always decides on suspensions, listing removals, trader checks and problems reported on deals. If you think an automatic check has got something wrong, email info@steadygen.co.uk and a person will look at it.

7. Data stored outside the UK

• In London: our database and photos are stored, and our server code runs, in Google Cloud's London region (europe-west2).
• In the US: Google's sign-in service (Firebase Authentication) runs only from Google's US data centres. Your email address, scrambled password, sign-in records, IP address and device type are processed there.
  • Safeguards: Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection. Google acts as our processor under its data processing terms, which add further safeguards.
• Google's push and geocoding services (Android): Firebase Cloud Messaging and the Android geocoding service run on Google's global network. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.
• Google staff: they may access stored data from outside the UK to run, secure and support the service, under the same terms.
• Microsoft: holds emails sent to info@steadygen.co.uk for us under its data protection terms, and may process them in other countries under the safeguards in those terms.
• Apple: may process data in other countries, under its own privacy policy and safeguards.

8. How long we keep your data

While your account is open, we keep your data, including withdrawn bikes and finished deals, so you can see your history.
Inactive accounts: in this version, we don't close accounts automatically if they aren't used. You can delete your account in the app at any time.

Deleting your account

You can delete your account in the app's Settings, using Delete account. For security, you may need to sign out and back in first. You can also delete it while it's suspended: sign in, and the app offers Delete my account.

You can't delete your account while:

• a handover is in progress (either of you has tapped "Deal complete"), or
• a problem report is open.

Finish the deal or report the problem first. This doesn't apply to a suspended account, which can't finish or report a deal.

Deleting your account removes straight away:

• your sign-in account (email, password and how you sign in)
• your public profile, first name, bio and location. Your username is freed, so someone else could choose it later (unless your account is suspended, see below).
• your private account record (email copy, 18+ confirmation, Terms of Use acceptance, ~1 km location)
• every photo you uploaded, both profile and bike photos
• the full number plate, frame number and ~1 km location of each of your bikes, unless we've flagged that bike as stolen (see the table below)
• the record of which of your bikes are using your 3 places for bikes for sale
• your saved bikes, bike alerts, notification settings and inbox
• your push notification registrations, on every phone you've used
• your list of blocked riders
• the records that count your completed deals

It also:

• cancels any request or deal that hasn't reached the handover. The other rider is told.
• withdraws your live and draft bikes.

If your account is suspended, deleting it doesn't cancel deals or withdraw bikes, because the security rules don't let a suspended account change anything except delete its own data. Your bikes were already taken off Swapsy when you were suspended. The other rider can still close an open deal, and our support team reviews any that are stuck. Deleting a suspended account also doesn't lift the suspension: we keep your username reserved and a coded form of your sign-in email (and Apple ID, if you used Sign in with Apple), so they can't be used to set up a new account (see the table below).

If you used Sign in with Apple and delete your account on an iPhone, Apple asks you to confirm, and we then tell Apple to disconnect Swapsy from your Apple ID. If that doesn't work and you choose to delete anyway, disconnect it yourself: in the Settings app, tap your name, then Sign-In & Security, then Sign in with Apple. The Android app can't ask Apple to do this, so if you delete your account on Android (or on a computer), go to account.apple.com, sign in, then choose Sign-In and Security > Sign in with Apple and stop using Swapsy.

What we keep after you delete your account, and why

Once your account is deleted, these records point to a random account ID rather than your profile. Your messages, or the other rider's memory of the deal, may still identify you.

Other time limits

• Google sign-in data: Google says it removes deleted sign-in accounts from its live and backup systems within 180 days, and keeps logged IP addresses for a few weeks.
• Backups: we haven't switched on separate backups or point-in-time recovery for the Swapsy database, so we don't keep extra copies of records that have been deleted. Google may take some time to clear deleted data from its own systems, under its data processing terms.
• Emails to us: we keep them, with our replies, for 6 years after we've dealt with them, the same as reports and support notes.
• The request counter: the record of when you sent requests in the last 24 hours (2.6) is deleted automatically about 2 days after your last request.

9. Children

Swapsy is for adults only. You must be 18 or over to create an account, and we ask you to confirm this when you sign up. Anyone can browse bikes without an account, but we don't collect personal data from people who browse, apart from the basic connection details Google receives (section 2.11).

If we find out that an account belongs to someone under 18, we'll close it and delete their data, except anything we need to keep to protect other riders. If you think a child is using Swapsy, please email info@steadygen.co.uk.

10. Your rights

You have the right to:

• See your data: ask for a copy of the personal data we hold about you.
• Correct it: you can edit your profile and listings in the app, and ask us to correct anything else. You can't change chat messages or feedback once they're sent, because the other rider relies on them. If something is wrong or harmful, tell us.
• Delete it: delete your account in the app (section 8), or ask us to.
• Restrict it: ask us to pause using your data while we sort out a concern.
• Object: to anything we do on the basis of legitimate interests. We'll stop unless we have a strong reason to carry on, such as protecting other riders or a legal claim.
• Take it with you: ask for the data you gave us in a common, machine-readable format.
• Change your permissions: turn location or notifications on or off in iPhone Settings > Swapsy, or on Android in Settings > Apps > Swapsy, at any time.

How to ask: email info@steadygen.co.uk, ideally from the email address on your Swapsy account. If you use Hide My Email, tell us your username. It's free. We'll reply within one month. If a request is complex, we can take up to two more months, and we'll tell you if we need to. We may ask you to prove who you are first.

Some rights have limits. For example, we may keep a report about you if deleting it would put other riders at risk. If we can't do what you ask, we'll explain why.

11. How we protect your data

• Encryption: data travels over encrypted connections (HTTPS), and Google encrypts it when it's stored.
• Security rules: Firebase security rules run on Google's servers and control who can read or change each record. Your private details (email, detailed location, full plates and frame numbers) are kept in separate records that other riders can't open. The one exception is the full plate and frame number of a bike in an agreed deal, which the other rider in that deal can read until it's finished or cancelled.
• Server checks: requests are created only by our own server code, which checks the limits in section 6. The record it uses to count your recent requests can't be opened by any app.
• Passwords: we never see your password.
• Admin rights: nobody can make themselves an admin from the app. Admin rights are only given by hand.
• On your phone: your sign-in token is kept in your iPhone's secure Keychain, or on Android in the app's private storage, which is left out of backups.
• Photos: hidden location data is removed before upload.

No system is completely secure. If a data breach is likely to put you at high risk, we'll tell you. When the law requires, we'll report breaches to the ICO within 72 hours.

You can help by using a strong password that you don't use anywhere else, keeping your chats inside Swapsy and never sharing your sign-in details.

12. Complaints

If you're unhappy with how we've handled your data, please contact us first at info@steadygen.co.uk and we'll try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects you significantly, we'll tell you in the app before it takes effect. That includes adding in-app payments or MOT checks. The latest version is always at https://steadygen.co.uk/swapsy/privacy, and there's a copy at https://swapsy-75a81.web.app/privacy.

14. Contact us

SteadyGen Ltd
47 Norris Close, St. Albans, AL2 1UN
Email: info@steadygen.co.uk
Website: steadygen.co.uk
Company number 17441777, registered in England and Wales
ICO registration number: ZC270943