Swapsy privacy policy

Last updated: 10 October 2026
Applies to: the Swapsy: Bike Swaps app for iPhone (version 1)

At a glance

• Swapsy is run by SteadyGen Ltd. We're responsible for your personal data under UK data protection law.
• We only collect what's needed to swap bikes safely: your account, profile, bikes, deals, chats and feedback.
• Your email address and home are never shown to other riders. They see roughly how far away you are, like "~7 mi away", and your county.
• Number plates are partly hidden, for example "AB21 •••". Once an offer is accepted, the full plate of the bike you're giving is also sent to the other rider's app. This version of the app still shows them only the hidden version, so ask each other for the full plate in the chat if you want to check it before you meet.
• No money goes through Swapsy yet. Any cash top-up is paid in person when you meet, so we never see your bank or card details.
• We don't use adverts or analytics, we don't track you, and we never sell your data.
• Your data is stored with Google Firebase in London. Google's sign-in service runs in the US (see section 7).
• You can edit your profile or delete your account in the app at any time. Some records you share with other riders, such as finished deals and feedback, stay after you leave, for 6 years after the deal ends (see section 8).
• Swapsy is for adults only (18+).

1. Who we are

Swapsy is run by SteadyGen Ltd, a company registered in England and Wales (company number 17441777).

• Registered office: 47 Norris Close, St. Albans, AL2 1UN
• Email: info@steadygen.co.uk
• Website: steadygen.co.uk

SteadyGen Ltd is the controller of the personal data in Swapsy. That means we decide how it's used and we're responsible for it. We've paid the data protection fee to the Information Commissioner's Office (ICO). Registration with the ICO: application C2055662 (registration number to follow). Our founder, James Howes, is responsible for data protection.

In this policy, "we" and "us" mean SteadyGen Ltd, and "you" means anyone using the Swapsy app.

2. What we collect, why, and our lawful basis

The law says we need a lawful basis for each use of your data. We rely on these:

• Contract: the data is needed to provide the service you signed up for.
• Legitimate interests: the use is something riders would reasonably expect, such as keeping Swapsy safe, and it doesn't override your rights. You can object to these uses (see section 10).
• Legal obligation: the law requires us to keep or share something.

Location and notifications on your iPhone only work if you give permission. You can change that in iPhone Settings at any time.

2.1 Your account

What we collect: your email address, your password, how you sign in (email or Apple), your username, the date you joined, whether your email is verified, your confirmation that you're 18 or over, and which version of our Terms of Use you accepted when you signed up, and when.

• Your password goes straight to Google's sign-in service (Firebase Authentication), which stores it in scrambled (hashed) form. We never see it.
• If you use Sign in with Apple, Apple gives us your email address and, if you choose to share it, your first name. If you picked "Hide My Email", we get a private relay address instead. We use your first name as your display name and suggest a username from it, and you can change both.
• Google's sign-in service also logs when you sign in, your IP address and your device type, to protect accounts from misuse.

Why: to create and protect your account, check your email address, reset your password, apply the 18+ rule, keep a record that you accepted our terms, and keep out fake or banned accounts.
Lawful basis: contract; legitimate interests (account security, and keeping under-18s and banned riders off Swapsy).

2.2 Your profile

What we collect:

• your username (required)
• your first name (optional)
• a profile photo (you need one before you can list a bike, make an offer or chat)
• a bio (optional, up to 300 characters)
• your county
• your founding member badge, if you have one

We also show your rating and how many deals you've completed. We work these out from feedback: other riders see the number of your finished deals that have feedback (from either of you). On your own profile, the count also includes finished deals nobody has left feedback on yet.

Why: so riders know who they're dealing with and meet the right person.
Lawful basis: contract; legitimate interests (trust and safety between riders).

2.3 Your location

Location is optional. You can let the app use your iPhone's location (only while you're using the app), or type a town or postcode instead.

• It's rounded straight away. The app asks your iPhone for a position accurate to about a kilometre and rounds it to about 1 km before saving it. It's then named after the nearest town in the app's built-in list.
• If you type a place, the app looks it up in its own list of towns and postcode districts. If the place isn't there, the app asks Apple's map service to find it. We save the place's rounded position and name, not your postcode.
• What's saved, and who sees it: your profile and each of your bikes have a location, kept in two copies:
  • Only you see the detailed copy: the ~1 km position and the town name.
  • The public copy is coarser: the position is snapped to a grid of roughly 5 km (about 3 miles) and shows your county, with no town name. Other riders' apps use it to work out distances.
• What other riders see: an approximate distance, such as "Under 2 mi away" or "~25 mi away", and your county. On the map, bikes are grouped into zones of about 3 miles, never pinned.
• When you browse, distances are worked out on your phone. Your current location isn't sent to us unless you save it to your profile or a listing.
• If you choose a town by hand, your phone also remembers it.
• Swapsy is only open in Hertfordshire and neighbouring counties for now. A bike can only go live if its location is in that area.

Why: to show bikes near you and how far away other riders are, and to keep swaps local.
Lawful basis: contract. You control location access in iPhone Settings > Swapsy > Location, and you can type a town instead.

2.4 Your bike listings

What we collect:

• Photos: 4 to 12, covering the whole bike, both sides, the odometer and any damage

• The bike: make, model, year, type, mileage, engine size (or motor power and battery range), condition and your description

• Paperwork: MOT status and expiry, service history and notes, and V5C status

• The deal you want: estimated value; what you'd swap for (types, makes, engine size, the most cash you'd add, how far you'd travel and any notes); and whether you offer delivery or collection

• The number plate (see 2.5) and the location (see 2.3)

• Photo data: before uploading a photo, the app shrinks it and saves it again. This removes hidden information that phone photos usually carry, such as the GPS position where the photo was taken. Don't include anything you don't want made public, like your house number or other people's faces.

• Who can see photos: listing and profile photos are public, and anyone with a photo's link can open it.

• Who can see listings: only you (and Swapsy support) can see a draft. Anyone using the app can see live listings, whether or not they're signed in.

Why: to list your bike and match it with possible swaps.
Lawful basis: contract.

2.5 Number plates

• Where it's kept: your full plate is saved in a record only you can open.
• What listings show: only the first four characters, for example AB21 •••. Very short plates are hidden completely.
• Who else sees it:
  • When an offer is accepted, the full plate of the bike they're getting is sent to the other rider's app. This version doesn't display it to them. They still see the partly hidden plate.
  • Swapsy support can see full plates.
• No history checks: this version of Swapsy doesn't check vehicle history, so your plate isn't sent to HPI, DVLA, DVSA or anyone else.
• Stolen bikes: if we have good reason to think a plate belongs to a stolen bike, we can flag that listing so it can't go live again. The flag is on the listing, not the plate. You can't remove it yourself. If you think we've got it wrong, contact us.

Why: to make handover checks possible and keep stolen bikes off Swapsy.
Lawful basis: contract; legitimate interests (preventing theft and fraud).

2.6 Deals and chat

What we collect:

• each offer: the bikes, any cash top-up, who pays it, and any note
• when an offer is accepted and the terms are locked
• the meetup: date, time, the public place and any notes
• who tapped "Deal complete", and when
• cancellations, with any reason given, and any problem reported on the deal
• chat messages, when they were sent and whether they've been read, plus automatic lines such as "Deal locked"

Payments: there are no in-app payments in this version. Any cash top-up is paid in person when you meet, so we never see bank or card details.

Scam warnings: when you send a message, the app checks it on your phone for common scam signs, such as a phone number, an email address, a link, or words like "bank transfer" or "deposit". If it finds one, it adds a warning to the chat that both of you see.

Inbox notices: when you do something in a deal (make an offer, send a message, suggest a meetup, leave feedback), the app puts a notice in the other rider's in-app inbox. The notice includes your name. For a chat message, it also includes the first 140 characters. If the other rider has allowed notifications, it's also sent to their phone as a push notification (see 2.10).

Quiet deals: the app cancels an accepted deal automatically if it goes quiet for 3 days and nobody has confirmed the handover. If only one of you confirmed, our support team reviews the deal instead. The 3 days always run until at least 48 hours after a meetup you've both agreed.

Why: to run swaps, keep a record you can both rely on, and keep people safe.
Lawful basis: contract; legitimate interests (scam warnings, safety and sorting out problems).

2.7 Feedback

After a completed deal, each rider can leave 1 to 5 stars and an optional comment of up to 280 characters.

• Feedback is public. It shows on the profile of the rider it's about, linked to the rider who left it.
• Feedback can't be edited once it's posted.
• We can remove feedback that breaks our rules.

Why: so riders can trust each other.
Lawful basis: legitimate interests (a fair, visible reputation system).

2.8 Reports, blocks and keeping Swapsy safe

• Reports: we keep what you reported (a bike, a profile or a deal), the reason, your details (up to 2,000 characters) and the date. Reports go to Swapsy support, not to the other rider. The exception is a problem reported on a deal: the reason and details also appear on that deal, so the other rider sees them.

• Our notes: when we deal with a report or a problem, we record what we decided and any notes.

• Blocks: we keep who you blocked and when. We don't tell the other rider, but their app needs to know about the block to hide you, so it isn't completely secret.

• Suspensions: when we suspend an account, we mark the profile as suspended and take its live bikes and bikes under offer off Swapsy until the suspension is lifted. We keep a record of the account ID and the date, even if the account is later deleted. So that deleting the account doesn't lift the suspension, we also keep the username of a suspended account that's deleted (nobody else can take it) and a coded form of its sign-in email and, for Sign in with Apple, of its Apple ID. The code is a one-way hash (SHA-256), not the address itself, and our team may also record it for the email when we suspend an account. A new account can't be set up with that email or Apple ID. Someone who signs up with a different email or Apple ID isn't caught by this, and our team deals with that by hand.

• Word filter: the app checks what you write, on your phone, against a short list of slurs and swear words. It won't accept slurs anywhere, won't publish swearing in usernames, names, bios, listings or feedback, and replaces swear words in deal chats with asterisks. Usernames can't include "Swapsy", "SteadyGen" or words such as "admin" or "support", and nor can names (except our own team's); our database rules also refuse these when a username or name is saved. Nothing you type is sent anywhere for the word check itself.

• Flags for our team: our admin screen flags things for a person to look at, such as:

  • a bike valued far below similar bikes
  • a brand-new account listing a bike worth £8,000 or more
  • a rider reported by two or more people
  • chat in a reported deal that suggests paying outside Swapsy

  A flag only prompts a closer look. A person always decides what happens.

Why: to protect riders, stop scams and stolen bikes, and enforce our rules.
Lawful basis: legitimate interests; legal obligation, when we must share information with the police or other authorities.

Some reports, such as a suspected stolen bike or a scam, may accuse someone of a crime. We use them only to keep Swapsy safe and to help the police. The law allows us to handle this kind of information for preventing or detecting unlawful acts and for preventing fraud (Data Protection Act 2018, Schedule 1, paragraphs 10 and 14).

2.9 Saved bikes, bike alerts and settings

What we collect:

• the bikes you've saved
• your bike alerts: what you're looking for, how far you'd travel, and any notes
• which notifications you've turned on

Only you can see these. Matching bikes to your alerts happens on your phone.

Lawful basis: contract.

2.10 Notifications

If you allow notifications, Swapsy sends your deal updates (new offers, counter-offers, chat messages, deal updates and feedback) to your iPhone as push notifications, even when the app is closed. Everything also appears in your in-app inbox, which is stored with your account, and the app icon badge shows how many unread items you have.

• What we store: while you're signed in with notifications allowed, the app saves your iPhone's push token (a code from Apple that lets us send notifications to Swapsy on that phone), whether it's an App Store or test build, the app version and when it was last refreshed. Only you can open this record in the app; our server reads it to send your notifications.
• How they're sent: our server code (Google Cloud Functions, in London) sends each notification through Apple's push notification service. It shows the other rider's name and what happened. For a chat message it shows the first 140 characters, so this text can appear on your lock screen.
• Your choices: turn each type off in Swapsy's notification settings, or turn notifications off in iPhone Settings > Swapsy > Notifications. Signing out or deleting your account deletes the push token. Match alerts aren't sent to your phone in this version.

Lawful basis: contract.

2.11 Technical information

• No tracking: we don't use analytics, advertising or tracking tools, we don't track you across other apps or websites, and we don't sell your data.
• Google: when your phone connects to Firebase, Google receives your IP address and basic connection details, as with any online service. Google says its sign-in service keeps logged IP addresses for a few weeks.
• On your iPhone:
  • Your sign-in token and a copy of your own profile are kept in the iPhone's secure Keychain, so you stay signed in when you lose signal.
  • The app also remembers a few settings, such as a town you chose and your distance filter.
  • Signing out or deleting your account clears the sign-in details.
• Apple: if "Share With App Developers" is turned on in your iPhone's settings, Apple may share crash reports and app usage statistics with us. You can turn it off in Settings > Privacy & Security > Analytics & Improvements.

Lawful basis: legitimate interests (running the app and keeping it secure).

2.12 If you contact us

If you email us, we keep your email address, what you tell us and our reply.
Lawful basis: legitimate interests (answering you and keeping a record).

What we don't collect

• bank or card details
• ID documents. You check each other's photo ID and V5C in person when you meet, and none of it goes through Swapsy.
• your contacts, your exact GPS position or your home address
• vehicle history check results (not in this version)

We don't ask for sensitive information, such as details of your health, religion or ethnic background. Please don't put it in your bio, listings or chats.

3. Where your data comes from

• You: when you sign up, fill in your profile, list a bike, make offers, chat, leave feedback or report something.
• Your iPhone: if you allow location, or when you choose photos.
• Apple: if you use Sign in with Apple.
• Other riders: offers, chat messages, feedback and reports that involve you.
• Google's sign-in service: sign-in records and IP addresses.
• Our support team: notes and decisions about reports and problems.
• People without an account: anyone can report a bike by email from a listing's Report this bike screen, which shows the listing's ID to include. We keep what they send us (see 2.12).

4. Who can see what

Anyone using Swapsy, even without an account, can see:

• your public profile: username, first name, profile photo, bio, county, join date, founding member badge, rating, number of completed deals, and whether the account is suspended
• feedback about you, and who left it
• your live bikes and bikes under offer, with all listing details, the partly hidden plate and an approximate distance
• your swapped or withdrawn bikes, if they have a direct link to them
• which of your bikes is in a deal with which other rider's bike (bikes under offer or swapped carry the same deal reference). Someone comparing listings could work out whose bikes were swapped for each other.

The other rider in a deal with you can also see:

• the whole deal: offers, cash top-ups, notes, meetup details, confirmations, cancellation reasons and any problem you report on that deal
• your chat messages, and the inbox notices your actions send them
• once an offer is accepted, the full plate of the bike you're giving them (sent to their app, although this version only displays the partly hidden plate)

Only you can see:

• your email address and how you sign in
• your detailed (~1 km) location and town name
• the full plates of your bikes (until an offer is accepted)
• your drafts, saved bikes, bike alerts, notification settings and inbox
• your iPhone's push notification registration (our server uses it to send your notifications)
• the list of your completed deals (others only see the number, as described in 2.2)
• which version of the Terms of Use you accepted, and when
• who you've blocked (see 2.8 for the one exception)

Swapsy support (SteadyGen staff) can see and do:

• In the app: our team can see all listings (including drafts and removed bikes), all public profiles, all reports and full plates, and can open any deal and its chat. We only open a deal's chat if it has been reported, a problem has been raised on it, or the law requires it.
• Actions: support can suspend accounts, remove listings, settle problems on deals and remove feedback.
• In Firebase: our team can look at stored data directly, including email addresses. We only do that for support, safety or legal reasons.

5. Who we share data with

We use these service providers to run Swapsy:

Google acts as our processor, under its data processing terms. Microsoft holds our emails for us under its data protection terms. For Sign in with Apple, push notifications, Apple Maps and the App Store, Apple also follows its own privacy policy.

We may also share information:

• with the police or other authorities, when the law requires it or to help prevent or investigate crime, such as a stolen bike or fraud
• with professional advisers, such as our solicitor or accountant, when needed
• with a buyer, if SteadyGen or Swapsy is ever sold or merged. We'd tell you if this happened.

We never sell your data or share it with advertisers.

Coming later, not in this version:

• Stripe, to hold cash top-ups safely until both riders confirm (escrow)
• the DVSA MOT History service, to check a bike's MOT record from its plate

These will mean sharing some data with new providers. We'll update this policy and tell you in the app before we turn any of them on.

6. Automatic checks

We don't make decisions about you or your account by computer alone. The scam warnings, admin flags and quiet-deal cancellations described in section 2 happen automatically. A person always decides on suspensions, listing removals and problems reported on deals.

7. Data stored outside the UK

• In London: our database and photos are stored, and our server code runs, in Google Cloud's London region (europe-west2).
• In the US: Google's sign-in service (Firebase Authentication) runs only from Google's US data centres. Your email address, scrambled password, sign-in records, IP address and device type are processed there.
  • Safeguards: Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection. Google acts as our processor under its data processing terms, which add further safeguards.
• Google staff: they may access stored data from outside the UK to run, secure and support the service, under the same terms.
• Microsoft: holds emails sent to info@steadygen.co.uk for us under its data protection terms, and may process them in other countries under the safeguards in those terms.
• Apple: may process data in other countries, under its own privacy policy and safeguards.

8. How long we keep your data

While your account is open, we keep your data, including withdrawn bikes and finished deals, so you can see your history.
Inactive accounts: in this version, we don't close accounts automatically if they aren't used. You can delete your account in the app at any time.

Deleting your account

You can delete your account in the app's Settings, using Delete account. For security, you may need to sign out and back in first. You can also delete it while it's suspended: sign in, and the app offers Delete my account.

You can't delete your account while:

• a handover is in progress (either of you has tapped "Deal complete"), or
• a problem report is open.

Finish the deal or report the problem first. This doesn't apply to a suspended account, which can't finish or report a deal.

Deleting your account removes straight away:

• your sign-in account (email, password and how you sign in)
• your public profile, first name, bio and location. Your username is freed, so someone else could choose it later (unless your account is suspended, see below).
• your private account record (email copy, 18+ confirmation, Terms of Use acceptance, ~1 km location)
• every photo you uploaded, both profile and bike photos
• the full number plate and ~1 km location of each of your bikes, unless we've flagged that bike as stolen (see the table below)
• your saved bikes, bike alerts, notification settings and inbox
• your push notification registrations, on every phone you've used
• your list of blocked riders
• the records that count your completed deals

It also:

• cancels any deal that hasn't reached the handover. The other rider is told.
• withdraws your live and draft bikes.

If your account is suspended, deleting it doesn't cancel deals or withdraw bikes, because the security rules don't let a suspended account change anything except delete its own data. Your bikes were already taken off Swapsy when you were suspended. The other rider can still close an open deal, and our support team reviews any that are stuck. Deleting a suspended account also doesn't lift the suspension: we keep your username reserved and a coded form of your sign-in email (and Apple ID, if you used Sign in with Apple), so they can't be used to set up a new account (see the table below).

If you used Sign in with Apple, Apple asks you to confirm when you delete your account, and we then tell Apple to disconnect Swapsy from your Apple ID. If that doesn't work and you choose to delete anyway, disconnect it yourself: in the Settings app, tap your name, then Sign-In & Security, then Sign in with Apple.

What we keep after you delete your account, and why

Once your account is deleted, these records point to a random account ID rather than your profile. Your messages, or the other rider's memory of the deal, may still identify you.

Other time limits

• Google sign-in data: Google says it removes deleted sign-in accounts from its live and backup systems within 180 days, and keeps logged IP addresses for a few weeks.
• Backups: we haven't switched on separate backups or point-in-time recovery for the Swapsy database, so we don't keep extra copies of records that have been deleted. Google may take some time to clear deleted data from its own systems, under its data processing terms.
• Emails to us: we keep them, with our replies, for 6 years after we've dealt with them, the same as reports and support notes.

9. Children

Swapsy is for adults only. You must be 18 or over to create an account, and we ask you to confirm this when you sign up. Anyone can browse bikes without an account, but we don't collect personal data from people who browse, apart from the basic connection details Google receives (section 2.11).

If we find out that an account belongs to someone under 18, we'll close it and delete their data, except anything we need to keep to protect other riders. If you think a child is using Swapsy, please email info@steadygen.co.uk.

10. Your rights

You have the right to:

• See your data: ask for a copy of the personal data we hold about you.
• Correct it: you can edit your profile and listings in the app, and ask us to correct anything else. You can't change chat messages or feedback once they're sent, because the other rider relies on them. If something is wrong or harmful, tell us.
• Delete it: delete your account in the app (section 8), or ask us to.
• Restrict it: ask us to pause using your data while we sort out a concern.
• Object: to anything we do on the basis of legitimate interests. We'll stop unless we have a strong reason to carry on, such as protecting other riders or a legal claim.
• Take it with you: ask for the data you gave us in a common, machine-readable format.
• Change your permissions: turn location or notifications on or off in iPhone Settings > Swapsy at any time.

How to ask: email info@steadygen.co.uk, ideally from the email address on your Swapsy account. If you use Hide My Email, tell us your username. It's free. We'll reply within one month. If a request is complex, we can take up to two more months, and we'll tell you if we need to. We may ask you to prove who you are first.

Some rights have limits. For example, we may keep a report about you if deleting it would put other riders at risk. If we can't do what you ask, we'll explain why.

11. How we protect your data

• Encryption: data travels over encrypted connections (HTTPS), and Google encrypts it when it's stored.
• Security rules: Firebase security rules run on Google's servers and control who can read or change each record. Your private details (email, detailed location and full plates) are kept in separate records that other riders can't open. The one exception is your full plate, which the other rider in a locked deal can read.
• Passwords: we never see your password.
• Admin rights: nobody can make themselves an admin from the app. Admin rights are only given by hand.
• On your phone: your sign-in token is kept in your iPhone's secure Keychain.
• Photos: hidden location data is removed before upload.

No system is completely secure. If a data breach is likely to put you at high risk, we'll tell you. When the law requires, we'll report breaches to the ICO within 72 hours.

You can help by using a strong password that you don't use anywhere else, keeping your chats inside Swapsy and never sharing your sign-in details.

12. Complaints

If you're unhappy with how we've handled your data, please contact us first at info@steadygen.co.uk and we'll try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects you significantly, we'll tell you in the app before it takes effect. That includes adding in-app payments or MOT checks. The latest version is always at https://steadygen.co.uk/swapsy/privacy, and there's a copy at https://swapsy-75a81.web.app/privacy.

14. Contact us

SteadyGen Ltd
47 Norris Close, St. Albans, AL2 1UN
Email: info@steadygen.co.uk
Website: steadygen.co.uk
Company number 17441777, registered in England and Wales
Registration with the ICO: application C2055662 (registration number to follow)