Privacy

Association SWAPSAC
French non-profit (loi du 1er juillet 1901)
RNA: W013005264
172 K allée des Cascatelles
01280 Prévessin-Moëns, France

Contact: hello@swapsac.com

• Email address: for login, account recovery and notifications.
• Password: stored hashed (bcrypt), never readable.
• Name or username (public) and, if you give them, first name and a short bio.
• City and country: to show nearby items. From them we derive a position (coordinates) to calculate distances. Positions shown to other members are rounded to about 1 km.
• Street and postal code: only if you choose to enter them. They are used to work out your position more precisely. Your street is never shown to other members.
• Optional contact details you add: phone, website, contact email.
• Your content: listings, activities, services, events, surveys, private messages and group messages.
• Photos of items: only if you add them to a listing. We strip all metadata from the photo (including GPS position) and reduce its size. It is stored at Supabase and can be opened by anyone who has its link.
• Copy of a reported post: when a post or message is reported, we keep a copy of its text (title, description or message, and the contact details of a notice) as it was at the time of the report. Only the moderation team can see it. It lets us review the report even if the author edits or deletes the post afterwards. Photos are not copied.
• Your language, so we write to you in it.

Swapsac has no profile photo.

browsing history, device identifiers, analytics, tracking pixels.

We do not sell, rent or trade your personal data, to anyone, ever. There is no advertising on Swapsac.

• Database and photos: Supabase, Ireland (AWS eu-west-1).
• Application: Koyeb, Frankfurt (Germany). Koyeb uses Cloudflare's network to route requests, so visitors' IP addresses pass through it.
• The providers below may process data outside the European Union; we send them only what is listed.

• Supabase: hosting of the database and of listing photos.
• Koyeb (with Cloudflare): application hosting.
• Resend: sends our emails (verification, password, notifications). It receives the recipient's email address and the message content.
• Nominatim (OpenStreetMap): turns a city, postal code or street into coordinates. It receives the address text entered, not your identity.
• GeoNames and geo.api.gouv.fr: look up the municipality for the Gazette. They receive a place name or coordinates, not your identity.
• Have I Been Pwned: when you choose a password, we check it against known breaches. Only the first 5 characters of its SHA-1 hash are sent. Your password and email are never sent.
• Open-Meteo: weather and air quality in the Gazette. Our server requests it with coordinates rounded to about 1 km.

These requests are made by our servers. Your browser only talks to swapsac.com. Fonts are hosted by us. There is no analytics, no advertising and no third-party script.

Like any host, Koyeb (and Cloudflare) record technical requests, which include your IP address, to run and secure the service. We do not store IP addresses in our database. Our application writes only technical errors and counters to its logs, never the content of your messages, passwords or addresses. How long those logs are kept is set by Koyeb. The service holds the IP address of failed login attempts in memory only (never in the database), erased at every restart of the service, to limit password-guessing attacks.

We send emails only when needed: account verification and password changes, new messages and exchange updates, group activity (new messages, join requests, approvals; each group can be muted), a change of date or place or the cancellation of an event you signed up for, and moderation notices. No newsletters, no SMS, no push notifications. The Gazette email alert is optional.

Until you delete your account.

The copy of a reported post is deleted 90 days after the report is dismissed, or 12 months after the post is removed or its author is warned. In every case it is deleted with its author's account.

You can ask for access to your data, correction, deletion and export. Write to hello@swapsac.com: we reply within one month at most. For an export we send your data as a readable file (JSON). Deletion removes your account and your content. You can also correct your profile yourself in your settings.

One cookie: swapsac_session, strictly necessary to stay logged in (lifetime: 1 year, not readable by JavaScript), set only when you log in. No tracking, no advertising, no third-party cookies.