# Privacy Policy

> What SwapShoot collects, image processing, website Library results (24 hours), developer API result access (18 hours), providers, retention and your rights.

- **URL**: https://swapshoot.com/privacy
- **Last Updated**: 2 November 2026

---

SwapShoot is an AI image-editing service (**SwapShoot**, **we**, **us**, or **our**). This Policy explains how we handle personal data when you visit the SwapShoot website, sign in, upload images, generate results or contact us.

**The short version:** we use account data to provide and protect the Service. Website Library results are kept for **24 hours after generation**. The developer API uses private temporary uploads and an **18-hour result-access window**; its access expiry and physical cleanup are described separately below. We do not use your images or outputs to train AI models, sell them, or publish them in a public gallery. Account, security and other legally required records are retained separately.

## 01 Who is responsible for your data

SwapShoot is responsible for the account, security, support and other personal-data processing described in this Policy. Where applicable, we act as a controller. If we process images solely on a business customer's documented instructions under a separate data-processing agreement, we may act as that customer's processor for that processing.

**Privacy contact:** [team@swapshoot.com](mailto:team@swapshoot.com?subject=SwapShoot%20privacy)

## 02 What we collect

| Category | Information and source |
|---|---|
| Account information | Your email address and account identifier provided through email sign-in or Google sign-in; for Google sign-in, also your name and profile picture. Firebase Authentication maintains the sign-in account record, and your profile is kept in our account database. We do not receive your Google password. |
| Images and processing data | The image to edit, the reference image, generated outputs and temporary files or image features needed to perform the edit. Images may contain personal data about you or someone else. |
| Service and consent records | Account/user ID, job reference, request time, processing duration, result or error status, usage limits and your permissions confirmation. These records never contain your photos. |
| Developer API records | Key names, prefixes, scopes, expiry/revocation and usage timestamps; a digest of each key rather than its full secret; temporary upload references, batch/item identifiers, idempotency receipts, credit holds and outcomes. Full key secrets are shown only when created. |
| Technical and security data | IP address, browser or device information, request paths, timestamps, authentication and security events, and related server logs generated when you use the Service. |
| Communications and reports | Messages, contact details, complaint information and any relevant evidence you choose to provide when you contact us or report misuse. |
| Purchase information | Order reference, purchased and used credits, transaction status, amount, currency, tax and invoice details. Payment providers process payment credentials under their own notices; free swaps do not require any payment details, and payments are made in crypto, never by card. |

Please do not submit unnecessary personal data, confidential documents or sensitive information unrelated to the requested edit. Do not upload images of minors or prohibited content. If image metadata contains location or other personal information, remove it before upload if it is unnecessary.

## 03 How images and face information are used

Your browser or authorised API client sends source images to our servers, which pass them to the processing services used for that request. Hugging Face supports the free experience and relevant image checks; paid generation and developer API inference use Modal. Producing a head or face replacement involves analysing visual features such as head position, facial appearance, hair and lighting, and may produce temporary crops, masks or other processing data. Website results are kept in your Library for 24 hours. API uploads and results use private Cloudflare R2 storage with the separate retention rules below.

We use this processing to perform the requested edit. We do not use your images to identify or authenticate people, create a persistent facial-recognition database, or sell face profiles. Some laws impose additional rules on particular uses of face information. Where those rules apply, any required additional notice or consent must be provided before that processing begins.

We do not use uploads, outputs or derived face information to train or fine-tune our own or a third party's AI models. Any future optional model-training programme would need a separate, clearly explained opt-in before the content was used. Refusing it would not change the terms of an already completed generation.

Routine generation is automated. Staff do not manually approve every output. Authorised personnel may access necessary information to resolve a support request, investigate reported misuse, respond to a security incident or comply with law. This does not authorise model training or routine public display.

## 04 Why we use personal data

We use the information described above to:

- create and maintain your account, authenticate access and provide requested generations;
- return results, administer usage limits and, if introduced, manage credit purchases and billing;
- protect the Service, investigate abuse, diagnose failures and improve operational reliability using appropriate service metadata;
- respond to support messages, privacy requests and complaints; and
- meet legal, tax, accounting, security and regulatory obligations and establish or defend legal claims.

Signed-up users receive a few product emails from SwapShoot: a welcome, tips if they have not tried a swap, and updates when free swaps run low or run out. Each email includes an unsubscribe link.

We do not sell or rent personal data, use your images in advertising, or share personal data for cross-context behavioural advertising.

Where the GDPR, UK GDPR or a similar law requires a legal basis, we use contractual necessity for account services requested by the account holder, legitimate interests where recognised for proportionate security, abuse prevention and service administration, legal obligations where applicable, and consent where required. A contract with an uploader does not by itself provide a contractual legal basis for processing another person's data. For people shown in uploaded images, the relevant permissions and any legally required consent must cover the actual image processing and intended use. If a feature requires explicit consent or another additional condition for protected face information, that requirement must be met before the feature is used.

Where we act as a business customer's processor, that customer is responsible for establishing the appropriate legal basis and notices for its instructions. We remain responsible for obligations that law independently assigns to us.

## 05 Images of other people

You may upload another person's image only if you have the required image rights, their informed permission for the proposed edit, and any consent required for our processing. You should make this Policy available to them before upload where required by law. Permission to use an ordinary photograph may not cover AI alteration or advertising use.

People whose likeness appears in an image can contact us directly, even without a SwapShoot account. We will assess privacy and misuse reports and assist with requests as required by our role and applicable law. If a file has already been deleted, we cannot recover it or remove copies independently held outside SwapShoot.

## 06 Cookies and browser storage

We use essential cookies, local storage or similar technology for sign-in sessions, security and necessary application functions. Firebase Authentication helps maintain your signed-in session. You can sign out or clear browser storage, although disabling necessary storage may stop parts of the Service from working.

When you follow a referral or affiliate link, first-party cookies remember the first link for each program for up to 30 days. Link codes are also carried through copied login links and email sign-in links. At verified signup, we record the introduction to issue eligible rewards or calculate affiliate commission. The link cookies are then cleared. Affiliates see sale amounts and commission status, not the referred customer's email or photos.

When enabled, Google Analytics uses analytics cookies and browser storage to measure public page visits, first-touch campaign attribution, account creation, swap outcomes and processing time, and successful contact and API enquiries. You can opt out by blocking Google Analytics in your browser or using [Google's Analytics opt-out browser add-on](https://tools.google.com/dlpage/gaoptout). Analytics stays off when it is not configured.

We do not use third-party advertising cookies or cross-site advertising trackers. Where consent is required for optional tracking technology, it must be obtained before activation. Signing out of SwapShoot does not necessarily sign you out of Google or clear data held independently by Google.

## 07 Who receives personal data

We disclose only information reasonably necessary for the purpose involved to:

- **Google Firebase**, for account sign-in, profiles, usage and service records, including API key digests and job metadata. Our account database may also temporarily hold website Library images where object storage is not used. See [Firebase privacy and security information](https://firebase.google.com/support/privacy) and [Google's Privacy Policy](https://policies.google.com/privacy).
- **Vercel**, which hosts the website and the application servers that handle sign-in, uploads, requests and service and security logs. See [Vercel's Privacy Policy](https://vercel.com/legal/privacy-policy).
- **Hugging Face**, for free image processing and relevant image checks. See [Hugging Face's Privacy Policy](https://huggingface.co/privacy).
- **Modal**, for the paid GPU engine and developer API inference. See [Modal's Privacy Policy](https://modal.com/legal/privacy-policy).
- **Cloudflare R2**, for private temporary API uploads and generated results, and website Library storage where configured. See [Cloudflare's Privacy Policy](https://www.cloudflare.com/privacypolicy/).
- **Communication and support providers**, to deliver necessary account communications and respond to messages and reports.
- **Payment and billing providers** (NOWPayments for crypto payments), to process authorised purchases and associated fraud, tax and billing matters. We will identify the provider at checkout and explain any material new data handling before payment collection starts.
- **Professional advisers and competent authorities**, where necessary for advice, legal claims, lawful requests or required reporting.

Providers processing data for us must do so under appropriate contractual instructions and safeguards. A provider may also process some information independently for purposes for which it is legally responsible, such as Google's own account services or a payment provider's fraud and regulatory duties.

If the business is involved in a merger, reorganisation or asset transfer, necessary personal data may be disclosed under confidentiality safeguards and transferred subject to applicable law. The recipient must be informed of the commitments in this Policy; any materially different use requires the notice and legal basis required by law.

## 08 Where processing takes place

Processing and storage locations depend on the provider and deployed configuration. We do not offer an EU-only processing or storage guarantee for the developer API. Firebase Authentication currently processes authentication data in the United States, and Modal, Cloudflare, Vercel and our other providers may process information in their operating locations.

Where international-transfer rules apply, we use the legally required safeguards, such as an applicable adequacy decision or approved contractual clauses with any necessary additional measures. Contact us for information about safeguards relevant to your data, subject to legitimate confidentiality restrictions.

## 09 Retention and deletion

| Information | Retention approach |
|---|---|
| Website input images and associated temporary processing files | Routine website uploads and processing files follow the website's **24-hour deletion window after upload**. API staging and queueing follow the separate rules below. |
| Website Library results | Kept for **24 hours after generation**, then deleted (normally within two hours). Download a result if you want to keep it. We do not offer long-term media storage. |
| Developer API uploads and queued inputs | Unclaimed uploads expire from API use after **30 minutes**. Accepted inputs remain private while needed for their queued items and any bounded in-progress read/send operation. We queue deletion after sending or when the item becomes terminal. Expired inputs cannot be reused for a new admission. |
| Developer API results | Authenticated access ends **18 hours after successful settlement**, even if physical cleanup has not finished. Deletion is queued for the next successful cleanup operation. Provider lifecycle rules and retrying deletion are backstops; outages can delay physical deletion, and we do not promise a fixed physical deletion deadline. Download results before their returned expiry time. |
| Developer API job and accounting metadata | Content-free jobs, batch and idempotency receipts are ordinarily retained for **30 days**. Per-account operational aggregates are kept while active and for 30 days after inactivity. Incomplete deletion records retain only the locators/status needed to retry cleanup; content-free records for unresolved upstream execution remain until provider reconciliation is complete. |
| Developer API keys and account closure | We keep a key digest and management metadata to authenticate and revoke access, never a stored copy of the full key secret. Account closure blocks the current API account generation before purge work; old keys and late results cannot restore access to a recreated account. Failed object deletion is retried independently of the closed account. |
| Account information | Kept while your account is active. When you delete your account, your profile and every result in your Library are deleted. We keep a minimal closed-account record (account identifier, email address, when the account was opened and closed, and how many free swaps it used) for 180 days, so a deleted account cannot restart its free allowance. |
| Service, consent-confirmation and security logs | Swap records (time, result or error status and processing duration, never the photos) are kept for 180 days, including after account closure. Security and server logs are kept for the period necessary to operate the Service, investigate misuse and meet legal duties. Longer retention is limited to a legal obligation, incident or documented legal need. |
| Purchase and invoice records, if applicable | Kept for the period required by applicable tax/accounting law and to resolve payment disputes. |
| Referral eligibility receipts | We keep a hash of the normalized email address, account identifiers and any reward receipt for the life of the referral program, including after account closure, to prevent the same inbox claiming a joining reward again. These receipts contain no photos and do not store the email address itself. |
| Affiliate and payout records | Affiliate codes, approval and commission terms, attributed sales, refunds and external payout references are retained separately from the customer profile, including after account closure, to administer the program and preserve its payment history. Closing an account does not erase these financial records. |
| Support messages, complaints and evidence | Kept while needed to handle the matter, complete any required preservation and address related legal claims, then deleted or anonymised. Images you separately submit as complaint evidence are handled as complaint records, rather than routine generation files. |

The website's 24-hour Library policy and the API's 18-hour access window are separate. Access expiry does not establish that every provider copy has already been physically erased; upstream processing retention and deletion depend on that provider's configuration and service operation. Account, security and other record categories follow the separate retention rules described above.

A specific legal preservation requirement, valid legal hold, reported abuse or security incident may require limited records or relevant available content to be retained longer. We restrict such retention to what is necessary and legally permitted. An exception does not mean we can recover material that has already been permanently deleted.

Copies you download, place on another service or share with someone else are outside our storage systems. Deleting your SwapShoot account does not delete those copies.

## 10 Your choices and rights

You can stop submitting images, sign out, or delete your account from your account page in the app. Account deletion ends normal access and starts deletion of account data, subject to the retention exceptions above. It does not require you to give up a complaint or billing right. For any other privacy request, email [team@swapshoot.com](mailto:team@swapshoot.com?subject=SwapShoot%20privacy%20request).

Depending on applicable law, you may ask to access, correct or delete personal data; obtain a portable copy; restrict or object to processing; withdraw consent for processing based on consent; or nominate another person to exercise rights where that right exists. Withdrawing consent does not invalidate earlier lawful processing or require us to erase records we must lawfully retain.

We may request proportionate information to verify a request or an authorised representative. Do not send government identification unless we request it through an appropriate channel. We aim to respond within one month and will meet any shorter applicable deadline. If a lawful extension is necessary, we will explain it within the original response period.

You can complain to a competent privacy regulator where applicable law provides that right. Statutory rights and regulatory complaint routes apply according to their legal scope and commencement dates.

## 11 Children

SwapShoot is for users aged 18 or older. Do not submit images depicting anyone under 18. If you believe a minor has an account or has been depicted through the Service, contact us so we can investigate, restrict access and delete or preserve/report information as legally required.

## 12 Security and incidents

We use reasonable technical and organisational measures appropriate to the information involved, including encrypted transmission, authenticated service access and restrictions on access to personal data. No system is completely secure.

We will investigate suspected incidents and make notifications to affected people or authorities when required by applicable law. If you suspect unauthorised access or another security issue, email [team@swapshoot.com](mailto:team@swapshoot.com?subject=SwapShoot%20security%20issue).

## 13 Privacy complaints

**Privacy complaints:** [team@swapshoot.com](mailto:team@swapshoot.com?subject=SwapShoot%20privacy%20complaint)

Describe your concern and provide a way to contact you. An account is not required to report a problem involving your likeness. We will handle complaints within applicable legal deadlines; content-removal and other urgent reports may require faster action than an ordinary privacy request.

## 14 Changes to this Policy

We will update this Policy when our practices change and revise the date above. We will give appropriate notice of material changes before they take effect and obtain fresh consent where required. We will not treat acceptance of a general policy update as permission for an incompatible new use of your images.