/privacy
Privacy policy
last updated · 2 November 2026
Short version
- We store only what the app needs: your GitHub or Google login details and what you do in the app.
- No analytics, no tracking scripts, no ads, no advertising cookies. Only the login cookie.
- Your web search history is deleted after 7 days.
- Your profile is private unless you choose to make it public, and you can switch it back at any time.
- You can download all your data or delete your account at any time from the avatar menu (top right).
Who is responsible (controller)
Enrique Achacoso, 1100 Wien, Austria
Email: achacoso.enrique [at] gmail.com
SwipeShip is a free, non-commercial project. We have not appointed a data protection officer and aren't required to.
What we store and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account (GitHub sign-in): GitHub user ID, username, display name, avatar URL, email address, sign-up and last sign-in time (via Supabase Auth) | To log you in, show your name and avatar, and check that a repo you submit belongs to you | Art. 6(1)(b) — providing the service you signed up for |
| Account (Google sign-in): Google account ID, name, email address, avatar URL, sign-up and last sign-in time (via Supabase Auth). If you later connect GitHub, both logins are linked to the same account | To log you in and show your name and avatar in the account menu | Art. 6(1)(b) |
| Profile: your GitHub username and avatar URL (copied from your GitHub login; empty if you only use Google), whether your profile is public, created/updated time | Your profile page and the public/private switch | Art. 6(1)(b); publishing it is based on your consent, Art. 6(1)(a) |
| Interests and level (optional): what you want to build (e.g. Web, Python) and your experience level, and when you answered or skipped the welcome screen. Never shown on your public profile | To show matching ideas first in your deck and not ask again | Art. 6(1)(b) |
| Saved and passed ideas | To show your saved list and not show you the same cards again | Art. 6(1)(b) |
| Ships: which idea you claimed, when, the suggested deadline, the GitHub repo URL you submitted, when it shipped, XP earned | Ship verification, XP and streaks | Art. 6(1)(b) |
| Removed ships: the idea, repo URL, XP and dates of a ship you removed | So the same repo can’t earn XP for the same idea twice | Art. 6(1)(f) — legitimate interest in fair XP |
| Legacy completions (from before October 2026): idea, time, and the link to the photo you uploaded | Kept so your old streak still counts | Art. 6(1)(b) |
| Web search log: the query text, time, number of results | Enforcing the daily limit of 10 web searches | Art. 6(1)(f) — legitimate interest in preventing abuse and keeping costs under control |
| Idea top-up requests: time of the request | Rate-limiting extra card generation | Art. 6(1)(f) |
When you search the web, the normalized query (e.g. “discord bot python”) is also stored next to the ideas it found, so the same search can be answered instantly later. That copy is not linked to you. Please don't type personal information into the search box.
When you submit a repo, our server asks the GitHub API for that repo's public details (owner, visibility, latest commits). Nothing about you is sent beyond the repo URL.
Optional public profile
Your profile is private by default. If you switch on “Make my profile public” (on the Streaks page), anyone with the link can see /u/your-github-name with:
- your GitHub username and avatar (a public profile needs a connected GitHub account; your Google name, email and avatar are never shown);
- a calendar of the days you shipped (past year), current and best streak, total XP and number of ships;
- the languages of the projects you shipped;
- your shipped projects with their title, date, XP and public repo link.
It never shows your email, saved or passed ideas, claimed-but-unshipped ideas or your searches. The page also has a preview image for link sharing (e.g. on X), built from the same public data.
This is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching the profile back to private or deleting your account. Our copy disappears immediately. Copies that others already made, such as link previews cached by social networks or search engines, are outside our control and may take some time to disappear.
Cookies and local storage
We set only the cookies Supabase needs to keep you signed in (named sb-…-auth-token). They are strictly necessary for the service you request, so no consent banner is needed (§ 165 (3) TKG 2021).
Your theme, mode and sound preference are saved in your browser's local storage (swipeship:theme, swipeship:mode, swipeship:sound). They never leave your device.
A copy of your interests and level, and small “already seen” flags for the welcome screen and the tutorial cards, are stored there too (keys starting with swipeship:prefs, swipeship:onboarded, swipeship:tutorial-done and swipeship:first-save-tip), so the app works instantly. Your interests and level are also saved to your account, as listed above.
There are no analytics, tracking pixels, ad networks or third-party scripts. Fonts are served from our own domain.
Who processes data for us
| Service | What for | What they receive |
|---|---|---|
| Supabase (database and login), hosted in the EU (Ireland) | Stores all data listed above | All data listed above, plus technical login logs (e.g. IP address) for security |
| Vercel (hosting) | Delivers the website and runs the server code | Technical request data (IP address, browser, page, time) in short-lived server logs |
| GitHub | Sign-in with GitHub, repo checks, idea sources; your browser loads your avatar image from GitHub | Your login (when you sign in); repo URLs you submit; search queries (not linked to you) |
| Google (sign-in) | Sign-in with Google; your browser loads your Google avatar image from Google | Your login (when you sign in). We only request your name, email address and avatar |
| Google (Gemini API) | Turns public posts and repos into idea cards | Only search queries and public source content — no personal data |
| Hacker News (Algolia) and dev.to | Idea sources for search | Only search queries, sent from our server — not linked to you |
| Cloudinary (legacy only) | Hosted the photos uploaded as proof before the ship flow existed; no new uploads | The legacy photos |
Some of these companies are based in the USA. Where personal data is transferred outside the EU, this happens on the basis of the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).
How long we keep it
- Account, profile, saved and passed ideas, ships: until you delete your account.
- Public profile page: visible only while your profile is switched to public.
- Web search log: 7 days, then deleted automatically.
- Idea top-up requests: unlinked from your account after 7 days.
- Hosting logs: as long as Vercel keeps them (short-lived, for operations and security).
- When you delete your account, all your rows and your login are deleted immediately. Legacy proof photos on Cloudinary are removed on request — email achacoso.enrique [at] gmail.com.
Your rights
Under the GDPR you have the right to:
- access your data (Art. 15) and get it in a portable format (Art. 20) — use Download my data in the avatar menu;
- erasure (Art. 17) — use Delete account in the avatar menu;
- rectification (Art. 16), restriction (Art. 18) and objection to processing based on legitimate interest (Art. 21);
- withdraw consent to your public profile at any time (Art. 7(3)) — switch it to private on the Streaks page.
For anything else, email achacoso.enrique [at] gmail.com. We answer within one month.
You can also complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at.
We don't make automated decisions with legal or similarly significant effects about you, and we don't build advertising profiles. Providing data is voluntary, but without a login you can only browse ideas, and shipping needs a connected GitHub account.