Privacy policy
Last updated: 16 August 2026
Controller
Christian Albers, Zimmerstraße 38, 22085 Hamburg, Germany, hello@swopa.app
What we process
- Email address
- For signing in. Swopa uses no password and instead sends a single-use sign-in link to your address.
- Details about your home and what you are looking for
- District, housing type, cold rent, warm rent, number of rooms, living area, description text, and photos. Of these, only the district is publicly visible as an approximate location, never an exact address.
- Messages
- The content of your chats with other members. Only the two participants can read them.
- Reports and blocks
- If you report a member, we store your reason and the reported content. The reported person learns neither about the report nor who submitted it.
- Push notifications
- If you allow them, we store the device token needed to deliver them. The notification itself says only that a new message exists, never its content, names, listing details, or locations.
- Usage figures
- We count how many members used the app each day, from a value derived from your identifier that cannot be reversed and differs every day. Swopa embeds no analytics SDK and records no individual clicks, screen views, or searches.
Legal bases
Processing your sign-in, listing, and message data rests on Art. 6(1)(b) GDPR, because it is necessary to perform the contract of use. Reports, blocks, and the aggregated usage figures rest on Art. 6(1)(f) GDPR, because we have a legitimate interest in operating the platform safely and in knowing whether it is used at all. Push notifications rest on your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time in your device settings.
Processors
- Supabase
- Database, authentication, file storage. Your data is held in a region within the European Union.
- MailerSend (UAB MailerLite, Lithuania)
- Delivery of the sign-in emails. Processes your email address within the EU for that purpose.
- Firebase Cloud Messaging (Google Ireland Limited)
- Delivery of push notifications. This can involve transfers to the United States, covered by the standard contractual clauses and the EU-US Data Privacy Framework.
- Firebase Hosting (Google Ireland Limited)
- Delivery of these web pages. Requesting them creates server logs that contain your IP address. This can involve transfers to the United States, covered by the same clauses and framework.
- INWX GmbH & Co. KG
- Domain, and forwarding of email sent to hello@swopa.app.
- Apple and Google
- Distribution of the app through the App Store and TestFlight, or Google Play. Apple and Google are independently responsible for the processing that happens there.
Data processing agreements under Art. 28 GDPR are in place with all processors named above.
Retention
- Account data, listings, photos, and messages: for as long as your account exists.
- Reports: 24 months after they are resolved, so that repeated safety issues stay auditable.
- Backups: up to 30 days beyond deletion, and not reachable through the app.
Deleting your account
You can delete your account in the app yourself, without writing to us. This removes your account and the data attached to it: listings, photos, favorites, messages, and device registrations. In reports already submitted, the reason and the decision remain until the retention period above expires, with your reference in them removed.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on a legitimate interest. Write to hello@swopa.app for any of these. You can also lodge a complaint with a data protection supervisory authority, either the one where you live or the Hamburg authority responsible for us, Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.
This website
These pages set no cookies, load no external fonts, maps, or scripts, and measure no visits. Requesting them produces technical logs at Firebase Hosting, named above, that serve secure operation.