Skip to content
Swapdeck
Sign inGet started

Privacy policy

Who is responsible

Duemar International FZ-LLC, Compass Building, Al Hamra Industrial Zone-FZ Ras Al Khaimah, United Arab Emirates is the controller of the personal data processed through Swapdeck. Contact for anything in this policy: support@swapdeck.top.

What we store

  • Account: name, email address, a hash of your password (never the password), whether you signed up as curator or artist, optional profile picture, description and genres, the date and version of the terms you accepted, your plan and trial end date, your notification choices.
  • Sign-in and security: for each session the IP address, the browser identification, when it started and when it was last used; if you turn on two-factor sign-in, its secret (encrypted) and hashes of your recovery codes. Security-relevant events (sign-ins, failed sign-ins, password and plan changes, support access to your account) are written to an audit log together with the IP address.
  • Spotify accounts you connect: the Spotify user id, display name, picture and the email address of that Spotify account as Spotify reports it, and the access tokens (encrypted). For the playlists you choose to manage: their name, picture, follower count per day and track list.
  • Your catalog: the songs you add (title, artists, cover, release date, popularity per day), the genre and promotion budget you enter for them, and grades calculated from those numbers.
  • Activity with other members: connection requests and connections, members you blocked, reports you sent, swaps (songs, playlists, positions, dates, daily results), messages you send, replies to announcements, images you upload, referral relations (who invited whom).
  • Presence: the time you were last active, used to show your connections whether you are online and to hold back emails while you are.
  • Billing: no payment data is collected on this site.
  • Error reports: when the app fails in your browser it sends us the error message, the page address and, if you are signed in, your account id, so that we can fix it.
  • Email: a log line for each message we send you (address, subject, whether it was accepted), without the content.

Why, and on what legal basis

  • To provide the service you signed up for (performance of the contract): your account, Spotify connections, playlists, catalog, swaps, messages, billing.
  • To keep accounts and the service secure and to deal with abuse (our legitimate interest): session data, the audit log, rate limits, blocks and reports, error reports, server logs.
  • To tell you what happens in your account (performance of the contract and our legitimate interest): emails about swaps, connection requests, messages and announcements. Every type has its own switch under Profile, Notifications; they are on by default and each email links to the switches. Emails needed to run the account (confirming your address, resetting a password) cannot be switched off.
  • To meet legal obligations, such as keeping accounting records of payments.

What other members see

Your name, picture, description, genres, the playlists you marked visible, whether you accept new swaps, whether you are verified, and, for your connections, whether you are online. In a swap your partner also sees the songs, playlists, positions and results of that swap. Your email address is never shown to other members. New accounts are listed in Discovery; you can leave it at any time under Profile, Discovery.

Access by our staff

Administrators can see account details including your email address, plan and billing references. To answer a support request or handle a report they can open your account as you see it for up to one hour ("support session"): in that session they can read but not change anything, and cannot send messages, change your profile, security settings, Spotify connections or billing. They can also list your conversations with the name of the other member and the latest message, and delete a conversation that breaks the rules. Every one of these accesses is recorded in the audit log with the administrator's identity, and your own data export lists them.

Cookies and similar storage

One essential cookie keeps you signed in. Your theme and, on the public pages, your choice in the consent bar are stored in your browser. Inside the app there are no advertising, analytics or chat tools.

Song previews inside the app are Spotify players embedded in the page. When one is shown, Spotify receives your IP address and may set its own cookies.

Who receives data

  • Spotify, to read and change the playlists you manage here.
  • Our hosting provider, which runs the server and the database, and our email provider, which delivers the emails.

Some of these companies process data outside the European Economic Area, in particular in the United States. Where they do, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. We do not sell personal data.

How long we keep it

  • Account data, playlists, catalog, swaps, messages, uploads: for as long as your account exists.
  • When you delete your account: your profile, Spotify connections, playlists, catalog, connections, uploads and the messages you sent are deleted at once, and conversations you were part of disappear for the other member too. Swaps that were completed stay in your former partner's history without your name ("Deleted member"). A hash of your email address is kept so that the address cannot be used for a second free trial. Stripe keeps its own record of you as a customer under its legal obligations.
  • Accounts whose email address is never confirmed: deleted after 14 days.
  • Sessions: 30 days after the last sign-in, or until you sign out. Password reset links: one hour, removed a day later.
  • Audit log: 12 months. Closed reports: 12 months. Error reports from browsers: 30 days. In-app notifications: 48 hours. Emails waiting to be sent: at most 7 days.
  • Server log files (errors, the email log): up to 90 days.
  • Payment references and invoices: as long as tax and accounting law requires.
  • Backups: copies of the database made for disaster recovery still contain deleted data until they are overwritten on their regular cycle.

Your rights

You can see and correct most of your data in your profile. Under Profile, General you can download a copy of your data ("Download my data") and delete your account. You can also ask us for access, correction, deletion, restriction or portability, object to processing based on our legitimate interest, and withdraw a consent at any time. Write to support@swapdeck.top; we answer within one month. You can complain to the data protection authority of the country you live in.