Legal
Sub-processors
These are the outside services Swapp's code sends personal data to, what it sends, and why. The list was made by reading the code, and it describes what the code does as of October 12, 2026. How we handle your data is set out in the privacy policy.
Cloudflare
What: Everything Swapp stores: accounts, play history, settings, cards and requests. Request logs (IP address, browser). Text you type into search, chat with a card, and feedback is sent to Cloudflare's AI models, through Cloudflare's AI Gateway.
Why: Hosting, databases and file storage, and the AI models that answer search and chat.
Clerk
What: Your email address and sign-in details, your session, and your Swapp account id (stored with your Clerk account).
Why: Signing in and keeping you signed in.
Stripe
What: For a purchase: the amount, the item and your Swapp account id. For a creator who sets up payouts: your Swapp account id; Stripe collects identity and bank details on its own pages.
Why: Taking payments and paying creators.
Payouts to creators are off by default in the code.
Sentry
What: Error reports from the API: the error, the address that failed (which can contain an account or card id) and a trace id. IP addresses and cookies are not sent.
Why: Finding and fixing errors.
Only when error reporting is configured for the API; this page cannot see whether it is.
Neon
What: Your play records (what you played, when, and how it went, under your player id), kept by Empress.
Why: Storing the record of your play.
PartyKit
What: When you play live against someone: your account id, handle, the card, your moves, and your IP address.
Why: Running live head-to-head games.
Fly.io
What: Your player id and your play history (cards played and followed), read by the recommendation service Swapp runs there; and your play records, passing through the Empress record store hosted there.
Why: Choosing which cards to show you next, and keeping the record of your play.
Your browser's push service (Google, Mozilla, Apple or Microsoft)
What: Only if you turn on notifications: your device's push address and the notification, encrypted so the push service cannot read it.
Why: Delivering notifications to your device.
Google (Cast)
What: Only when you cast to a TV: Google's casting script is loaded from Google, which sees your IP address and browser, and the room you are casting.
Why: Playing on a TV.
Anthropic and OpenAI
What: Instructions and card code typed by the Swapp team when making cards. These tools are open to the team only, not to players.
Why: Helping the team write cards.
Only when a key for that provider is configured; this page cannot see whether it is.
Our own services
Play records also go to Empress, the record-keeping service run by Empress Ecosystems LLC, the company behind Swapp. It is not an outside company, so it is not listed above. Empress runs on Cloudflare and keeps play records in a record store hosted on Fly.io, which saves them in a Neon Postgres database.
Could not confirm from the code
- Resend (email). The privacy policy names it. No code sends email through it, or through any other email service, today.
Public data cards read
Some cards show live public data (weather, news, space and money feeds, and public records). Your browser or our server asks those sources for the data; no account information is sent, though a source your browser asks directly sees your IP address.
Questions: [email protected].