Privacy Policy

Your email address. You sign in with Google and we receive your email address and account ID — nothing else. We never receive your Google password, contacts or files.

The text you submit and the carousels made from it. Your most recent 30 carousels are stored so you can reopen and re-export them: the slide text, the preset, the format and the colours. Older ones are deleted automatically.

Usage counters. Carousels generated this month, remaining credits, your plan and subscription status. This is what enforces the free limit and your subscription.

Product events. Anonymous counts of things like a page view, a generation or an export, plus the website that sent you here (the domain only, never the full address), so we can see where the product confuses people and which channels work. If you cancel a plan we also keep the reason you pick and anything you type in that box — it is product feedback, and it is the reason the box is there. Stored in our own database — there is no Google Analytics, no advertising pixel and no third-party tracker anywhere on this site.

A salted hash of your IP address, kept for up to 7 days, so the free trial cannot be abused by reloading the page. A hash cannot be turned back into an address.

What we never receive: your card number, expiry or CVC. Those are entered on Paddle's side and never reach our servers. The author name, username and photo you set in the editor are used to render your slides; the photo never leaves your browser.

To perform the contract you entered into when you created an account — your email, plan, credits and saved carousels all exist so the service can work.

For our legitimate interests in keeping the service usable — the IP hash that prevents free-trial abuse, the rate-limit counters, and the anonymous product events that tell us what to fix. Those interests are balanced against your privacy, which is why the events are not tied to an advertising profile and the IP is never stored in the clear.

To meet legal obligations, for the billing records tax law requires us to keep.

Supabase — authentication and database hosting.

Vercel — website hosting and delivery.

Google (Gemini API) — the text you submit is sent to Google to generate your carousel. We send only the slide text, never your email, name or account ID. NextSwipe currently uses Google's free API tier, under which Google may use this content to improve its services — please don't include personal or confidential information.

Paddle.com Market Ltd — Merchant of Record for all purchases. Paddle handles payment, invoicing and tax, and is a separate controller of the payment data you give it.

These providers operate servers outside Ukraine, including in the EU and the United States, so your data is transferred internationally under the safeguards each provider offers. We do not sell your data, and we do not share it with anyone else except where the law compels us to.

Carousels — the most recent 30 per account; older ones are deleted automatically as new ones are saved.

IP hashes — up to 7 days.

Product events — up to 180 days.

Account and billing records — while your account exists, and afterwards only for as long as tax and accounting obligations require.

You can ask us to give you a copy of everything we hold about you, correct it, delete it, restrict or object to how we use it, or hand it over in a portable form. Email us and we will act within 30 days, free of charge.

You can delete any saved carousel yourself from the list under the preview. To delete your whole account and everything attached to it, email us and we will remove it within 30 days.

If you are in the EU, EEA or UK you also have the right to complain to your national data protection authority.

Only what is needed to keep you signed in, plus one identifier in your browser's local storage that lets us count a visit without knowing who you are. No advertising cookies, no tracking cookies, no consent banner to click through, because there is nothing here that requires one.

NextSwipe is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

Traffic is encrypted in transit, access to the database is restricted to the service itself, and payment details never reach us. No system is perfectly secure; if a breach ever affects your data we will tell you and the relevant authority without undue delay.

If this policy changes materially the date at the top changes, and where the change affects you we will notify you by email.

Send any privacy request — a copy of your data, a correction, a deletion — to support@nextswipe.app. We answer within 30 days.

The data controller for NextSwipe is Dmytro Dolapchi, an individual sole trader based in Ukraine.