Legal
Privacy Policy
Swoop (“the App”) is published by Valet Hero LLC (“we,” “our,” “us”). This policy explains what the App collects, why, who else sees it, and what you can do about it. By using Swoop you agree to this policy. If you do not agree, please do not use the App.
The short version. You can use the whole canvas — write, play, and copy components — without an account and without sending us anything. Those files stay on your device. An account is needed only to publish to the community feed or to like what other people published, and what you publish is public by design.
1. Information we collect
Information you provide
- Sign-in details. If you sign in with Apple or with Google, we receive a user identifier and, where the provider supplies it, your name and email address. Sign in with Apple lets you hide your address, in which case we only ever see Apple’s private relay address.
- Display name. The name shown next to what you publish. It defaults to the name your sign-in provider supplied and you can change it at any time in Settings.
- What you publish. The component you choose to publish, together with your display name, your account identifier, and the time you published it. Publishing is always an explicit action.
- Likes. A record that your account liked a particular post, so a like counts once and you can take it back.
Information collected automatically
- Usage analytics. Through Google Analytics for Firebase we record which screens you open and which actions you take — creating a file, pressing play, whether play succeeded or was refused, copying source, opening the feed, signing in. These events carry no file contents and no source code.
- Device and diagnostic data. Device model, operating system version, app version, language and region, and a Firebase-generated app instance identifier, along with crash and performance data.
- Approximate location. Firebase derives a coarse region (typically country) from the network address of your requests. The App never asks for, and never receives, precise device location.
- Ad measurement. Through the Meta (Facebook) SDK we learn which of our ads led people to install and use the App. Meta receives the App being opened, onboarding being finished, the paywall being shown, and your first successful Play; RevenueCat reports purchases to Meta for the same purpose. With these events Meta receives an anonymous install identifier, your device’s vendor identifier, network address and device model — and your device’s advertising identifier (IDFA) only if you tap “Allow” on the iOS tracking prompt. These events never contain your files, source code, AI keys or conversations.
Information that stays on your device
- Your files. Everything you write on the canvas is saved to the App’s own documents folder on your iPhone. It is not uploaded, not read by us, and not used to train anything. It leaves the device only when you publish it or share it yourself.
- Session tokens. Sign-in tokens are held in the iOS Keychain and are removed when you sign out.
- Your AI key. If you connect an AI provider (OpenAI, Anthropic, xAI or Google), the API key you paste is held in the iOS Keychain on your device. We never see it, and it is not sent anywhere except to that provider.
- Your AI conversation. What you ask the AI about a file, and the code it returns, is saved with that file on your device so the AI can pick up where it left off. It is deleted with the file.
Information you send to an AI provider you choose
Swoop lets you connect your own account with an AI provider. When you ask the AI to write or change a file, the App sends your request, the current contents of that file, and the recent conversation about it directly from your device to that provider, using your key. Nothing passes through servers we operate. That provider handles what it receives under its own privacy policy and terms, and bills your account there. You can switch or remove the key at any time in Settings → Your AI, and “Start over” in the chat deletes the saved conversation for a file.
2. How we use it
- Authenticate your account and attribute what you publish.
- Show the community feed, and keep like and view counts accurate.
- Understand which parts of the App are used, and which ones fail.
- Diagnose crashes, refusals and performance problems.
- Protect the service against abuse.
We use the ad-measurement events above only to understand which of our own ads work. We do not show ads in the App, and we do not sell or rent your information.
3. What publishing makes public
A published swoop is public. Anyone with the App — signed in or not — can see the component, your display name, and its like and view counts. Treat your display name as public, and do not put anything into a component you would not want published. Published posts are a permanent record within the App; you can delete your own, and doing so removes it from the feed.
4. Who else processes your data
| Service | What it handles | Why |
|---|---|---|
| Google Firebase Authentication, Firestore, Analytics |
Account identifier, display name, published posts, likes, analytics events, device and diagnostic data | Accounts, the community feed, and product analytics |
| Apple | Sign in with Apple identity, App Store distribution and payments | Authentication and distribution |
| Google Sign-In | openid, email, profile — your Google identifier, email and basic profile |
Authentication only. We request no other Google scopes and access no other Google data. |
| RevenueCat | Purchase and subscription receipts, an anonymous customer identifier | Managing paid entitlements, if and when you buy one |
| Meta Facebook SDK and Conversions API |
App opens, onboarding, paywall views, first Play, purchases; install and vendor identifiers, network address, device model; the IDFA only with your permission | Measuring which of our ads bring people to the App, under Meta’s own privacy policy |
| An AI provider you connect OpenAI, Anthropic, xAI or Google — only if you add a key |
Your prompts, the file you are working on, and the recent conversation about it | Writing and fixing SwiftUI on your instruction. Sent directly from your device under your own account; we operate nothing in between. |
Each operates under its own privacy policy. Beyond these, we disclose information only where required to comply with applicable law, a governmental request, a court order or legal process, or in connection with a merger, acquisition or sale of assets — in which case you will be notified before your data is transferred under a different policy.
5. Storage, retention and security
- Encryption. All communication with our services uses TLS 1.2 or higher.
- Credentials. We never see or store your Apple or Google password.
- Retention. Account and published data are kept until you delete them. Deleting your account removes your username, profile picture, likes and everything you published, immediately and permanently. Analytics data is retained on Firebase’s default schedule and then deleted or anonymised.
- Access. Only authorised personnel can reach account data, and only when necessary to run or support the service.
No method of transmission or storage is completely secure. We take reasonable technical and organisational measures, but you use the App at your own risk.
6. Children
Swoop is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
7. Your rights and choices
Depending on where you live — including the EEA, the UK, and U.S. states such as California — you may have the right to access, correct, delete, restrict the processing of, or export your personal data. You can also:
- Use the entire canvas without an account at all.
- Change your display name, or sign out, from Settings in the App.
- Delete any post you published.
- Delete your account from inside the app — Settings, or your profile behind the avatar. It removes your username, picture, likes and every swoop you published. Files on your phone are not touched.
- Revoke Sign in with Apple under Settings → your name → Sign-In & Security → Sign in with Apple, or Google’s access under your Google Account → Security → Third-party apps.
- Limit ad and analytics identifiers system-wide under Settings → Privacy & Security → Tracking.
Deleting your account does not need to go through us: it is in the app, under Settings and on your profile. For anything else — a copy of your data, a correction, a question about this policy — email info@valethero.com from the address on your account. We act on requests in line with applicable data protection law.
8. Changes to this policy
We may update this policy. The revised version takes effect as soon as it is posted here and the effective date above changes. Significant changes will be announced in the App.
9. Contact
Valet Hero LLC — info@valethero.com. The support page covers the common questions.