Last updated: August 10, 2026
This Privacy Policy explains how Swungo ("Swungo", "we", "us") collects, uses, shares, and protects the personal data of visitors and account holders at swungo.com. Swungo is a creator-analytics tool that surfaces publicly available short-form video and its performance signals so creators can study what formats are working. This Policy covers only the personal data of our own visitors and account holders. It does NOT govern the publicly available third-party content shown in our dashboard (Instagram Reels, thumbnails, captions, audio details, and the metrics we compute) — if you are a creator and want your content removed, please see our DMCA Policy and contact [email protected].
The data controller responsible for your personal data is Swungo, reachable at [email protected]. We are established in the United States, and our production servers are located in the European Union (Germany). We have not appointed an EU representative or Data Protection Officer at this time;. For any privacy question or to exercise your rights, email [email protected].
When you create and use a Swungo account we collect: (a) your email address; (b) a display name you choose; (c) a securely hashed version of your password (we never store your password in plain text); (d) your subscription and billing status, plus the limited billing identifiers we receive back from our payment provider — we never receive or store your full card number; (e) the reels you save as favorites; (f) session tokens that keep you signed in; and (g) your IP address and browser user-agent, used for sign-in, rate-limiting, and security. Our bot-protection provider (Cloudflare Turnstile) may also process limited visitor signals when you use our sign-up and sign-in pages. We do not ask for, and do not want, any special-category or sensitive data beyond the account log-in credential described in Section 9.
We use your data to operate and secure the Service. Under the GDPR/UK GDPR we rely on: (1) Performance of a contract — to create your account, authenticate your logins, deliver the dashboard, downloads and saved favorites, and operate your auto-renewing subscription; (2) Legitimate interests — to keep the Service secure, prevent abuse and fraud, rate-limit by IP address, run bot protection, and improve the product; (3) Legal obligation — to keep tax and accounting records and respond to lawful requests; and (4) Consent — only where we ask for it separately, such as any optional product emails we may add later, which you can withdraw at any time without affecting the service you already receive. This Policy is our transparency notice at the point of collection; we do not rely on disclosures buried in our Terms of Service as a legal basis.
We share personal data only with the service providers below, each bound by a data processing agreement and only as needed to run Swungo. We do not otherwise disclose your personal data to third parties except as legally required. Cloudflare, Inc. (USA) — content delivery, R2 object storage for the cached reel media we re-host, and Turnstile bot-protection; processes your IP address, request metadata, and limited visitor signals. Resend (USA) — sends transactional email such as verification codes and password resets; processes your email address and message content. Our payment provider (USA) — checkout, billing, and subscription management; processes your email and billing data (full card details are handled by our payment provider, not by Swungo). Hetzner Online GmbH (Germany, EU) — hosting of our application and database. Authentication itself runs on our own infrastructure (Better Auth on a self-hosted PostgreSQL database), not a third party. We keep this list version-dated and will update it before adding any new processor.
We do not sell your personal data, and we do not "sell" or "share" it as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), including for cross-context behavioral advertising. We have not sold or shared personal data in the preceding 12 months, and we do not use your data to build advertising profiles. Because we do not sell or share, we are not required to post a "Do Not Sell or Share My Personal Information" link; nonetheless, we will honor opt-out preference signals such as Global Privacy Control (GPC) to the extent they apply to us.
Our primary servers are in Germany (EU). Some of our processors — Cloudflare, Resend, and our payment provider — are based in the United States, so your data may be transferred there. Where a processor is certified under the EU-US Data Privacy Framework, we rely on that framework; where it is not, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / IDTA for UK data) together with appropriate additional safeguards.
Swungo uses only strictly necessary cookies and similar technologies: an authentication/session cookie that keeps you signed in, and security signals from Cloudflare Turnstile that protect our sign-up and sign-in pages from bots. These are essential to provide the Service and are exempt from prior consent under ePrivacy rules. We do NOT use advertising, marketing, or cross-site tracking cookies, and we do not run third-party analytics that profile you — so we do not display a cookie consent banner. If we ever introduce any non-essential cookie, we will ask for your consent first.
If you are in the EEA or UK, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to receive a portable copy, and to withdraw consent where we rely on it. To exercise these rights, use the controls in your account or email [email protected]; we will respond without undue delay and within one month, and will tell you if we need a permitted extension. We may need to verify your identity using your account email before acting. You also have the right to lodge a complaint with your local data protection supervisory authority, though we would welcome the chance to resolve your concern first.
If you are a California resident, you have the right to know and access the personal information we collect, to delete it, to correct it, to opt out of the sale or sharing of personal information (note: we do not sell or share), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. In the preceding 12 months we have collected these categories: Identifiers (email, display name, IP address); Internet or other electronic network activity (user-agent, request metadata); Commercial information (subscription status); and Sensitive Personal Information (your account log-in credential only). We store that credential solely as a secure hash and use it only to authenticate you, secure your account, and detect and prevent fraud and abuse — never to infer characteristics about you. Because that use falls within the security and fraud-prevention purposes permitted by the CPRA, the right to limit the use of sensitive personal information does not apply; we describe the category here for transparency. Submit a request via [email protected]; we verify your identity using your account email before responding, and an authorized agent may submit a request with proof of authorization.
We keep your account data for as long as your account is active. If you close your account or ask us to delete it, we remove or anonymize your personal data within 30–90 days, except where we must keep certain records longer — for example, billing and tax records, which we retain for approximately 7 years as required by law, and records needed to demonstrate your subscription and consent choices, which we retain as required to show compliance. Session tokens expire automatically, and security logs including IP addresses are kept for up to 30–90 days for abuse prevention.
We protect your data with industry-standard measures: passwords are stored only as salted hashes, all traffic is encrypted in transit (TLS), and the reel media we re-host is stored privately on Cloudflare R2 and served only to authenticated users through short-lived, signed links that are not publicly indexable. We also apply rate-limiting and bot protection. No system is perfectly secure, but if a personal-data breach occurs, we will notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay where the law requires it.
Swungo is not directed to children and is intended for use by adults (18 or older). We do not knowingly collect personal data from anyone under 16 in the EEA/UK or under 13 in the United States. If you believe a child has provided us personal data, contact [email protected] and we will delete it.
The trending reels, thumbnails, captions, audio details, and metrics shown in Swungo are collected from publicly available sources, and we compute our own independent virality and engagement estimates from them. We re-host the cached video and thumbnail privately (see Section 11) so that only authenticated users can view them. This is third-party creator content, not the personal data of our account holders, and it is not governed by this Policy. Swungo is not affiliated with, endorsed by, or sponsored by Instagram, Meta, or the creators shown, and all third-party names and marks belong to their respective owners. If you are a creator and wish to have your content removed, please see our DMCA Policy and contact our designated agent at [email protected].
This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws rules, except where mandatory local data-protection law (such as the GDPR or the CCPA) gives you rights that cannot be overridden. We may update this Policy from time to time; we will post the new version with an updated "Last updated" date and, for material changes, notify you by email or in-app before the change takes effect. Material changes will not reduce your rights over data already collected without a valid legal basis. Questions or requests: [email protected].
More policies
This page is a plain-English summary of our policies and is provided for general information. Questions? Contact [email protected].