Privacy Policy

Thornline Labs LLC ("Company," "we," "us," "our") operates the Thornline Labs website and develops applications including Swappr (collectively, "Services"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Services.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy. If you do not agree with our practices, please do not use our Services.

1. Information We Collect

1.1 Account Information

When you create an account with our Services, we collect information you provide directly, including:

• Name and email address
• Phone number, if you verify your phone (shared with Twilio to send the verification code)
• Apple ID account information required for authentication
• Profile information you choose to provide (e.g., profile picture, username, display name)
• Any other information you voluntarily submit through our Services

1.2 Service providers

We use the following providers to operate the Services: Railway (application hosting and database), Twilio (SMS phone verification), Resend (transactional email), Cloudinary (image hosting for profile and listing photos), RevenueCat and Stripe (payment processing), and Meilisearch (search indexing). We do not use Firebase or Google Cloud services.

1.3 Subscription and Purchase Data

Purchases of token packs and Swappr Pro are made on getswappr.com and processed by RevenueCat Web Billing using Stripe. Thornline Labs does not receive or store your full card number — card details go directly to the payment processor. In connection with a purchase we and our processors handle:

• Your email address and the Swappr account the purchase belongs to
• The amount, currency, and what was purchased
• Subscription status and renewal information
• Purchase history
• Limited technical identifiers required to process the payment and prevent fraud

RevenueCat handles subscription management but does not share your purchase data with us for marketing purposes. You can review RevenueCat's privacy policy at https://www.revenuecat.com/privacy.

1.4 Analytics Data

We collect limited, anonymized analytics to improve our Services, including:

• App crash reports and error logs
• Feature usage statistics (which features are used, how often)
• Device type and operating system version
• Precise location (latitude and longitude), together with the city and state you provide, so that Swappr can show you listings near you

Analytics data is aggregated and does not identify you personally. We do not track individual user behavior or create detailed usage profiles.

1.5 Communication Data

If you contact us via email or through our Services, we collect:

• Your email address and name
• The content of your message
• Any attachments or information you provide

1.6 Notification Lists

If you ask us to let you know about a product — for example the “keep me posted” form on Swappr — we store only what is needed to send you that message:

• The email address you enter
• The area you tell us, such as your state or city, so we can tell when there is activity near you
• Which product you asked about, and the page you signed up from
• The date and time of your signup

Swappr's notification list is stored in the Swappr application database; a list you join directly on this website is stored in Cloudflare Workers KV. Either way it sits on infrastructure we control — we do not use a third-party form, mailing-list, or marketing service to collect it. On this website, to limit automated abuse, we temporarily store a one-way hash of your IP address for one hour; the address itself is never written down, and the hash is deleted automatically when it expires.

We use these emails for one thing only: telling you when there is something worth knowing about that product — for Swappr, when listings start appearing near you. Joining is not a requirement for using anything: Swappr is open to everyone now, and you can create an account and post a listing without joining any list. We do not add you to a newsletter, we do not use these addresses for advertising, and we never share or sell them. You can ask us to remove your address at any time by emailing hello@thornlinelabs.com, and every email we send includes a way to opt out.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing Services: To deliver, maintain, and improve our Services, including account management, feature development, and customer support
• Authentication: To securely authenticate your identity and prevent unauthorized access to your account
• Personalization: To customize your experience, track achievements, and maintain leaderboards
• Analytics and Improvement: To understand how our Services are used, identify bugs, optimize performance, and plan new features
• Security: To detect, prevent, and address fraud and security issues
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide assistance

3. Data Sharing and Disclosure

3.1 What We Do NOT Do

• We do not sell your personal data. We do not sell, trade, or rent your information to third parties for marketing purposes.
• We do not use advertising. We do not serve targeted ads based on your personal information.
• We do not create detailed tracking profiles. We do not build comprehensive profiles of your behavior for commercial purposes.

3.2 Limited Sharing with Service Providers

We share information only with third-party service providers who assist us in operating our Services, and only to the extent necessary:

• Railway: Application hosting and database
• Twilio: SMS phone verification
• Resend: Transactional email delivery
• Cloudinary: Hosting of profile and listing images
• RevenueCat and Stripe: Payment processing for token packs and Swappr Pro
• Meilisearch: Search indexing
• RevenueCat: For subscription and purchase management
• Twilio: For SMS phone verification

We require these service providers to maintain strict confidentiality and use data only for the purposes we specify.

3.3 Legal Requirements and Protection

We may disclose your information when required by law or when we have a good faith belief that disclosure is necessary to:

• Comply with applicable laws, regulations, or court orders
• Enforce our Terms of Service and other agreements
• Protect the safety, rights, and property of Thornline Labs, our users, or the public
• Detect and address fraud or security concerns

3.4 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice if your information becomes subject to a materially different privacy policy.

4. Data Retention and Deletion

4.1 Retention

We retain your information only for as long as necessary to provide our Services and fulfill the purposes outlined in this Privacy Policy. Specific retention periods:

• Account data: Retained while your account is active; deleted upon account termination (see below)
• Analytics data: Aggregated and retained for up to 90 days
• Backup/archive data: Retained for up to 90 days after account deletion for data recovery purposes

4.2 Data Deletion Requests

You may request deletion of your personal data at any time by contacting us at hello@thornlinelabs.com with the subject line "Data Deletion Request." Please include:

• Your name and email address associated with your account
• A clear statement that you request deletion of your personal data

Upon receiving a valid request, we will:

• Delete your account information within 30 days
• Purge personal data from backups within 90 days
• Provide written confirmation of deletion

Note: Some data may be retained when required by law or for legitimate business purposes (e.g., fraud prevention, legal disputes). We will inform you of any such retention.

5. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request what personal data we have collected, the sources, and how we use it
• Right to Delete: You may request deletion of personal data we have collected (with certain exceptions)
• Right to Opt-Out: You have the right to opt-out of the "sale" of your personal data (we do not sell data, so this right is not applicable)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, email hello@thornlinelabs.com with your request. We will verify your identity and respond within 30 days.

6. Children's Privacy

Our Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete such information and terminate the child's account.

For children ages 13 and older, we maintain the same privacy protections outlined in this Privacy Policy.

If you believe a child under 13 has provided us with information, please contact us immediately at hello@thornlinelabs.com.

7. Security Measures

We implement industry-standard security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data in transit (TLS/SSL) and at rest
• Passwords stored only as salted hashes, never in readable form
• Regular security audits and testing
• Strict access controls and employee confidentiality agreements
• Compliance with Apple's security guidelines

However, no security system is impenetrable. While we strive to protect your information, we cannot guarantee absolute security. You use our Services at your own risk.

8. Third-Party Services and Links

Our Services may contain links to third-party websites and services that are not operated by Thornline Labs. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. Please review the privacy policies of any third-party services before providing your information.

Third-party services we integrate with include:

• Payment providers: RevenueCat and Stripe process card payments; Thornline Labs does not receive or store your full card number
• Railway: Application hosting and database
• Twilio: SMS phone verification
• Resend: Transactional email delivery
• Cloudinary: Hosting of profile and listing images
• RevenueCat and Stripe: Payment processing for token packs and Swappr Pro
• Meilisearch: Search indexing
• RevenueCat: For subscription management

9. International Data Transfers

Your information may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that are different from your home country. By using our Services, you consent to the transfer of your information to countries outside your country of residence, which may not provide the same level of protection as your home country.

10. Your Rights and Choices

10.1 Access and Correction

You may access and update your account information at any time by logging into your account. If you need assistance, contact us at hello@thornlinelabs.com.

10.2 Email Communications

If we send you promotional emails, you may opt-out by clicking the "unsubscribe" link in the email or by contacting us directly. Please note: We may continue to send you transactional emails (e.g., account notifications, password resets) even if you opt-out of promotional messages.

10.3 Device Permissions

You can control app permissions on your device at any time:

• Location: your device or browser settings (used to show skills near you; you can decline and browse without it)
• Notifications: your device or browser settings
• Camera and photos: your device or browser settings (used only when you add a photo to a listing or profile)

10.4 Tracking and Do Not Track

We do not respond to "Do Not Track" signals, as there is no universal standard. However, we do not track you across third-party websites or apps, and we do not use third-party tracking for marketing purposes.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by:

• Posting the updated Privacy Policy on our website
• Updating the "Effective" date at the top of this policy
• Sending you an email notification (for material changes)

Your continued use of our Services after changes become effective constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Ohio, without regard to its conflict of law principles. Any disputes arising out of or relating to this Privacy Policy shall be resolved in the courts located in Ohio.