Privacy Policy

Who we are and what this covers

SwipeCaddy is operated by Const Agility, LLC, 17350 State Hwy 249, Ste 220, Houston, Texas 77064, USA. This single policy covers two things: the SwipeCaddy mobile app for iOS and Android, and this website at swipecaddy.com. Some practices apply to only one of them — ads and the Nearby map exist only in the app, while session-replay analytics runs only on the website — and we say which is which throughout. SwipeCaddy is currently available only in the United States. Questions: hello@swipecaddy.com.

Using the app without an account

You can use the whole app without signing in. As a guest you create no account with us and no account with our sign-in provider (Google Firebase) — there is no record of “you” in our database, and your cards, favorites, and settings live only on your phone. Signing in is optional and only adds the features described below. Guest mode is genuinely account-free, but it is not silent: like the signed-in app, it still uses analytics and shows ads (both described below), and if you turn on notifications your device registers to receive them.

What signing in adds

If you choose to sign in with Google or Apple, we receive and store the basic profile those services provide, so we can run your account and, in a future update, sync it across your devices:

• Your email address, name, and profile photo link from Google or Apple. If you use Sign in with Apple’s “Hide My Email”, we only ever see the private relay address Apple provides.
• An account identifier from the sign-in provider, which we use to recognize you.
• We never receive or store a password — sign-in is handled entirely by Google or Apple.

What stays on your device

The core of SwipeCaddy runs on your phone. Your wallet (the cards you mark as “I have it”), your favorites, and your preferences are stored locally, and the recommendation itself is always computed on-device — the ranking never leaves your phone. What happens to that list depends on whether you are signed in. As a guest, nothing leaves your phone at all. If you sign in, we save which cards and categories you picked so you can restore them on a new phone; that list is stored on our servers against your account, and deleting your account deletes it. We never store card numbers, expiry dates or security codes — only short names like “chase-sapphire-preferred”. Cloud sync is free with any account; it is not a paid feature. One honest nuance: when you add or remove a specific card, we also record which card it was in our analytics (see below), so our analytics providers could reconstruct your wallet from those events even for guests. Everything on-device is erased when you sign out or delete your account.

Analytics: what the app records

To understand how the app is used and to improve it, we record in-app activity and send it to two analytics providers, Google (Firebase Analytics) and Amplitude. This includes the screens you view, the cards, merchants, and categories you open, the searches you type, the filters and settings you change, and events like sign-in, ad views, and notification opens. This data is always tied to a persistent identifier for your app install, and once you sign in it is also tied to your account — in Amplitude, that means your email and name sit on the same profile as your activity. A few specifics worth calling out:

• Search terms: the words you type into search are sent to our analytics providers as typed.
• Cards: adding or removing a card sends that card’s identity (its short name, never a card number).
• This is identified, first-party analytics — not anonymous, aggregate-only measurement.
• There is no in-app setting to turn analytics off. The controls that do exist are listed under “Deleting your account and your controls”.

Advertising

SwipeCaddy is free and supported by ads from Google AdMob shown to users who are not subscribed. You may also choose to watch a rewarded ad to unlock the Nearby map for a few hours. We request non-personalized ads only: we never pass your wallet, your location, or your account to the ad system, and the app shows no iOS tracking prompt because it does not use Apple’s advertising identifier. Ads are not personalized to you — but Google still receives your device information, IP address, and approximate (IP-based) location to deliver, frequency-cap, measure, and protect the ads, and Google’s own disclosures classify the device identifier it uses as linked to you. In short: not personalized, but not invisible either.

Location

Location is used for four features, and they do not all work the same way. The Nearby map, Swipe Scope and Swipe Spot use it only in the foreground: Nearby and Swipe Scope while that screen is open, and Swipe Spot only at the moment you tap it. Swipe Signal — an optional Pro feature in beta that you turn on yourself — also uses location in the background: with your permission the app watches for arrivals at places you visit, using visit detection on iPhone and geofences on Android, so it can notify you which card to use before you pay. You can turn Swipe Signal off, or revoke background location in your system settings, at any time; the rest of the app keeps working. Where your coordinates go depends on your phone. On iPhone, Apple Maps resolves the places around you, so your coordinates never reach our servers. On Android there is no equivalent free source, so your device sends your coordinates to SwipeCaddy to look up which places are nearby — we use them to answer that one request, we do not store them, and we never build a history of where you have been. They do appear briefly in our server request logs, which are short-lived and not used for analytics. On both platforms, which card to use is worked out on your phone, and your coordinates never appear in our product analytics. Two honest notes: the foreground permission prompt appears when you open Nearby (before the rewarded-ad step), and while your coordinates stay out of analytics, which store you tap on the map is recorded there like other activity.

Push notifications

Notifications are off until you turn them on. When you enable alerts, your device registers a push token with Google’s messaging service (delivered via Apple’s push service on iPhone) so we can send notifications; for signed-in users we also store that token on our servers so we can address messages to you. Turning on alerts also subscribes your device to our general announcement and offers broadcasts — this happens even for guests. The single “alerts” toggle in Settings controls all of this: turning it off unregisters your device and stops the broadcasts.

The website

This website is separate from the app and has no login. Two things happen here:

• Waitlist: if you join the waitlist, we store your email address to tell you when we launch, along with basic sign-up context. If you unsubscribe, we keep your address on a suppression list so we know not to email you again — unsubscribing stops emails, it does not delete the address.
• Website analytics: we use Vercel (page analytics and performance) and Microsoft Clarity, which sets cookies and records replayable, pseudonymous sessions of how visitors move around the site, to understand and improve it. This is not anonymous aggregate measurement, and it runs on every page, including this one.

Cookies and similar technologies

In the app, “similar technologies” means the on-device storage described above plus the device and advertising identifiers used by the analytics and ad providers. On the website, Microsoft Clarity sets first-party cookies to recognize repeat visits within its analytics, and we use a cookie to remember your language choice. We do not currently show a cookie-consent banner; if you are visiting from a region that requires one, please use your browser settings to limit cookies.

The companies that help us run SwipeCaddy

We share data only with the service providers that operate parts of SwipeCaddy for us, under agreements that limit their use of it. We do not sell your data. These providers are:

• Google — sign-in (Firebase Auth), app analytics (Firebase Analytics), notifications (Firebase Cloud Messaging), ads (AdMob), and maps on Android.
• Apple — Sign in with Apple, and Maps and push delivery on iPhone.
• Amplitude — product analytics (receives your in-app activity, and your email and name once you sign in).
• Microsoft — website session analytics (Clarity).
• Vercel — website and API hosting, image hosting, and website analytics.
• Upstash — short-lived rate-limiting to prevent abuse.
• Resend — sending service emails.
• RevenueCat — managing SwipeCaddy Pro subscriptions and telling the app whether yours is active. Your payment is taken by Apple or Google, not by us: we never see your card number or billing details, only whether a subscription is active and which plan it is.

What we never collect

Some things we want to be explicit that we do not do:

• No bank or card-issuer connections, and no card numbers, expiry dates, or security codes — the app only stores short names like “chase-sapphire-preferred”.
• No transaction history, balances, statements, or spending data.
• No passwords — sign-in is handled by Google and Apple.
• No access to your contacts, photos, microphone, calendar, files, or health data. The camera is used only by Swipe Scope, only while that screen is open, and only to render the live view on your device — we never record, store, upload, or analyze what it sees.
• No location tracking and no profile of where you go. Background location is used only if you turn on Swipe Signal (beta), and only to notice that you have arrived somewhere so the app can suggest a card. On Android your coordinates reach our servers for the nearby-places lookup and are not stored; on iPhone they never leave the device.
• No personalized advertising, no Apple advertising identifier (IDFA), and no cross-app or cross-site tracking.
• We never sell your personal information.

How long we keep your data

Retention depends on the type of data:

• Account information (email, name, photo link, tokens): kept until you delete your account.
• On-device data (wallet, favorites, settings): kept on your phone until you sign out, delete your account, or uninstall.
• Analytics events: retained by Google and Amplitude under their own settings; we do not set a fixed period, and deleting your account does not remove events already sent.
• Waitlist email: kept until you ask us to remove it; unsubscribing suppresses but does not delete it.
• Operational logs, at us and our providers, may contain your email or IP address for a limited period; rate-limiting records expire within about two hours.
• Location: not retained by us at all.

Deleting your account and your controls

You can delete your account at any time in the app (Settings → “Delete my account”), or by emailing hello@swipecaddy.com; details are at swipecaddy.com/en/account-deletion. Deletion removes your profile and personal information, your saved cards, and your device and notification registrations, and it deletes your sign-in with our provider. We keep a minimal internal record that contains an account identifier and timestamps but no name, email, or other personal details, so our counts and bookkeeping stay accurate. In the interest of honesty, deletion does not reach everything: analytics events already sent to Google and Amplitude, your address in our email provider’s sent-mail records, and your address in operational logs are not retroactively purged. Your available controls are the alerts toggle (notifications), your device’s location permission, resetting your advertising ID at the OS level, and account deletion. There is no separate analytics or ad opt-out inside the app.

Children

SwipeCaddy is intended for adults and is not directed to children. On Google Play the app is rated for users 18 and over, and it is not designed for or marketed to children.

Where your data is processed

SwipeCaddy is operated from the United States and is currently available only in the US. Our providers, including Amplitude, Google, and Vercel, process data in the United States. If you access SwipeCaddy from outside the US, you are sending your information to the US.

Your privacy rights

Depending on where you live, you may have rights to access, correct, or delete the personal information we hold and to know how it is used. US residents, including under California’s CCPA/CPRA, can request access or deletion and are entitled to non-discrimination for exercising those rights; we do not sell your personal information or share it for cross-context behavioral advertising as those terms are defined. To make a request, email hello@swipecaddy.com — for account data, the fastest route is in-app deletion. We may need to verify your identity before acting on a request.

Security

Data is encrypted in transit between the app, the website, and our providers. On your phone, app data is stored in the standard app storage area, protected by your device rather than separately encrypted by us. No method of storage or transmission is perfectly secure, but we work to protect your information and to limit what we collect in the first place.

Changes to this policy

We may update this policy as SwipeCaddy grows or as features change. When we make a material change, we will revise the “last updated” date above and describe significant changes where appropriate.

Contact

Questions about this policy or your data? Email hello@swipecaddy.com. To delete your account, see swipecaddy.com/en/account-deletion.