Privacy Policy

Swypit ("we", "our", "us") operates the Swypit mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our App. By using Swypit, you agree to the collection and use of information as described here.

1. Information We Collect

Account Information

• Email address (login and verification)
• Name and display name
• Profile photo (optional)
• Phone number, date of birth, and gender (optional)

Vendor Information

• Store name, logo, bio, and category
• Business location and operating hours
• Payment details for receiving payouts (bank account or mobile money)

Transaction Data

• Order details — products, quantities, amounts, payment method
• Payment references and delivery information
• Wallet balance and transaction history (vendors)

User-Generated Content

• Messages between buyers and vendors
• Comments and reviews on products
• Product listings, images, and videos (vendors)
• Reports submitted about content or users

Device & Technical Data

• Device identifier (trusted device / remember-me)
• Device name, platform, and OS version
• Push notification token

Usage Data

• Products you view, like, save, or share
• Vendors you follow and interaction timestamps

2. How We Use Your Information

Purpose	Data used
Account creation and authentication	Email, password, device info
Processing orders and payments	Transaction data, payment details
Sending verification codes (OTP)	Email address
Push notifications	Push token, device info
In-app messaging	Messages, media attachments
Personalising your feed	Views, likes, follows, saves
Vendor payouts	Bank / mobile money details
Fraud prevention and security	Device fingerprint, login activity
Customer support and dispute resolution	Order data, messages, reports

3. Third-Party Services

We share data with the following providers solely to operate the App:

Service	Purpose	Data shared
Paystack	Payment processing	Email, payment amounts, bank/MoMo details
Resend	Transactional emails (OTP)	Email address
Cloudinary	Image and video hosting	Uploaded media files
Expo / Firebase	Push notifications	Push tokens, notification content
Render	Server and database hosting	All stored data (encrypted at rest)
Sentry	Error monitoring	Error logs, device info (no personal data)
Redis	Caching and session storage	Temporary session data only

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

4. Data Retention

• Account data: Retained while your account is active. On deletion, personal data is removed and public content is anonymised.
• Transaction data: Retained as required by applicable financial regulations.
• Messages: Retained while both participants have active accounts.
• Verification codes: Automatically expire after 5 minutes.

5. Data Security

We protect your data with:

• Passwords hashed with bcrypt — never stored in plain text
• JWT authentication tokens with automatic expiry and rotation
• Webhook signature verification for payment events
• Rate limiting on all authentication endpoints
• Input validation and sanitisation on all endpoints
• HTTPS encryption for all data in transit

6. Your Rights

• Access your personal data via your profile and order history
• Update your account information at any time
• Delete your account — removes personal data and anonymises public content
• Opt out of push notifications via your device settings

To exercise these rights, contact support@swyp.it.com or use the in-app settings.

7. Children's Privacy

Swypit is not intended for use by anyone under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently done so, please contact us immediately so we can delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes through the App or via email. Your continued use of the App after changes constitutes acceptance of the updated policy.