# Privacy Policy This policy explains what SwipeToLaunch ("we", "the site") collects when you use https://swipetolaunch.com, why, how long it is kept, and what you can ask us to do with it. Last updated 16 October 2026. The short version: swiping is anonymous and needs no account. We keep the minimum needed to count one vote per person and to stop abuse. We do not sell data or show ads. We use Google Analytics, Microsoft Clarity and Cloudflare Web Analytics to understand how the site is used. ## What we collect ### When you swipe (no account) - **An anonymous voter id.** A random id in a signed cookie, so the site can remember which products you already swiped and count one vote per person. It contains no personal details. - **Each vote.** Which product or founder, launch or pass, and when. - **Coarse request data, used only to detect abuse.** Country, region, city, postal code, continent, time zone and approximate coordinates as reported by our hosting provider for your network (not your device's GPS), the network operator (ASN), the data centre that served the request, and your browser's language setting. - **One-way hashes of your IP address and browser user agent.** We store a salted hash, never the raw IP address or user agent. The hash lets us spot many votes coming from one source without knowing who you are. ### When you sign in (optional) Signing in is optional, both for voting and for adding listings. It is only used to attribute listings to you and to give site administrators access to moderation tools. You can sign in with Google or with a one-time code sent to your email address. **With Google.** When you choose "Sign in with Google", Google shares the following with us, and nothing else: - your Google account id, - your email address, - your name, - your profile picture URL. We ask Google only for the `openid`, `email` and `profile` scopes. We do not get access to your Gmail, contacts, Drive, calendar or any other Google data, and we never see your Google password. **With an email code.** You type your email address and we email you a 6-digit code. The code is valid for 10 minutes, can be tried at most 5 times, and works only once. We store: - your email address, lowercased, on your account; - while a code is pending: a salted hash of the code (never the code itself), when it was created and when it expires, a salted hash of the IP address that asked for it, and how many times it has been tried. This record is deleted when the code is used or expires; expired codes are pruned within a day. An account created by email has no name or picture. If you later sign in with Google using the same email address, both methods sign in to the same account, matched on the verified email address, and the account gets your Google name and picture. **Weekly Domain Rating email.** If your account owns a listing, we email you once a week with the Domain Rating of each listing's domain and how it changed since the week before. Every email has a one-click unsubscribe link, and you can turn it off or back on from your listings page while signed in. We record when the last one was sent so you never get two in a week. Either way, we also keep a login session record (a hashed session id, its expiry, and hashes of the IP address and user agent it was created from) so you stay signed in. ### When you add a product or founder profile - **What you submit.** The product link and the listing text, images, categories and tags you review and publish. This is public. - **Founder profiles.** If you put your name on a listing: the name, photo, short bio, website and X / LinkedIn handles you enter. This is public on your founder page. - **Ownership.** Your anonymous voter id, and your account id if you are signed in, are stored with the listing and any images you upload, so only you can edit them. Signing in when you submit lets us attribute the listing to your account. - **Badge checks.** A free listing goes live once the "Featured on SwipeToLaunch" badge is on your product's homepage. When you click "Verify", we fetch your product's public website (the link you submitted) once, and then roughly once a week, to check that the badge is there. We store when we checked, whether the check passed, and the page URL where the badge was found. We don't store the page's content. While the badge is verified, the link from your listing to your site is a normal (followed) link instead of nofollow. - **Paid listing payments.** If you buy a paid plan, the payment is taken by **Dodo Payments** on its own checkout page. Dodo Payments is the merchant of record: it is the seller on your invoice, collects any applicable tax, and issues the receipt. We never see your card number. Dodo Payments sends us the payment's id, status, amount, and the email address you gave at checkout, which we store with the listing so we can show you the payment state and handle refunds. Dodo Payments' handling of your data is covered by [its privacy policy](https://dodopayments.com/privacy-policy). ### When you see our badge on another site Some product websites show a "Featured on SwipeToLaunch" badge, an image loaded from `https://swipetolaunch.com/api/badge/…` that links to the product's listing here. When you visit such a site, your browser requests that image from us like any other image, which sends us your IP address and browser user agent. The image is served from our edge cache. We don't set cookies on it or build profiles from it. ### What we don't collect No card details (Dodo Payments holds those), no advertising ids, and no device fingerprints beyond the hashes above. We don't use the analytics below for advertising or to build profiles across other sites. ## How we use Google user data Information received from Google is used only to: 1. identify your account when you sign in and keep you signed in, including linking Google sign-in to an account you created by email with the same address; 2. show your name and picture next to things you added, where you choose to be attributed; 3. contact you about a listing you added, if we need to. We do not sell it, use it for advertising, share it with third parties except the infrastructure providers listed below that store it for us, or use it to train AI or machine-learning models. Our use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ## Cookies The site sets these cookies itself, all needed for it to work: - `stl_anon`: your anonymous voter id. Signed, httpOnly. Lasts 365 days. - `stl_session`: keeps you signed in, only set if you sign in (with Google or with an email code). Lasts 30 days or until you sign out. - `stl_oauth_state`, `stl_oauth_verifier`, `stl_oauth_return`: short-lived cookies that protect the Google sign-in step and remember which page to send you back to. Deleted as soon as sign-in finishes. Email sign-in sets no cookies besides `stl_session`. Your light or dark theme choice is stored in your browser's local storage, not in a cookie, and never leaves your device. ### Analytics We use three analytics services to see which pages are visited and where the site is confusing or broken. Google Analytics and Clarity set their own cookies (Google Analytics: `_ga` and `_ga_*`; Clarity: `_clck`, `_clsk` and related) and receive your IP address, browser and device type, the pages you view, and how you interact with them. Cloudflare Web Analytics sets no cookie. - **Google Analytics** (Google) counts visits, pages and referrers. See [how Google uses data from sites that use its services](https://policies.google.com/technologies/partner-sites). - **Microsoft Clarity** (Microsoft) records anonymised clicks, scrolls and page interactions, including session replays, with text and form input masked. See the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement). - **Cloudflare Web Analytics** (Cloudflare) counts page views and load times. It sets no cookie and does not fingerprint the browser. You can block them with a content blocker or your browser's tracking protection, or opt out of Google Analytics with the [Google Analytics opt-out add-on](https://tools.google.com/dlpage/gaoptout). The site works the same without them. ## Who processes the data We don't sell or rent personal data. It is handled only by the providers that run the site for us: - **Cloudflare** hosts the site and stores the database and images (Workers, D1, R2, Images, Browser Rendering), and provides Cloudflare Web Analytics. All requests pass through Cloudflare's network. - **Google** provides sign-in, only if you choose to use it, and Google Analytics. - **Microsoft** provides Clarity analytics. - **Dodo Payments** (Dodo Payments Inc.) processes paid listing payments as merchant of record, only if you buy a paid plan. - **Cloudflare Email Service** (Cloudflare, Inc.) sends sign-in codes and the weekly Domain Rating email from login@swipetolaunch.com, with **Resend** (Resend, Inc.) as a fallback email provider. They receive only your email address and the message. - **Ahrefs** (Ahrefs Pte. Ltd.) provides the Domain Rating shown on listing pages and in the free tools. We send Ahrefs the listing's domain name, never anything about you. - **An AI model provider**, reached through our AI gateway, reads the public web page of a product you submit so it can draft the listing. Only that page's public content is sent, never your personal data. We may disclose data if the law requires it, or to protect the site and its users from fraud or abuse. ## What is public Listings, founder profiles, scores and vote counts are public by design: that is the product. Individual votes are never shown. Nobody can see how a particular person voted. ## How long we keep it - Votes and their abuse-detection data are kept for as long as the product or founder they belong to is listed, because the public score is made of them. - Accounts are kept until you ask us to delete them. Expired login sessions are removed. - Listings and founder profiles stay up until they are removed at your request or by moderation. - AI drafts of submitted pages are cached for 7 days and then discarded. - Email sign-in codes are deleted when used or expired; expired codes are pruned within a day. ## Your choices and rights - **Stay anonymous.** You can swipe without ever signing in. Clearing your cookies gives you a fresh anonymous id. - **Sign out** at any time. You can also revoke SwipeToLaunch's access in your [Google account settings](https://myaccount.google.com/permissions). - **Access, correct or delete.** To get a copy of the personal data we hold about you, correct it, or delete your account, founder profile or listings, email [hello@swipetolaunch.com](mailto:hello@swipetolaunch.com). We reply within 30 days. Because anonymous votes are not linked to your identity, we can only find them if you give us the voter id from your `stl_anon` cookie. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have further rights, including objecting to processing and complaining to your local data protection authority. We honour those rights for everyone, wherever they live. ## Legal basis (EU and UK) We process anonymous vote and abuse-detection data based on our legitimate interest in running a fair poll, analytics data based on our legitimate interest in understanding and improving the site, account data to provide the sign-in you asked for, badge checks to provide the verification you asked for, and submitted listings to publish what you asked us to publish. ## Children SwipeToLaunch is not directed at children under 13, or under 16 in the EU and UK, and we do not knowingly collect their personal data. If you believe a child has given us personal data, email [hello@swipetolaunch.com](mailto:hello@swipetolaunch.com) and we will delete it. ## Security Traffic is encrypted with HTTPS. Cookies are signed, httpOnly and Secure. IP addresses and user agents are stored only as salted one-way hashes, session ids are stored hashed, and email sign-in codes are stored only as salted hashes. No system is perfectly secure, but we keep the data we hold small on purpose. ## Changes If we change this policy, we will update this page and the date at the top. If a change materially affects how we use data you have already given us, we will say so on the site before it takes effect. ## Contact Questions about privacy or this policy: email [hello@swipetolaunch.com](mailto:hello@swipetolaunch.com).