Privacy Policy

We collect information needed to operate SwipeTrove and provide account features:

• Account identifiers such as email address, display name, profile image, and internal user ID.
• Creative references, source links, collections, Playbook drafts and selected references, manual tests and lessons, research-activity records, preferences, and subscription status associated with your account.
• Billing identifiers and lifecycle status received from Paddle, such as customer, subscription, product, price, transaction-event, renewal, and cancellation information. SwipeTrove does not receive or store full payment-card numbers.
• Waitlist email address, signup source, confirmation status, and optional product-update consent.
• Public source URLs or IDs submitted to the authenticated reference-import utility and technical information needed to process them.
• Device, browser, IP address, request logs, and security events used for reliability and abuse prevention.
• Messages submitted through the contact form, and product feedback linked to your account, including the category, product area, optional ease-of-use rating, follow-up permission and review status.

Feedback you submit inside SwipeTrove is stored privately for you and authorized administrators to review and improve the product. Administrators may keep private triage notes. We do not automatically capture screenshots, private workspace URLs or research content with feedback, and feedback text is not sent to Google Analytics.

Optional follow-up permission allows us to contact you about your submission or usability research; it does not subscribe you to marketing emails. You can withdraw permission or request feedback removal through support. Your personal-data export includes your submissions and review status. Feedback and private triage notes are removed when account deletion is processed, subject to operational backups and legal requirements.

Authentication is operated by SwipeTrove using one-way password hashes, short-lived access tokens, rotating refresh tokens, and secure HTTP-only cookies. Plaintext passwords and refresh tokens are not stored. Optional passkeys and authenticator-app codes add a verification step after email and password. Passkeys store a public credential rather than your device’s biometric data. Authenticator-app secrets are encrypted at rest, and recovery codes are stored as one-way hashes.

You are responsible for keeping your account and sign-in methods secure. You may request account deletion through the contact page.

Public source URLs submitted by signed-in users may be processed to identify reference media made available by the source. Media may pass temporarily through our servers or short-lived operational caches. Inspecting a source alone does not create a retained media copy.

When an entitled Pro user saves an eligible creative, SwipeTrove may copy that creative into a private media archive at the user's request. Archive access remains account-controlled, is subject to plan quotas and retention rules, and may be disabled or removed in response to deletion, account closure, legal requirements, or a valid rights complaint.

Accounts may retain creative references, archived media, collections, Playbook recommendations and selected evidence, private manual tests and lessons, notes, structured creative classifications, tags, favorites, research activity, and export requests. This data can include advertiser name, source URL, thumbnail URL, platform, media type, timestamps, and user-entered research. Pro Playbook handoffs expose selected evidence and the saved recommendation according to the previewed sharing options; private notes and tags require explicit inclusion, and manual learning entries are not included in recipient handoffs. Deleting a saved creative queues its private archived objects for deletion, subject to operational backups and legal retention requirements.

The SwipeTrove browser extension supports saving selected public Meta Ads Library references and downloading available creative media for authorized research. On supported Ads Library pages, it adds Save and Download controls. When your account is connected, it may send visible public ad IDs to SwipeTrove to show which references you have already saved. When you select an ad, it may read the active page URL and visible information needed for that action, such as the ad ID, advertiser name, available copy, headline, destination, creative media and thumbnail URLs, media type, position, source URL, and capture status. It does not collect your general browsing history or continuously monitor unrelated pages.

When you save or update a reference, the extension sends the selected reference data and any competitor selection, new competitor name and Facebook Page source link, collection, tags, notes, or favorite setting you provide to SwipeTrove over HTTPS. When a connected account completes a download, the extension also records that account, the public ad ID and source URL, media URL and type, number of downloaded files, extension version, and completion time so SwipeTrove can provide download history and measure aggregate product reliability. Anonymous downloads are not assigned a SwipeTrove user or persistent device identifier.

A short-lived extension access token is stored in Chrome session storage and is cleared when the browser session ends. To recover from popup closure, offline errors, or a service-worker restart, an unfinished save draft, including competitor choices and a new competitor form, and its current stage may be stored locally in the extension for up to seven days. Drafts are scoped to the connected SwipeTrove account and selected ad, removed after a successful save, and are not stored in Chrome sync. The extension does not receive your password, payment-card details, Paddle credentials, R2 credentials, or database credentials.

SwipeTrove uses information received through Chrome extension APIs only to provide or improve this user-facing research workflow, secure the service, or comply with law. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell extension data or use it for personalized advertising.

We use strictly necessary cookies for internal authentication sessions, CSRF protection, security, and account continuity. Local storage may remember theme and result-layout preferences. If a research-note save is interrupted, the unsaved draft may remain in session storage for that browser tab so it can be recovered after reopening the note or reloading the tab; it is scoped to that account and saved reference, removed after a successful save, and cleared when the tab session ends. Google Analytics may use cookies on eligible pages. We also use a short-lived first-party cookie or session storage for approved acquisition categories and a local browser marker to suppress internal analytics traffic.

SwipeTrove uses Google Analytics 4 automatically to understand aggregate website traffic, signup and activation steps, and use of core product features.

We limit analytics events to controlled categories such as page path, acquisition source, login method, media type, export format, and whether a product action succeeded. We do not intentionally send names, email addresses, account or subscription identifiers, ad IDs, source URLs, search text, notes, collection names, tag names, feedback text, ratings, or payment details to Google Analytics. Query strings and raw referrers are excluded, and dynamic collection paths and page titles are replaced with fixed labels. Google signals and ad-personalization signals are disabled.

Analytics is suppressed on administrator pages and sensitive routes such as email verification, password reset, extension connection, product feedback, and public collection links. Administrators, configured internal or reviewer accounts, and browsers marked as internal are excluded. These account exclusions cannot identify a fresh signed-out browser before it signs in.

You can restrict analytics through your browser privacy controls or content-blocking settings. Strictly necessary authentication and security cookies remain required while using an account.

We rely on service providers that process data on our behalf or as independent controllers where applicable:

• Hostinger for VPS infrastructure hosting, including the private PostgreSQL database operated by SwipeTrove.
• Cloudflare for website security, traffic delivery, and private R2 object storage used by private media archives.
• Resend, when configured, for email verification, password reset, waitlist confirmation, and consented product-update email.
• Paddle for paid checkout and subscription administration as Merchant of Record when checkout is enabled. Paddle handles buyer payment details, applicable taxes, fraud controls, and receipts under its own Privacy Notice and Buyer Terms.

When live paid checkout is enabled, payment details are entered into Paddle's checkout rather than SwipeTrove's systems. Paddle may collect buyer name, email, billing location, tax information, payment details, and transaction-risk information.

Paddle sends SwipeTrove the identifiers and lifecycle events needed to activate access, show renewal and cancellation state, provide billing support, prevent fraud, and maintain accounting records. Sandbox checkout uses test data and cannot create a real charge.

• Profiles and subscription records are retained while an account remains active and as required for legal, fraud, or accounting purposes.
• Creative references, notes, and collections remain until you delete them or an account-deletion request is processed, subject to backups, legal holds, and valid rights complaints. Private media archives also have plan-based retention: when Pro access ends, existing copies enter a 30-day retrieval window before scheduled removal. Re-upgrading before removal cancels that scheduled deletion; removing archived media does not remove your notes or collection organization.
• Free accounts can view seven days of reference-import activity; older records may remain available for service integrity or future entitled access until deleted or the account is removed.
• Confirmed waitlist records are retained through the Pro launch period or until you withdraw. Unconfirmed records may be deleted periodically.
• Product feedback and its review notes remain associated with your account until a verified removal or account-deletion request is processed, subject to backups and legal requirements.
• Contact messages are generally retained for up to 12 months after resolution.
• Security and request logs are retained only as long as reasonably necessary for operations, abuse prevention, and legal obligations.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data. You may also withdraw consent where processing relies on consent and complain to a supervisory authority.

California residents may request disclosure, correction, or deletion of personal information and may have rights concerning sale or sharing. SwipeTrove does not sell personal information for money. We will not discriminate against users for exercising applicable privacy rights.

Signed-in users can request a private personal-data export from Data & privacy settings on any plan. For other verified requests, use the privacy request form or email [email protected].

We use HTTPS, access controls, row-level security, rate limiting, secure session management, and restricted service credentials. No online service can guarantee absolute security. Providers may process data in countries outside your residence using safeguards available under applicable law.

Questions or privacy requests can be sent through our contact form or to [email protected]. SwipeTrove is an independently operated software product.