Privacy Policy

SwiftTune acts as the data controller for personal data processed via SwiftTune. Contact: info@swifttune.workers.dev.

• Account identifiers (email, name) supplied at sign-up.
• Authentication metadata from our identity provider (Auth0).
• Content you upload to the Service.
• Operational logs (request IP, timestamp, user-agent) retained for security and abuse-prevention purposes.

We process the data above on the legal basis of (a) contract performance — to deliver the Service you signed up for — and (b) legitimate interest, where applicable, for security, fraud prevention and product analytics, with consent for non-essential categories (see the Cookies clause below).

All data is processed and stored within the European Union (Cloudflare EU region: D1, KV, R2 all jurisdiction-locked). Authentication (Auth0) and billing (Stripe) sub-processors may transfer data within the EEA only.

Account data is kept for as long as your account exists. Operational logs are kept for 90 days. On account deletion you may request erasure of personal data at info@swifttune.workers.dev.

Under GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Access and portability are self-service: download your data as a machine-readable JSON file at any time, without asking us and without waiting. Exercise the remaining rights by emailing info@swifttune.workers.dev.

We use Cloudflare (EU region: infrastructure), Auth0 (authentication), and Stripe (payments). Each is a GDPR-compliant sub-processor with EU data-processing agreements in place.

We use industry-standard encryption in transit (TLS 1.3) and at rest. Application secrets are stored encrypted (AES-GCM) and rotated on schedule. Access to production data is restricted to a named operator list.

SwiftTune distinguishes three cookie categories:

• Essential — session, CSRF and authentication cookies (httpOnly, Secure, SameSite=Strict). Always on; without them the service does not work.
• Analytics — off by default, loaded only after you accept them.
• Marketing — off by default, loaded only after you accept them.

The consent banner shown on your first visit is where the two non-essential categories are accepted or rejected; rejecting is as prominent as accepting. You can change or revoke your choice at any time from your browser’s site data settings — clearing storage for this site re-shows the banner. We do not load any third-party tag before consent.

We may update this Privacy Policy. Material changes will be notified via email at least 30 days in advance. Continued use of the service after the effective date constitutes acceptance.

Data protection enquiries: info@swifttune.workers.dev.