Privacy, Cookies & Terms

Last updated: 11 August 2026

This policy is available in several languages for convenience. The English version is authoritative - if there is any difference, the English text applies.

1. Who we are

swish ("we", "us") is an independent fashion discovery service based in Romania. We show you clothing from retailers we have a licensed feed for, and you swipe through it. We are not a shop: we never hold stock, take payment, or fulfil orders - every purchase happens on the retailer's own website, under their terms. For anything to do with your data, the data controller is reachable at hello@swishshop.net.

This policy describes what the app and the website actually do today. Where something is not built yet, or where a control you would expect does not exist, we say so plainly rather than describing an intention.

2. Using swish without an account

You can browse and swipe without signing up. At the end of setting up your feed we ask one clear question - whether we may use the country your phone is set to, so we only show you shops that can actually deliver to you. You can say no, and saying no is a single tap that costs you nothing: you keep the whole app and simply see every catalogue instead of a filtered one. You can change your mind either way in Account.

If you carry on without an account, we create a guest session - a random ID with no email, name or password attached - so your swipes survive closing the app and your feed can keep learning. Be clear about what that means: you have not told us who you are, but it is still a profile tied to an ID we hold, so the law treats it as personal data and so do we. It is not anonymous, and like any signed-in session it records an IP address and a device user-agent.

3. What we collect

From everyone, including guests. In short: what you swipe and how you use the app. Your likes and skips, your this-or-that answers, and the ordinary things you do in it - opening a shop, changing a filter or currency, browsing a gallery, finishing setup - are recorded so we can build a feed that actually suits you. Each of those is a simple action from a fixed list, never free text. We keep a copy of each liked item's details as they were when you liked it, so your saved list still works after the item sells out.

Alongside that we hold the plumbing that makes it work: the random session ID your data hangs on, your operating system, device model and app version so we can tell what breaks where, and - like any signed-in session - an IP address and device user-agent recorded with every session, guests included. If you turn on notifications we hold a push token for your device, and if you send us a bug report we get your message and which screen you were on. The retired recommendation experiment's install ID and A/B assignment are no longer collected.

Only if you create an account we also hold your email address and a name, and a password that is only ever stored hashed - we cannot read it. We do not ask for your date of birth, or your age. If you sign in with Google, Facebook or Apple we store the link to that account and its tokens, encrypted. If you claim a username you get a profile - a display name, a private/public setting and an avatar - and unless you set it to private, others can find you by searching the start of your username. Friends you connect with and outfits you share are stored too.

The waitlist. If you join the waitlist on swishshop.net we store the email you enter, the page language you were reading, and which form you used - the language so we can write to you in it. The app offers the same list when swish cannot yet deliver to your country, prefilled with your account's email address. Either way the entry holds only your email, a language and which form it came from: it is not linked to your account by any shared ID, and it is not deleted when you delete your account - email us and we will remove it.

Everything is held on servers in Ireland, with access controls so you can only ever reach your own data. We do not collect payment or card details - purchases happen entirely on the retailer's site - and we do not knowingly collect special-category data such as health, beliefs or biometrics.

4. What we never collect

Some of these are worth stating because apps like ours often do collect them. We do not:

Your location. No GPS, no location permission, no location SDK, and we never look your location up from your IP address. We do work out a rough country - section 5 explains exactly how, and what happens to it.
Your date of birth or age. We never ask, and there is no field for it.
An advertising ID. No IDFA, no Android advertising ID, no ad-tracking prompt, no advertising SDKs of any kind.
Your contacts, camera, microphone or photos. The app does not ask for these permissions.
Crash reports. Despite what our previous policy said, no crash-reporting service is switched on in the app you have. If we turn one on, we will update this page first.
Anything identifying you, passed to affiliate networks. The links we open carry campaign-level tracking only - there is no swish user ID, install ID or reference code attached.

5. How we work out your country, and what happens to it

We read your device's language setting - the same setting that tells your phone to show dates and numbers your way - and take the country from it. That gives us a country and nothing finer: it can tell us you are in Romania, never where in Romania. Picking your starting language and currency from it happens entirely on your phone and is not something we ask permission for, because nothing is collected to do it. What we do ask permission for, at the end of setting up your feed, is using that country to decide which shops you are shown - and you can change that answer in Account at any time.

Your shopping-region choice stays on your device. We save whether you chose automatic, everywhere, or a particular two-letter shopping region in the app's local storage. It is not added to your account, profile or analytics. In automatic mode the country worked out from your phone's language setting is likewise not written to your account.

It does leave your phone in one narrow way, and we would rather spell it out than let you discover it. Catalogue requests may tell our servers either which merchants are eligible, or a canonical catalogue market and department such as US:women. That catalogue market is not necessarily your country - for example, Canadian and US delivery can use the same US catalogue - and it never includes a city, address or precise location. It is used to answer the request and is not added to your account or analytics. Choosing Everywhere, or saying no to country personalisation, sends no regional restriction.

6. What stays on your device

Some things never leave your phone at all. Your learned taste profile is calculated and stored locally - only the individual swipes behind it are synced, never the profile itself. The same goes for your deck history, the names you give your outfit collections (we only ever see an opaque ID), your chosen currency, the cached exchange rates, and the shake-to-report motion detection, which compares movement to a threshold in memory and stores nothing. Your session token is held in your device's secure keystore, not ordinary app storage.

7. Why we use it, and our legal basis

To run the app - keeping you signed in, storing your saved items, syncing them across your devices. Basis: performance of a contract for account holders, and our legitimate interest in providing a working service to guests.
To personalise your feed - the whole point of the product. This profiling only affects which clothes you are shown; it has no legal or similarly significant effect on you. Basis: legitimate interests.
To keep it working - fixing bugs from your feedback, understanding which devices fail, limiting abuse, and basic internal analytics such as how many people liked an item. Basis: legitimate interests.
To send you email you would expect - verifying your address, resetting your password, and waitlist messages you asked for. Basis: contract, or consent for the waitlist.
To send push notifications. Basis: your consent, given through your device's notification permission and withdrawable there at any time.

We do not use your data to make any automated decision that produces a legal effect or similarly significantly affects you.

8. Going from guest to an account

If you sign up or log in after using swish as a guest, we move what you collected as a guest onto your account, so nothing you liked is lost. Your likes, skips, swipe history, this-or-that answers, feedback and push token are reassigned to the account ID, merging sensibly where the account already has the same items.

9. Cookies and local storage

The app uses on-device storage to work at all: your session token, your saved swipes and your taste profile. There are no advertising or cross-site tracking cookies in the app. The swishshop.net website uses one cookieless analytics beacon to count page views, and stores your language choice locally so you are not asked twice. When you tap through to a retailer, that retailer and the affiliate network set their own cookies under their own policies, which we do not control and cannot read.

10. Shopping, affiliate links and retailers

When you tap "Shop", we hand the link to your device's browser, which opens the retailer's own site through an affiliate network - Awin, or 2Performant for some brands. We may earn a commission if you buy, at no extra cost to you. It never changes the price you pay, and it does not influence what we show you beyond normal personalisation. The link carries campaign-level tracking only, with nothing identifying you attached. From that point the retailer's own privacy policy and terms apply, and we never see your payment or order details.

One thing worth being straight about: product images are loaded directly from the retailer's image servers as you swipe. That means the retailer's CDN sees your IP address and device user-agent simply because a card appeared on your screen, before you tap anything. That is how images on the internet work, but it is a real disclosure and most policies leave it out.

11. Friends and sharing

If you claim a username, others can find you by searching the beginning of it - unless you set your profile to private. Outfits you share are visible to the friend you send them to, along with the items in them and any title you add. None of this is visible to anyone outside swish, and none of it is shared with partners. Resetting your taste with "Remove my data" leaves all of it alone. Deleting your account does remove your friendships and every outfit you sent or received - which means your friends lose the outfits you sent them, so it is worth knowing before you do it.

12. Companies we rely on

We keep this list short on purpose. Each of these receives only what is listed, and none is allowed to use it for their own advertising or profiling:

Convex - our backend, database and file storage, on servers in Ireland. Everything in section 3 lives here. Our sign-in system runs inside it rather than being a separate company. Convex is a US-headquartered vendor, so support access from outside the EEA is possible.
Resend - sends verification, password-reset and waitlist emails, from their EU (Ireland) region. Receives your email address and the message.
Expo (US), then Apple or Google - deliver push notifications. They receive your push token and the contents of the notification.
Google, Facebook or Apple (US) - only if you choose to sign in with them, and only then.
Awin (UK) and 2Performant (Romania) - affiliate networks. They see your IP address, user-agent and their own cookies when you tap through, plus campaign-level tracking. No swish identifier.
The retailers and their image servers - currently including Zalando and boohoo and their CDN providers. They see your IP address and device user-agent whenever product images load, as explained in section 10.
An exchange-rate service (US) - contacted at most once a day to refresh currency rates. It receives your IP address, because any web request does, and nothing else - no account data, no identifier. It is a free public API, so unlike the others there is no contract behind it.
Cloudflare (US) - hosts the swishshop.net website only, not the app.

International transfers. Your database and your email both sit in Ireland. The ones that do leave the EEA are push delivery, social sign-in, the exchange-rate lookup, the website host, and Awin in the UK. Those transfers rely on appropriate safeguards - the UK adequacy decision for Awin, and the EU Standard Contractual Clauses for the US providers.

13. We do not sell your data

swish does not sell your personal information, and does not share it with advertisers, brands or data brokers for their own marketing or profiling. Our previous policy said otherwise; that was wrong, and this corrects it. We share data only with the providers in section 12, acting on our instructions, and with the affiliate network when you choose to tap through so a purchase can be credited. If this ever changes we will update this page and ask for any consent the law requires before doing it.

14. Notifications

Notifications are on by default, and cover things like an item you saved coming back in stock. There is a switch in Account to turn them off, and turning it off does more than mute them: it deletes the push address we hold for your device, so we are no longer keeping a way to reach it. Your phone's own notification settings work too, and override us either way. Nothing is sent to you if you never grant the OS permission in the first place.

15. Your controls, and exactly what they do

There are two controls in the app, both on the Account tab. They do different things and it matters which you use.

"Remove my data" is a fresh start, not a goodbye. It deletes the things that make up your taste - your likes and skips, your swipe history, your this-or-that answers and the learned profile built from them - from your device and from our servers, so the feed begins again from nothing. You stay signed in and you keep everything that is you: your account, your username and profile, your friends, outfits you have shared or been sent, and your notification setting. Use it when the feed has learned the wrong thing about you.

"Delete my account" removes everything. Your taste data, your profile and username, your friendships, every outfit you shared or received, your push token, and the account itself - email, name, password and any linked Google, Facebook or Apple login. This is the one to use if you want to be gone. It is only available once you have a real account. It runs as a single step on our side, so if any part of it fails nothing is deleted at all and you keep your account intact - we would rather refuse a deletion than leave you half-erased.

You can also remove any single saved item from your likes at any time. Individual skips, activity records, this-or-that answers, feedback reports and shared outfits cannot be deleted one at a time in the app - email us and we will do it for you.

16. What we cannot delete for you

We would rather list these than let you assume otherwise:

A guest identity. If you have never made an account, "Remove my data" erases everything we collected about you, but the empty guest ID and its session records remain. There is no in-app way to remove those, because there is no way to prove they were yours. Contact us and we will remove them.
A waitlist email. Whether you joined from the website or from inside the app, a waitlist entry is not linked to your account, so deleting your account does not remove it. Email us and we will delete it.
Anything already sent to someone else. Emails delivered by our email provider, notifications already handed to Apple or Google, and cookies or click records held by a retailer or affiliate network are outside our reach. Those are governed by their own policies.

17. How long we keep things

Honestly: until you tell us to delete it. We do not currently run any automatic expiry, so your data stays for as long as you keep using swish, and goes when you use one of the controls in section 15 or ask us. Password-reset links expire after an hour. We know a defined retention schedule is better practice and we are working towards one; we will update this section when it exists rather than claiming it now.

18. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it - including objecting to the profiling that personalises your feed - and to withdraw any consent you have given. Exercising these rights costs you nothing and we will not treat you differently for it.

There is no data-export button in the app yet, so for a copy of your data email hello@swishshop.net and we will send it. We answer every request within one month. If we get it wrong, you can complain to Romania's data-protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

19. Security

Everything travels over HTTPS. Passwords are stored only as hashes we cannot reverse, third-party login tokens are encrypted at rest, your session token lives in your device's secure keystore, and access rules mean one account can never read another's data. No system is perfectly secure, but we use reputable providers, apply appropriate technical and organisational measures, and will notify you and the supervisory authority of any qualifying breach as the law requires.

20. Children

swish is not directed at children under 16 and we do not knowingly collect their data. We do not ask for anyone's age, which means we rely on you telling us: if you believe a child has given us data, contact us and we will remove it.

21. Where swish is available

Our current licensed catalogues cover Romania and boohoo's United States and Canada programme. A retailer may operate elsewhere without our particular affiliate catalogue covering that market. You can browse from anywhere, but if you have an account and enabled country personalisation, we show a waitlist when none of our live catalogue programmes can serve the selected or detected shopping region. If you did not give us that permission, we simply show you everything.

We are actively working on bringing swish to more countries. If swish is not available where you are and you would like it to be - or if you think we have your country wrong - email hello@swishshop.net. Where people are asking from genuinely shapes which market we open next, so it is worth telling us.

22. Terms of use

swish is provided "as is" as a discovery tool. Prices, availability, sizing and product details belong to the retailers and change constantly - always confirm on the retailer's site before buying.
Your purchase contract is with the retailer, not swish. Returns, warranties, delivery and payment are entirely theirs.
Please do not misuse the service - no scraping, reverse engineering, automated abuse, or unlawful use.
swish is provided without warranties to the extent the law permits, and we are not liable for the acts, products or websites of third-party retailers.
We may suspend or remove accounts that abuse the service or these terms.
Governing law is Romania; any EU consumer-protection rights that apply to you are unaffected.

23. Changes

We will update this page whenever what we do changes, and revise the date at the top. If a change materially affects your rights, we will tell you in the app rather than quietly editing this page.

24. Contact

Anything at all about privacy or these terms, including any request under section 18: hello@swishshop.net.