Privacy Policy

1. Introduction

GeoSwap ("the Service") is a free geo-targeting platform operated by GeoSwap ("we," "us," "our"). The Service enables website owners to create geo-targeted redirects, geo short links, and personalized content experiences for their visitors.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data. It applies to all users of the GeoSwap dashboard, the geoswap.js script, Geo Links, and any related services.

We are committed to protecting your privacy and complying with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account through our authentication provider (Clerk), we collect:

• Your name and email address as provided during registration
• Profile information associated with your authentication method (e.g., Google or GitHub profile)
• Account preferences and team membership details

2.2 Configuration Data

We store the geo-targeting rules, redirect configurations, link settings, and content personalization rules you create within the Service.

2.3 Visitor Analytics Data

When visitors interact with websites using GeoSwap's geo-targeting features, we collect aggregated analytics data including:

• Geographic location (country, region, and city) derived from the visitor's IP address at the network edge
• Device type and browser information extracted from the user agent string
• Whether the request originated from a known search engine bot or crawler
• The page URL where the geo-targeting action was triggered
• Redirect, link click, and content display event counts
• Timestamps of events

2.4 Information We Do NOT Collect

We want to be explicit about what we do not collect:

• IP addresses are not stored. Visitor IP addresses are processed at the edge solely to determine geographic location. They are never written to our database, logs, or any persistent storage.
• We do not track individual visitors across websites or sessions.
• We do not build visitor profiles or use fingerprinting techniques.
• We do not collect payment information (the Service is free).
• We do not collect sensitive personal data such as health information, religious beliefs, or political opinions.
• We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

3. How We Use Information

We use the information we collect for the following purposes:

3.1 Providing and Operating the Service

• Processing geo-targeting decisions at the edge based on visitor location
• Executing redirects, link routing, and content personalization
• Displaying analytics dashboards to account holders about their geo-targeting rules
• Managing accounts, teams, and access permissions

3.2 Communication

• Sending service-related communications such as team invitations, account notifications, and security alerts
• Responding to support requests or inquiries you send to us

3.3 Service Improvement

• Analyzing aggregated usage patterns to improve the Service
• Identifying and fixing bugs, errors, and security issues
• Developing new features based on how the Service is used

3.4 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Enforcing our Terms of Service and protecting against misuse

4. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation applies, we process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)): Processing your account data and configurations is necessary to provide the Service you registered for.
• Legitimate interests (Article 6(1)(f)): We process aggregated analytics data and usage patterns to improve the Service, maintain security, and prevent abuse. We have assessed that these interests do not override your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)): Where we are required to retain or disclose data to comply with applicable laws.
• Consent (Article 6(1)(a)): Where explicitly given for optional features or communications. You may withdraw consent at any time.

5. Cookies and Tracking Technologies

We use a limited number of cookies that are strictly necessary for the Service to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

5.1 Dashboard Cookies

• Authentication cookies (set by Clerk): Essential for maintaining your signed-in session. These are strictly necessary and do not require consent.
• geoswap_active_workspace: Stores your currently selected account for multi-account switching. This is a functional cookie necessary for the Service.

5.2 Visitor-Facing Cookies (geoswap.js)

When a website uses GeoSwap's geo-targeting script, the following cookies may be set on the visitor's browser:

• geoswap_visited_{ruleId}: A small cookie used to identify whether a visitor has previously triggered a specific redirect rule, enabling "first visit only" behavior. Contains no personally identifiable information.
• geoswap_popup_dismissed_{ruleId}: Records that a visitor has dismissed a specific popup so it is not shown again. Contains no personally identifiable information.

These visitor-facing cookies are minimal, first-party, and do not contain any personal data. They are used solely to prevent repetitive actions and improve visitor experience.

5.3 No Third-Party Tracking

We do not embed third-party trackers, pixels, or analytics scripts (such as Google Analytics) on the marketing site or in the geoswap.js script. We do not participate in cross-site tracking or retargeting.

6. Data Sharing and Third Parties

We do not sell your data. We share data only with the following categories of service providers that are necessary to operate the Service:

All service providers process data solely on our behalf and in accordance with our instructions. They are bound by data processing agreements and are prohibited from using the data for their own purposes.

We may also disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of GeoSwap, our users, or others.

7. International Data Transfers

Our infrastructure providers operate globally. Your data may be processed in countries other than your own, including the United States. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or reliance on adequacy decisions.

Cloudflare Workers process visitor requests at edge locations worldwide. IP addresses are used transiently at the nearest edge node for geographic determination and are not transferred to or stored at any central location.

8. Data Retention

We retain data according to the following schedule:

• Account data: Retained for as long as your account remains active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.
• Configuration data: Deleted when you delete the associated rules or your account.
• Analytics data: Stored in aggregated, non-personally identifiable form. May be retained indefinitely to provide historical analytics to account holders.
• Visitor IP addresses: Not retained. Processed transiently at the edge and discarded immediately after geographic determination.
• Visitor-facing cookies: Expire automatically based on the rule configuration set by the website owner.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: You may request that we limit the processing of your data in certain circumstances.
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@geoswap.co. We will respond to your request within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to opt out of sale: We do not sell personal information. No opt-out is necessary.

In the preceding 12 months, we have not sold any personal information and do not intend to do so. To submit a CCPA request, contact us at privacy@geoswap.co.

11. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit using TLS for all data transmitted between your browser, our servers, and third-party services
• Encryption at rest for database storage
• Role-based access controls within the dashboard and internal systems
• Edge processing of sensitive data (IP addresses) that never reaches our central servers
• Regular security reviews and dependency auditing

While we strive to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

12. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such data promptly. If you believe a child under 16 has provided us with personal data, please contact us at privacy@geoswap.co.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Provide notice through the Service dashboard for significant changes
• Where required by law, obtain your consent before applying changes to previously collected data

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes have been posted constitutes your acceptance of the revised policy.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will acknowledge receipt of your inquiry within 5 business days and aim to resolve all privacy-related requests within 30 days.