Swage Privacy Policy
Last revised: 2026-11-11.
In short. We use your file to run your job. Within an hour after the job's time limit ends we delete it, the result and what we read from it, and only if you allow it do we keep what is left of a failed job, for up to 30 days. If you open an account, we keep your email address and what the service needs to run it. We also keep daily totals, which point to no one, and fingerprints of layer names and file content made with a secret key, which hold no job, account or address. You can ask for your data, close your account and object to processing at any time. The full text below prevails.
1. Who processes the data
This policy covers the Swage website and service at tryswage.com and its subdomains. The controller is Dmitrii Lutskov, a sole trader registered with the Israel Tax Authority. For questions about your data, write to or use the contact form.
The figures on this page are the defaults. The privacy policy at app.tryswage.com/privacy states the figures the service actually uses, and it prevails.
2. What data, why, for how long, on what legal basis
| Data | Purpose | Retention | Legal basis (GDPR) |
|---|---|---|---|
| The uploaded file and its content | Run the conversion job you started | The uploaded file is deleted once processing is done, or when the job is stopped, for example because your account was closed. What we read from it (our model of the file, which holds its full content) is kept until the job's time limit ends, so that a format can be added or the result written again. The result stops opening when the job's time limit ends (24 hours by default), and the result and the model are deleted within the following hour. If your account is closed, the result stops opening at once but stays stored until the end of the job's time limit, and it opens again if you keep the account. Once the account is deleted, what is left is deleted within the hour | performance of a contract, the terms of use (art. 6(1)(b)) |
| The record of a job after its time limit ends: the day it was made, the language, the output format, the outcome, the size of the file rounded to two figures, counters (features read and written, layers, seconds, the verdict) and a log of what was deleted, with no file name, address or email | Show how much and how well the service works, and answer a person who comes back for a result that is gone | 30 days. Then it is counted in the daily totals below and deleted. If your account is deleted, the record stays for the same time and holds nothing that points to you | legitimate interest in running and improving the service (art. 6(1)(f)) |
| Your network address (for IPv6, its /64 block) when you upload a file, send a chat message, a report, a review, the contact form or the news signup, ask for a sign-in, sign-up or password reset email, press the button in one, or try a password, and the size of an uploaded file | Protect the service from overload and abuse, for example from a script opening many accounts | 24 hours at most. The counters behind sign-in and sign-up emails are kept in memory only | legitimate interest in keeping the service stable (art. 6(1)(f)) |
| For an account that signs in with an email address, that address, copied to the job when you tick at least one of the boxes "Email me if reading takes over 15 min", "Email me when the format is to be chosen" and "Email me the result" on the upload form. Only the last one is ticked unless you change it, and your choice of each box is remembered for the next upload | Send you only the emails you ticked, when reading the file is still going 15 minutes after the upload, when the file is read and a format is to be chosen and when the result is ready or the job did not finish | The copy on the job is deleted with the job, or at once if your account is deleted. While your account waits to be deleted, the copy stays on the job and no email is sent to it. If you keep the account, jobs that have not expired send the emails you ticked again from then on. The choice of the boxes is kept until your account is deleted | performance of a contract, the terms of use (art. 6(1)(b)) |
| Email address given in the news signup form, the time of signup and confirmation, which consent text was shown | Send news about the service, only after you confirm the address through the link we send | Until you unsubscribe. An address never confirmed is deleted after 7 days. Closing an account does not unsubscribe you, because the news list is separate from accounts. Use the unsubscribe link in any news email | consent (art. 6(1)(a)) |
| Name (optional), email address and message sent through the contact form or by email | Answer your message | Kept in our mailbox for a year after the last message in the conversation, ours or yours, then deleted. The site itself stores none of it | legitimate interest in answering a message you sent us (art. 6(1)(f)) |
| A rights holder's notice (see For rights holders): the sender's name, an email address for our reply, the rights claimed and the material in dispute | Handle the notice | Until the matter is resolved and for 3 years after that | legitimate interest in handling claims about the site's content and being able to show how a claim was handled (art. 6(1)(f)) |
| Text and optional contact in a "Send for review" report or a "something's wrong" complaint, and your answer to "Did the result match what you expected?" with the job number | Find out why reading the file failed, and whether results match what people expect | 30 days. If your account is deleted, we remove at once any contact that is the account's address or was left on one of its jobs, and keep the rest without it until the 30 days are up | consent (art. 6(1)(a)) |
| A "Report a problem" message from a signed-in account holder or tester: your text, your email address or the name on your tester link, the page you were on with job numbers taken out, and the browser details shown to you before sending, which you can edit: browser and version, system, window size, language, time zone, script errors on that page, and on the upload page the state of the upload (file size and extension, never the file name) | Find and fix the problem you reported, and tell you the outcome | 30 days. We also email a copy of the report, with your email address or tester name, to our own mailbox, and keep it there for a year like any message to us. If you withdraw your consent, we delete that copy on request. If your account is deleted, your email address or tester name is removed from the report on the site at once, and the rest stays there without it until the 30 days are up | consent (art. 6(1)(a)) |
| Messages in the chat inside the app | Reply to you | 30 days. They are tied to your browser, not to your account, so closing an account does not remove them before then | consent (art. 6(1)(a)) |
| What is left of a job after a failure of ours: a copy of the file's data, the job log and the intermediate files. The uploaded file itself is never kept | Find the cause of the failure on our side | Kept only if you separately allowed it on the job page, until we finish looking into the failure and for 30 days at most. Deleted within the hour once your account is deleted | consent (art. 6(1)(a)) |
| Daily totals for the service as a whole: how many jobs ran, in which formats, how they ended, their total size and time, how many features were read and written. They hold no file, name, address or job number | Show on the site how much the service has done, and plan the load | Kept indefinitely | These are sums over all jobs that identify no one, so they are not personal data |
| Fingerprints of layer names and file content, made with a secret key only we hold. They are pseudonymous: they hold no job, account or address, but anyone with the key and a layer name or file can recompute one, so no one without the key can match them to a name or a file | Check layer-matching rules across many files | 180 days from the day the job is read, with no link to any job, address or file | legitimate interest in improving layer-matching rules (art. 6(1)(f)) |
| Opening an account at app.tryswage.com with an email address: the address you type on the sign-in page or on an invite link, and a one-time sign-up link sent to it. When you press the button with the box for the terms of use ticked, the account is made and we store the address, the version of the terms you accepted and the time you accepted them. If sign-ups are full for the day, we send that address one email saying so, with no link, and delete the address on the same schedule | Make your account only after you have proved the address is yours, and be able to show which terms you accepted | The link works once and for 15 minutes. If you never press it, the address you typed is deleted 24 to 25 hours after the email was sent. The account, the terms version and the time stay until your account is deleted | performance of a contract, the terms of use (art. 6(1)(b)) |
| Signing in to your account: your email address, when the account was made and how (the sign-in page, an invite link or a tester link), when you were last active (to the hour), a one-time sign-in link, a session cookie and on our side a one-way hash of that cookie with the times it was made and last used and, if you ask to close your account, a one-time link for that, stored only as a hash made with a secret key | Let you into your own account and keep your jobs apart from other people's | The link works once and for 15 minutes. A session lasts 30 days, or until you sign out, change or set your password from another session, or your account is closed. The rest stays until your account is deleted, or within 30 days after the service stops. The link to close your account works once and for 30 minutes, and stops working earlier if you sign out of any session, change your password, ask for a new link or your account is closed. We delete the record of the link no later than 24 hours after its time runs out, and it is never copied into a backup. Once you confirm, the account is closed and deleted 7 days later. What closing keeps and for how long is in section 7 of the terms of use. If you sign in or sign up again while the account waits to be deleted, we store a one-time token for the button that keeps the account, only as a hash made with a secret key. It works for 15 minutes, we delete it on the same schedule as sign-in links, and it is never copied into a backup. We use the address for an email that says when the account is to be deleted, a notice if it is kept and, in most cases, a notice when it is deleted | performance of a contract, the terms of use (art. 6(1)(b)) |
| Signing in with Google, if you choose it: your browser goes to Google, and Google sends us back your email address and whether it has verified that address. We use only the address. We store no name, no photo and no token of Google's. While you are on the way, a record holds random codes that tie the trip to your browser and, for an address with no account yet, that address until you accept the terms | Let you sign in without a password or an emailed link, and join the sign-in to the account that has the same email address | The record works for ten minutes and is deleted between one and two hours after it was made, and a backup copy does not hold it. The account, the terms version and the time stay until your account is deleted | performance of a contract, the terms of use (art. 6(1)(b)) |
| A password, if you set one: only a one-way hash of it, made with scrypt and a random salt of its own, so the password itself is never stored and we cannot read it. Next to it we store when you set the password and, if you chose not to be asked to set one, when you made that choice. If you ask for a new password, we email a one-time link to your address. The hash is never written to a log or shown on a page | Let you sign in without waiting for an email or take your account back if you forget the password and warn you if someone else changed it | The hash and the time it was set stay until you set a new password or your account is deleted. The time of that choice stays until your account is deleted. The link to set a new password works once and for 15 minutes. A backup copy holds neither the hash nor the time it was set, so after a restore you sign in by an emailed link and set a new password | performance of a contract, the terms of use (art. 6(1)(b)) |
| Wrong password tries, password reset requests and requests to close an account: a count of wrong tries kept under the email address typed (in a normalized spelling, also when no account has that address), a count of wrong tries per network address, a count of reset emails per address and per network address, and a count of emails that confirm closing an account, kept per account | Slow down password guessing, and stop these emails being used to flood someone's mailbox | 15 minutes for wrong tries, 24 hours for the counts of emails. The counts are kept in memory only | legitimate interest in protecting accounts from guessing and mailboxes from unwanted email (art. 6(1)(f)) |
| A one-way hash of the email address of an account we closed because it broke the terms. It is made with a secret key only we hold, so it cannot be found by guessing addresses. We keep nothing of this kind when you close your account yourself or ask us to delete it | Keep that mailbox from opening a new account through a sign-up or an invite link | 365 days, deleted within the following hour, or earlier if we let the address back in by hand | legitimate interest in keeping out an address we closed for breaking the terms (art. 6(1)(f)) |
| Sign-in by a tester link, which we make and hand to a tester ourselves. It creates an account with no email address, holding only the name of the person we made the link for, when the link was made and until when it works, how many times it was opened and when last. Opening the link creates a session, which is a cookie in your browser and, on our side, a one-way hash of it with the account it belongs to and the times it was opened and last used. Jobs you run are recorded with their job log, like any job | Let a tester in without asking for an email address, and see whether and when a link was used | The link works for the time we set when we make it, 30 days unless we choose otherwise, or until we close it or make a new one. A session ends no later than the link. Once the link has ended, the account is deleted 90 days after the end of the link or after the last sign-in, whichever is later. A job and its log are deleted at the end of the job's time limit, or within the hour once we delete the account | legitimate interest in testing the service with people we invited (art. 6(1)(f)) |
| Joining through an invite link we posted on a forum, in a post or in a reply: the email address you type, a one-time sign-in link sent to it, which of our links you came through and when, how many jobs you started and when you last started one. The account is made only when you press the button in that email with the box for the terms ticked, and we store the terms version and the time, as for any account | Let people in through a link we posted without asking anyone to wait for approval, and see which places bring people who use the app | The link works once and for 15 minutes. If you never press it, the address you typed is deleted 24 to 25 hours after the email was sent. The account and the record of the link you came through stay until your account is deleted | performance of a contract, the terms of use (art. 6(1)(b)), for the address and the account. Legitimate interest in seeing which of our links bring people who use the app (art. 6(1)(f)), for the record of the link you came through |
| For accounts: how many verified results you have opened and when we last asked for a review, kept under a one-way hash of your email address, not the address itself | Ask for a review only after your third verified job, and not more than once in 30 days | Until your account is deleted | legitimate interest in asking for feedback without asking too often (art. 6(1)(f)) |
| Counters on an account, a tester account too: how many jobs it ran, how they ended, and their total size and time, with no file names, deleted with the account | Know how the service is used and what it costs to run | Until your account is deleted, which deletes them | legitimate interest in planning and costing the service (art. 6(1)(f)) |
No law requires you to give us data. Without the file a conversion cannot run, and without an email address you cannot open an account unless we gave you a tester link. Everything else is optional. The uploaded file is used for your job. Beyond the job we keep only the fingerprints, daily totals and account counters described above and, if you allowed it on the job page, what is left of a failed job. No model is trained on the file. A file may hold personal data of other people, such as owners or addresses. We process it only to run the job, on the basis of our and the uploader's legitimate interest in converting the file (art. 6(1)(f)).
We keep a nightly copy of the service database for 14 days. Uploaded files and results are not in it. Before it is encrypted we empty what holds sign-in links, sessions, password hashes, messages, reports, unconfirmed news addresses and network addresses. What stays is accounts and their counters, confirmed news addresses, hashes of closed addresses, job records, fingerprints and daily totals, so anything deleted from those can stay in a copy until the copy is deleted. If we restore from a copy, we find and delete again any account deleted after it was made. An account that was waiting to be deleted when the copy was made comes back closed and is deleted at its set time, even if you kept it afterwards. One that was open comes back open, so if you closed your account shortly before a restore, close it again.
3. Who receives the data
- Hosting of the service and the site: a hosting provider in the EU (France).
- The mail we send (every email the service sends, including to an address that was typed but never confirmed, the news signup confirmation, news, and contact-form messages and problem reports on their way to our mailbox, with the name of the uploaded file in the subject of job emails): Resend, Plus Five Five, Inc. (resend.com), United States.
- Mail to our address: Cloudflare, Inc. (cloudflare.com), United States.
- Visit statistics on the site: our own Umami counter on our server in the EU (stats.tryswage.com), no outside company involved. It sets no cookie and stores no IP address.
- A notice that a new chat message has arrived, forwarded to the operator for a quick reply: Telegram FZ-LLC (telegram.org), United Arab Emirates. It holds only that fact and a link to our admin page. No message text, name or address goes to Telegram.
- Sign-in with Google, only if you choose it: Google LLC (google.com), United States. Your browser goes to Google's sign-in page, so Google learns that you are signing in to Swage and with which Google account. Google sends us your email address and whether it has verified it. We send Google the address of our return page, a one-time code and the secret of our application, and nothing about your files, jobs or account.
We run the service from Israel, which the European Commission recognises as protecting personal data adequately. Transfers to Resend, Cloudflare and Google rely on the EU-U.S. Data Privacy Framework and the EU standard contractual clauses. You can ask us for a copy of the safeguards.
4. Cookies
The public site sets no cookies. In the app, a signed-in account holder or a tester gets one sign-in cookie that keeps them signed in. If you pick the app's language yourself, a second cookie, swage_lang, remembers it for a year. It holds only "en" or "ru" and nothing that tells one visitor from another. If you use the chat, your browser also keeps a random identifier in its local storage, so that replies reach you. It holds nothing else. If you sign in with Google, a third cookie ties that one sign-in to your browser. It holds a random value, lasts ten minutes and is of no use afterwards. The app shows a short note for first-time visitors. If you close it while signed in with an email address, we keep on your account when you closed it, until the account is deleted. If you are not signed in that way, for example on a tester link, or if we could not save it to the account, a cookie, swage-intro, remembers it for a year. It holds only "off".
5. Your rights
You may ask for access to your data, its correction or erasure, restriction of processing and a portable copy. You may withdraw any consent at any time without affecting processing done before. Every news email has an unsubscribe link. You can close your account yourself on its account page, as described in section 7 of the terms of use. It is deleted 7 days later, and until then you can keep it. To have it deleted sooner, write to us from its address, or from another address if you can no longer reach it, and we delete it within one month, or at its set time if that comes first, and tell you when it is done. Section 2 says what closing and deletion remove and what they leave. For anything else, write to . You may also lodge a complaint with a data protection supervisory authority.
Right to object to processing. Where we process data for our legitimate interest, you may object to it at any time by writing to us. We then stop, unless we show a compelling reason that outweighs your interests, or need the data to establish or defend a legal claim. A fingerprint holds no job, account or address, so we can match one to you only if you send us the layer name or file it was made from. Daily totals point to no one and cannot be removed.
We close an account for breaking the terms by hand only, and we make no decision about you by automated means alone that has a legal or similarly significant effect on you.
We answer a request about your data within one month of receiving it (GDPR art. 12(3)).
6. Changes to this policy
If a change affects how we use your data, we email account holders and tell testers directly, at least 30 days before it applies. The date of the last change is shown at the top.