Privacy Policy

Effective date: upon publication · Last updated: July 27, 2026

SwapProof ("SwapProof," "we," "us") is operated by Ardeo Labs LLC, a Florida limited liability company. This policy explains what we collect, why, and what your rights are. It covers the SwapProof mobile and web apps, the SwapProof website — including public service-request pages, service-history pages, record PDFs, and service-agreement e-sign pages — and support channels. It applies both to operators (the portable-sanitation businesses who hold SwapProof accounts), to thedrivers and office staff they authorize, and to the customers who interact with an operator's public pages.

The short version: your data is yours. We don't sell it, we don't run ads, and you can export or delete everything at any time. SwapProof has no AI features, so nothing you enter is ever sent to an AI model or used to train one.

1. What we collect

Account information. Email address, name, role (owner, manager, or driver), and organization membership. Authentication credentials are managed by our authentication provider.

Your business content. What you enter to run your route: customers, service sites (addresses, map pins, access notes and gate codes), fleet units and their serials and classes, placements and their rates and cadences, schedules and route days, checklist templates, swap orders and exceptions, disposal logs, invoices, and payments you record.

Your customers' contact details. You may enter — or a customer may submit through your public request page — names, business contact details, site addresses, and notes. You are responsible for having the right to collect and share that information with us; we use it only to provide the service to you andnever for our own marketing. We never contact your customers except when you direct it (an invoice you send, a record link you share).

Service-record media and stamps. Photos your drivers take in the app, each stamped with thedevice time at capture and — only if the device's location permission is granted and a fix returns — the location at that moment of capture. See section 3.

E-signature records. When a customer signs a service agreement, we record the typed signature name, the date and time, a hashed IP address, and browser information, so you have evidence the agreement was signed. The record is immutable once written.

Payment information. Subscription payments are processed by Stripe. We receive your subscription status only — we never receive or store card numbers, card brands, or billing card details of any kind (billing happens on Stripe's own pages). Payments your customers make to you happen entirely outside SwapProof, via your own payment links, and we never see or hold those funds.

Usage and device data. Product analytics events (screens used, features triggered, organization-scoped identifiers), device type, OS version, and approximate region, collected via PostHog. Crash and error diagnostics collected via Sentry. No advertising trackers.

Support communications. Emails you send to our support address, and anything you submit through our contact or waitlist forms.

2. How we use it

• Provide, maintain, and improve the service — including offline route days, sync, and backups.
• Compose proof-of-service records, invoices, history pages, and bid/season packs from the data you entered.
• Geocode a service site's address once, at site creation, to place an initial map pin (see section 4).
• Send transactional email the service requires (invoices you send, account and security notices) and the weekly operator digest, via Resend. Every non-transactional email carries a one-click unsubscribe.
• Send push notifications you enable (service exceptions, request received, invoice cycle ready, route-day reminders) via Expo.
• Measure aggregate product usage, diagnose crashes, prevent fraud and abuse, and comply with law.

There is no AI in SwapProof. Route order is a deterministic suggestion computed from your own data — no model, no third-party inference service, nothing sent anywhere to be analyzed.

We do not sell or rent personal information, and we do not share it with third parties for their own advertising. We disclose data if the law requires it.

3. Location — what we do and don't collect

This one matters in a field app, so it is stated plainly:

• Location is recorded only at the moment a service photo is captured, and only when the device's foreground location permission has been granted and a fix returns.
• There is no background location tracking of any kind. SwapProof does not follow a driver, a truck, or a phone between stops, and no location is collected outside photo capture.
• When location is unavailable or permission is declined, the record says "location unavailable." A location is never fabricated, inferred, or backfilled.
• Location permission is optional. Declining it does not block any part of the driver day.

4. Site pins and addresses

When you create a service site, we send its address to our geocoding provider to drop an initial map pin. A geocoded pin is a convenience, not an authority: it is never auto-confirmed, and once you or your driver confirms the pin on site, it becomes your data and the geocoder is never consulted for that site again. Editing the address flags the pin unconfirmed and says so.

5. Driver accounts

Drivers see only their assigned, published route: today's stops, checklists, site access notes, and the customer phone number for those stops. They see no rates, invoices, or billing anywhere — that restriction is enforced in the database, not just the interface.

Photos, capture timestamps, and capture-moment location recorded during work are part of the operator's service records. The operator is responsible for informing drivers that the app records them and for obtaining any consent their jurisdiction or employment relationship requires (see the Terms, section 2). Drivers may contact [email protected] about their own account data.

6. Public pages you share

Operators share several surfaces that live at unguessable signed links, and anyone holding such a link can view that page until the operator rotates or disables it:

• Service-history pages — a chronological register of stamped service records for a placement: dates, times, unit serials, photo counts, and record links. We record a first-view timestamp.
• Record PDFs — the formal per-visit register: site, unit serials, each check with photo thumbnail and capture time, geotag when present, and the driver's name.
• Service-request pages — your public front door, showing your business details and collecting what a prospective customer submits.
• Service agreements — rates, cadence, and terms blocks, for typed-name e-signature.

Records and history pages produced on the Free plan carry a "Recorded with SwapProof" watermark, applied when the document is composed.

7. If you're a customer of a SwapProof operator

The operator uses SwapProof to run and record your service. They are responsible for the relationship with you; we process your details on their behalf, as their processor, to provide the service to them. To access, correct, or delete information about you, contact the operator — or email us and we'll help route the request.

Quote requests. Contact details submitted through an operator's public request page arequarantined: they are stored where nobody can read them and are revealed to the receiving operator only when that operator explicitly accepts the request. Until then, not even the operator's own staff can see them, and the notification they receive names the request but never the requester.

8. Where your data lives

Data is stored with Supabase (PostgreSQL and file storage) in the United States, encrypted in transit (TLS) and at rest. Access in our systems is enforced by row-level security scoped to your organization and role. Public pages and record PDFs are served from our site infrastructure (Fly.io, US region).

9. How long we keep it

• While your account is active: we keep your content so the service works; export (JSON/CSV) is available anytime, on any plan, including after you cancel a subscription and during the off-season pause.
• If you delete your account: deletion is scheduled with a 7-day grace window— sign back in before it ends and nothing is lost. After the window, your organization's records, photos, documents, and public links are purged from production systems.
• Backups age out on a rolling schedule of no more than 30 additional days.
• A few minimal records we must keep for legal, tax, or security purposes (e.g., invoices we issued you) are retained where the law requires.

10. Service providers (subprocessors)

Each provider processes data only as needed to provide its service to us, under its own contractual data-protection commitments. No AI provider appears on this list, because SwapProof uses none.

11. Your rights and choices

• Access & portability: export everything — customers, units, placements, records, invoices — as JSON or CSV, free, on every plan.
• Correction: edit your content in the app.
• Deletion: delete your account in Settings (see Delete account), or email us from your account address and we'll run the same deletion.
• Notifications: per-type toggles in Settings for push; one-click unsubscribe on the digest and every non-transactional email.
• Location: optional, and declining costs you nothing but the geotag.
• State privacy rights: depending on where you live (e.g., California, Colorado, Virginia, Florida), you may have statutory rights to access, delete, correct, or obtain a copy of your personal information, and to non-discrimination for exercising them. We honor these requests for everyone, resident or not. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.

To exercise any right: [email protected]. We verify requests via your account email and respond within the time required by applicable law (generally 45 days).

12. Children

SwapProof is a business tool for adults; accounts require you to be 18+. It is not directed at children, and we do not knowingly collect their information. If you believe a child has provided us information, contact us and we will delete it.

13. Security

Row-level security on every table, scoped by organization and by role — the driver restriction and the quarantine on request contacts are database rules, not interface choices. TLS everywhere, encryption at rest, scoped credentials, and no card data in our systems. No method of transmission or storage is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

14. Changes

We'll post changes here and update the date above. For material changes, we'll notify account owners in the app or by email before they take effect.

15. Contact

Ardeo Labs LLC
[email protected]