Privacy policy

What Swolski collects

Today, an account holds: your email address; your password, in a form that cannot be read back; the time you confirmed that you are 18 or older; the version of the terms you accepted and when; the consents you gave or withdrew and when; your sign-in sessions; and records of the requests you make about your data (a deletion request, an export, a password reset), by their times. When you write to the contact address, the mailbox keeps what you wrote.

If you sign in with Google, Swolski receives your Google account's email address and Google's identifier for you. It keeps the address and a scrambled form of the identifier, which it uses to recognise your sign-in. It does not receive your Google password, your name or your contacts.

When paid plans open: if you buy a plan, the account also holds the record of your plan and its payments: the plan, its status and its dates, the amounts, and Stripe's references for them. Your card never reaches Swolski: you enter it on Stripe's own page.

To limit abuse of the sign-up, sign-in and password forms, Swolski also counts requests under a keyed hash of the network address they come from and of the address typed into the form. Those counts are kept for up to two days, cannot be turned back into an address without a key that lives only on the server, and are left out of backups. When Cloudflare, which carries the site, serves a challenge page, it sets cookies of its own for that purpose. The sign-up form reads the country Cloudflare reports for your network address and takes sign-ups only from the United States; the country is not kept.

The public pages (the home page, pricing, safety, the terms, the policies, refunds and the sign-up pages) count visits with Plausible, analytics software that Manic Agency LLC runs on its own server, rented from Akamai in the United States. When you open one of them while signed out, your browser sends Plausible the page's address (without its query string, except campaign tags), the site you came from and your browser's description, and your network address reaches it with the request. Plausible keeps the page, the site you came from, how long the page was open and how far down it was scrolled, the country of your network address, and the kind of browser, system and device. It keeps neither your network address nor your browser's description, sets no cookie, and recognises a visitor only within one day, by a scrambled value made from the site's name, your network address, your browser's description and a key it deletes every 24 hours. If your browser sends a Global Privacy Control or "do not track" signal, the pages send nothing. Pages you see signed in, and pages that ask for or show health data, count nothing.

As further parts of Swolski open, each asks for the data it needs before collecting it, one kind at a time, as the consumer health data privacy policy describes.

What it is used for

To run your account and sign you in; to send you the mails the service needs (a confirmation link, a password reset, the written answer to a deletion request, a notice of a change to the terms or to this policy); to answer your requests; to keep the forms from being abused; and to count visits to the public pages, as above. Swolski sends no marketing mail.

Who receives it

The companies that carry and host the service and the mail it sends. Each is named here with what it receives and how to reach its privacy contact:

• Resend (Plus Five Five, Inc.), which delivers the mail this product sends you. It receives your email address and the messages sent to it. Its privacy contact is privacy@resend.com.
• Cloudflare, which carries the connection between you and our server, and stores our encrypted backups. It receives everything you send to and receive from the product, on its way, and the backups, which it cannot read. Its privacy contact is privacyquestions@cloudflare.com.
• Akamai Cloud (formerly Linode), which runs the server the product and its database are on. It receives everything the product stores, on the disk of the server it runs. Its privacy contact is https://www.akamai.com/legal/dpr.
• Google Workspace (Google LLC), which hosts the mailbox behind our contact address. It receives the messages you send to our contact address, and our replies. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• Google sign-in (Google LLC), which signs you in with your Google account, if you choose that. It receives that you signed in to this product with your Google account, and when. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• When paid plans open: Stripe (Stripe, Inc.), which takes your payment when you buy a plan. It receives your email address, the amount, a reference to your account that is not your name, and, on its own page, your billing address and card details; with each payment's record Stripe shows us the billing name and address and the card's brand and last digits, which we read and do not keep; the card's number never reaches us. Its privacy contact is privacy@stripe.com.

No company receives what you send us for its own purposes. Cloudflare keeps its own record of the traffic it carries, such as your IP address, under its own privacy policy. AI providers: none receives anything today; each will be named here before it does.

Your health data

Health data, such as screening answers, training logs and clips, is covered by the consumer health data privacy policy, which says what is collected and why, with whom it is shared, and how you use your rights. Nothing of it is collected before you agree.

What Swolski does not do

Swolski does not sell personal information and does not share it for advertising. It shows no advertising. No advertising, analytics or tracking company collects data about you across sites when you use Swolski: the visit counting above runs on Manic Agency LLC's own server and recognises no one across sites or across days. If your browser sends a Global Privacy Control or "do not track" signal, the public pages leave out the visit counting.

Swolski is not for anyone under 18 and does not knowingly collect information from anyone under 18.

Your choices and your rights

In your account you can see and download everything in it, change your password, withdraw a consent, and delete your account. To correct your email address, or for anything you cannot do in your account, write to team@manic.agency from the address of your account. Swolski answers within 45 days, or tells you why inside them and finishes within 45 more; a deletion is carried out within 30 days, usually within minutes, and is never extended. If you disagree with how a request was handled, write again and say so: Swolski reviews it and answers in writing, with its reasons, within 45 days, and tells you how to reach the Attorney General of your state if it did not do what you asked.

Nevada residents

Nevada law lets you direct a website operator not to sell your covered information. Swolski sells none, and will not. You can still send that direction to team@manic.agency, the address designated for such requests, and Swolski confirms it within 45 days.

How long it is kept

Your account, for as long as you keep it. A sign-up that is never confirmed, for 7 days after its confirmation link expires (a link works for 24 hours). Ended sessions, 30 days. Request counts, up to two days, and never in backups. Backups, 180 days: the consumer health data privacy policy says what a restore from a backup does. The records that show a deletion or another request was answered in time are kept without the wording of the request. When your account is deleted, our correspondence with you is deleted from the mailbox within the same 30 days.

Security

Passwords are stored as hashes that cannot be read back. Connections are encrypted. Backups can be read only with a key that is not on the server. Access to the server is by key only.

Changes to this policy

Swolski emails account holders about a material change at least 30 days before it takes effect, and the effective date at the top changes. The lines marked "When paid plans open" take effect on a day that will be mailed to account holders at least 30 days ahead.

Contact

Manic Agency LLC, 2831 St Rose Parkway, Suite 200, Henderson, NV 89052, United States. team@manic.agency