1. Who we are

Idea Boundary Inc. is an Ontario, Canada corporation and the operator of Sway. We are the "data controller" (under GDPR) and the "organization" responsible for personal information (under PIPEDA and Quebec Law 25) with respect to data processed through Sway. Our Privacy Officer can be reached at privacy@ideaboundary.com.

2. The most important thing: audio stays on your device

Sway's core architectural design is that audio never leaves your device. When Sway listens to your microphone, that audio is processed locally by your Mac. Sway does not:

• Transmit audio recordings to Idea Boundary Inc.
• Store audio recordings on any server.
• Send raw audio to any third-party AI provider.
• Create voiceprints, voice models, or any biometric identifiers from your voice.
• Identify speakers or perform speaker diarization that creates persistent voice profiles.

What does leave your device: text-based prompt context derived from audio, sent to third-party AI providers (Google Gemini, OpenAI) to generate suggestions. This is text, not audio. The AI providers process that text under their own privacy policies.

3. What data we collect and why

Account information

If you create an account or join a waitlist: your name, email address, and any profile information you provide. We use this to authenticate you, operate your account, and communicate about the product.

Legal basis (GDPR): Performance of contract (Art. 6(1)(b)); legitimate interests in operating the Service (Art. 6(1)(f)).

Retention: For the life of your account, plus up to 90 days after deletion request.

App usage and analytics data

We collect anonymized, aggregated data about how Sway is used — such as which features are active, session frequency, and error events. This data does not identify you personally and cannot be linked back to individual users.

We also use Google Analytics 4 (GA4) to understand how visitors use swayon.app. GA4 collects data such as page views, session duration, scroll depth, and button clicks. GA4 uses cookies and may process your IP address. You can opt out of GA4 tracking via browser settings or a GA4 opt-out extension.

Legal basis (GDPR): Legitimate interests in improving the Service (Art. 6(1)(f)). We conduct a balancing test: analytics data is anonymized or pseudonymized; users have reasonable expectation that software providers monitor usage to improve products.

Retention: Anonymized analytics data is retained indefinitely. GA4 data is governed by Google's retention settings (default: 14 months).

Diagnostic logs

The App may generate crash logs and error reports stored locally on your device. If you submit a bug report, those logs may be included. Logs do not contain audio content.

Retention: Local logs are deleted when you remove the App. Submitted logs are retained for 12 months.

AI prompt context (text only — not audio)

When you use Sway's AI features during a session, text-based context derived from your conversation is sent to our AI providers. This may include phrases, questions, or conversational context from your session, expressed as text. It is never raw audio.

This text is processed by AI providers (Google LLC, OpenAI Inc.) under their own privacy policies and data processing agreements. We have entered into data processing agreements with these providers consistent with GDPR Standard Contractual Clauses for transfers of personal data from the EEA/UK.

We do not and will not use your prompt context to train Idea Boundary's own AI models.

Legal basis (GDPR): Performance of contract (Art. 6(1)(b)) — processing is necessary to provide the AI suggestion service you've requested.

Retention: Sway itself does not retain prompt context after your session ends. Retention by AI providers is governed by their terms (typically 30 days for API usage).

Payment information

If paid features are introduced, payment processing will be handled by a third-party payment processor (such as Stripe). Idea Boundary Inc. does not store full payment card details. The payment processor's privacy policy governs payment data.

4. What we do not collect

To be explicit, Idea Boundary Inc. does not:

• Record, store, or transmit audio from your sessions;
• Create voiceprints or biometric identifiers from your voice;
• Access the content of your meetings or conversations (we only process text context you generate via Sway);
• Collect or retain the identities of other participants in your calls;
• Sell your personal information to any third party;
• Use your data to train third-party AI models (our AI providers' API terms prohibit this by default).

5. Third-party AI providers and data flows

Sway relies on the following third-party AI providers. Text context processed by these providers is subject to their privacy policies:

• Google LLC (Gemini API): Privacy Policy · API Terms
• OpenAI Inc.: Privacy Policy · Terms of Use

Both providers have committed, through their API terms, that they do not train their models on API inputs from customers who have not opted in. We have not opted in, and your data is not used to train these providers' models.

6. Cookies and tracking technologies

The Sway desktop application itself does not use cookies. The swayon.app website uses:

• Google Analytics 4 cookies (_ga, _ga_*) — for analytics. Expires: 2 years (_ga), 1 year (_ga_*).
• Session storage — for UTM campaign attribution during your visit. Not persistent.

You can control cookies through your browser settings. Disabling analytics cookies does not affect Sway's functionality.

7. EU, UK, and EEA users — GDPR

If you are located in the European Economic Area, United Kingdom, or Switzerland, additional rights and obligations apply under the General Data Protection Regulation (GDPR) or UK GDPR.

International transfers. Idea Boundary Inc. is based in Canada. Canada has received an adequacy decision from the European Commission (Decision 2002/2/EC, subject to ongoing review). Data transferred to AI providers in the United States is governed by Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914.

Your GDPR rights. You have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate personal data;
• Erasure ("right to be forgotten") of your personal data;
• Restriction of processing in certain circumstances;
• Data portability for data processed by automated means;
• Object to processing based on legitimate interests;
• Lodge a complaint with your local supervisory authority (in Ireland, the DPC; in Germany, the relevant Landesbehörde; etc.).

To exercise any of these rights, email privacy@ideaboundary.com. We will respond within 30 days.

Breach notification. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33-34.

Geographic scope. Sway is currently offered to users in the United States and Canada. If we expand to serve users in the EU/EEA, we will appoint an EU Representative as required under GDPR Article 27 and update this Policy accordingly.

8. California residents — CCPA/CPRA

California residents may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), depending on Idea Boundary Inc.'s revenue and user thresholds. We describe our data practices fully in this Policy regardless of threshold.

Categories of personal information collected: Identifiers (name, email, account ID); internet or network activity (usage logs, page views); commercial information (subscription status, if applicable).

We do not sell or share your personal information with third parties for monetary consideration or for cross-context behavioral advertising.

Your rights (when CCPA applies): Right to know, right to delete, right to correct, right to opt out of sale/sharing, right to non-discrimination. To exercise: privacy@ideaboundary.com. We respond within 45 days.

9. Canadian users — PIPEDA and Quebec Law 25

Idea Boundary Inc. complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for users in Quebec, the Act respecting the protection of personal information in the private sector (Law 25 / formerly Bill 64).

Privacy Officer: Designated per PIPEDA and Quebec Law 25 requirements. Contact: privacy@ideaboundary.com.

Privacy Impact Assessments: We conduct PIAs before implementing new personal information processing activities, in compliance with Quebec Law 25.

Your PIPEDA rights: You have the right to request access to your personal information and to challenge its accuracy. Contact our Privacy Officer to exercise these rights.

Breach reporting: We report privacy breaches that pose a real risk of significant harm to affected individuals and to the Office of the Privacy Commissioner of Canada, as required by PIPEDA.

10. Illinois users — BIPA

Sway does not collect, capture, store, or create biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act (740 ILCS 14/), including voiceprints. All audio processing is local to your device. No biometric data is transmitted to or held by Idea Boundary Inc. See Section 4 of our Terms of Service for our full BIPA disclosure.

11. Children's privacy — COPPA

Sway is not directed at children and is intended for users aged 18 and older. We do not knowingly collect personal information from individuals under the age of 13. If we learn we have collected personal information from a child under 13, we will delete it promptly. Contact us at privacy@ideaboundary.com if you believe we have done so.

12. Data retention

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law.

• Account data: Duration of your account plus 90 days post-deletion request.
• Analytics data: Anonymized data retained indefinitely; GA4 governed by Google's settings.
• AI prompt context: Not retained by Sway after session ends. AI providers retain per their terms (typically 30 days).
• Submitted bug reports/logs: 12 months.

13. Security

We implement industry-standard technical and organizational security measures to protect personal data, including TLS encryption for data in transit and access controls for data at rest. No system is completely secure. In the event of a breach affecting your personal data, we will notify you as required by applicable law.

14. Your choices and rights

• Opt out of emails: Every marketing communication includes an unsubscribe link. Transactional emails related to your account may still be sent.
• Delete your account: Email privacy@ideaboundary.com. We will delete your account data within 30 days.
• Local data: Delete Sway's local data by removing the app and its Application Support folder (~Library/Application Support/Sway).
• Analytics opt-out: Use your browser's cookie controls or a GA4 opt-out browser extension.
• AI prompt context: Disable Sway's AI features entirely in Settings to prevent any text from being sent to AI providers.

15. Changes to this policy

We will update this Policy as our practices evolve. For material changes, we will provide at least 14 days' notice by email or prominent notice on this page before the change takes effect. The latest version is always at swayon.app/privacy.

16. Contact and complaints

For all privacy questions, data requests, or complaints:
privacy@ideaboundary.com

If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Idea Boundary Inc.
Ontario, Canada