Privacy Policy

1. Who we are

Idea Boundary Inc. is an Ontario, Canada corporation and the operator of Sway. We are the "data controller" (under GDPR) and the "organization" responsible for personal information (under PIPEDA and Quebec Law 25) with respect to data processed through Sway. Our Privacy Officer can be reached at privacy@swayon.app.

2. The most important thing: audio stays on your device

Sway's core architectural design is that audio never leaves your device. When Sway listens to your microphone, that audio is processed locally by your Mac. Sway does not:

• Transmit audio recordings to Idea Boundary Inc.
• Store audio recordings on any server.
• Send raw audio to any third-party AI provider.
• Create voiceprints, voice models, or any biometric identifiers from your voice.
• Identify speakers or perform speaker diarization that creates persistent voice profiles.

What does leave your device: text-based prompt context derived from audio, sent to third-party AI providers (Google Gemini, OpenAI) to generate suggestions. This is text, not audio. The AI providers process that text under their own privacy policies.

3. What data we collect and why

Account information

If you create an account or join a waitlist: your name, email address, and any profile information you provide. We use this to authenticate you, operate your account, and communicate about the product.

Legal basis (GDPR): Performance of contract (Art. 6(1)(b)); legitimate interests in operating the Service (Art. 6(1)(f)).

Retention: For the life of your account, plus up to 90 days after deletion request.

App usage and analytics data

We collect anonymized, aggregated data about how Sway is used — such as which features are active and session frequency — using PostHog as our product-analytics provider. When you are signed in, these events are linked to your account (account ID and email) so we can understand how the App is used and help with support; when you are signed out they use a random ID. We do not use this data for advertising.

We also use Google Analytics 4 (GA4) to understand how visitors use swayon.app. GA4 collects data such as page views, session duration, scroll depth, and button clicks. GA4 uses cookies and may process your IP address. You can opt out of GA4 tracking via browser settings or a GA4 opt-out extension.

Legal basis (GDPR): Legitimate interests in improving the Service (Art. 6(1)(f)). We conduct a balancing test: analytics data is pseudonymized and never used for advertising; users have reasonable expectation that software providers monitor usage to improve products.

Retention: Product analytics data is retained until you ask us to delete it (for example, by deleting your account). GA4 data is governed by Google's retention settings (default: 14 months).

Diagnostic logs, error reports and crash reports

The App keeps a diagnostic log on your device. When something goes wrong, it also sends us an error report automatically so we can find and fix the problem. An error report contains the error message and technical trace, the part of the App involved, the App version, your macOS version and processor type, and your account ID if you are signed in (otherwise a random ID for your installation). Before an error report leaves your device, the App removes email addresses, sign-in tokens and API keys from it and shortens long messages. Error reports are designed to exclude audio, screenshots, and the content of your meetings or dictation, and they never contain audio.

Error reports are processed by Google Cloud (Cloud Logging and Error Reporting), and crash reports by Sentry, as our service providers.

Feedback and bug reports you send us

When you send feedback from inside the App, we receive your message, the feedback type, where in the App you opened the form, your account ID and email if you are signed in (or the email you choose to enter, and a random ID for your installation, if you are not), and the App version.

Unless you untick "Include diagnostics", the report also includes a technical snapshot: your macOS version and processor type, language and time zone, which permissions the App has, window size and visibility settings, which AI model is selected, how long the App has been open, the App's recent warnings and errors (with emails, sign-in tokens and API keys removed), and the names of the last few actions you took in the App (for example "settings opened"). The snapshot does not include your chat, transcripts, screenshots, audio or anything you typed.

Two attachments are off unless you tick them: a screenshot of Sway's own window (never other apps, but it shows whatever is on Sway's screen at that moment, including chat) and the App's local diagnostic log (with emails, tokens and keys removed; it can contain short snippets of App activity).

We use your report to understand and fix the problem and to reply to you. To route reports faster, the message and diagnostics are categorized automatically by our AI provider (Google Gemini); this is not used to train models. Reports are stored with Google Cloud (Firestore, Cloud Storage and Google Sheets) and we are notified through Telegram. If an email address is available, we send you a confirmation and may follow up about your report.

Legal basis (GDPR): Legitimate interests in supporting you and fixing the Service (Art. 6(1)(f)), and your choice to send the report and any attachments.

Legal basis (GDPR): Legitimate interests in keeping the Service working and secure (Art. 6(1)(f)).

Retention: Error and crash reports are kept for up to 90 days. The local diagnostic log is capped in size, overwritten over time, and deleted when you remove the App. Submitted feedback and bug reports, including any screenshot or log you attached, are deleted automatically after 12 months.

AI prompt context (text only — not audio)

When you use Sway's AI features during a session, text-based context derived from your conversation is sent to our AI providers. This may include phrases, questions, or conversational context from your session, expressed as text. It is never raw audio.

This text is processed by AI providers (Google LLC, OpenAI Inc.) under their own privacy policies and data processing agreements. We have entered into data processing agreements with these providers consistent with GDPR Standard Contractual Clauses for transfers of personal data from the EEA/UK.

We do not and will not use your prompt context to train Idea Boundary's own AI models.

Legal basis (GDPR): Performance of contract (Art. 6(1)(b)) — processing is necessary to provide the AI suggestion service you've requested.

Retention: Sway itself does not retain prompt context after your session ends. Retention by AI providers is governed by their terms (typically 30 days for API usage).

Payment information

If paid features are introduced, payment processing will be handled by a third-party payment processor (such as Stripe). Idea Boundary Inc. does not store full payment card details. The payment processor's privacy policy governs payment data.

4. What we do not collect

To be explicit, Idea Boundary Inc. does not:

• Record, store, or transmit audio from your sessions;
• Create voiceprints or biometric identifiers from your voice;
• Access the content of your meetings or conversations (we only process text context you generate via Sway);
• Collect or retain the identities of other participants in your calls;
• Sell your personal information to any third party;
• Use your data to train third-party AI models (our AI providers' API terms prohibit this by default).

5. Third-party AI providers and data flows

Sway relies on the following third-party AI providers. Text context processed by these providers is subject to their privacy policies:

• Google LLC (Gemini API): Privacy Policy · API Terms
• OpenAI Inc.: Privacy Policy · Terms of Use

Both providers have committed, through their API terms, that they do not train their models on API inputs from customers who have not opted in. We have not opted in, and your data is not used to train these providers' models.

6. Cookies and tracking technologies

The Sway desktop application itself does not use cookies. The swayon.app website uses:

• Google Analytics 4 cookies (_ga, _ga_*) — for analytics. Expires: 2 years (_ga), 1 year (_ga_*).
• Session storage — for UTM campaign attribution during your visit. Not persistent.

You can control cookies through your browser settings. Disabling analytics cookies does not affect Sway's functionality.

7. EU, UK, and EEA users — GDPR

If you are located in the European Economic Area, United Kingdom, or Switzerland, additional rights and obligations apply under the General Data Protection Regulation (GDPR) or UK GDPR.

International transfers. Idea Boundary Inc. is based in Canada. Canada has received an adequacy decision from the European Commission (Decision 2002/2/EC, subject to ongoing review). Data transferred to AI providers in the United States is governed by Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914.

Your GDPR rights. You have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate personal data;
• Erasure ("right to be forgotten") of your personal data;
• Restriction of processing in certain circumstances;
• Data portability for data processed by automated means;
• Object to processing based on legitimate interests;
• Lodge a complaint with your local supervisory authority (in Ireland, the DPC; in Germany, the relevant Landesbehörde; etc.).

To exercise any of these rights, email privacy@swayon.app. We will respond within 30 days.

Breach notification. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33-34.

Geographic scope. Sway is currently offered to users in the United States and Canada. If we expand to serve users in the EU/EEA, we will appoint an EU Representative as required under GDPR Article 27 and update this Policy accordingly.

8. California residents — CCPA/CPRA

California residents may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), depending on Idea Boundary Inc.'s revenue and user thresholds. We describe our data practices fully in this Policy regardless of threshold.

Categories of personal information collected: Identifiers (name, email, account ID); internet or network activity (usage logs, page views); commercial information (subscription status, if applicable).

We do not sell or share your personal information with third parties for monetary consideration or for cross-context behavioral advertising.

Your rights (when CCPA applies): Right to know, right to delete, right to correct, right to opt out of sale/sharing, right to non-discrimination. To exercise: privacy@swayon.app. We respond within 45 days.

9. Canadian users — PIPEDA and Quebec Law 25

Idea Boundary Inc. complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for users in Quebec, the Act respecting the protection of personal information in the private sector (Law 25 / formerly Bill 64).

Privacy Officer: Designated per PIPEDA and Quebec Law 25 requirements. Contact: privacy@swayon.app.

Privacy Impact Assessments: We conduct PIAs before implementing new personal information processing activities, in compliance with Quebec Law 25.

Your PIPEDA rights: You have the right to request access to your personal information and to challenge its accuracy. Contact our Privacy Officer to exercise these rights.

Breach reporting: We report privacy breaches that pose a real risk of significant harm to affected individuals and to the Office of the Privacy Commissioner of Canada, as required by PIPEDA.

10. Illinois users — BIPA

Sway does not collect, capture, store, or create biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act (740 ILCS 14/), including voiceprints. All audio processing is local to your device. No biometric data is transmitted to or held by Idea Boundary Inc. See Section 4 of our Terms of Service for our full BIPA disclosure.

11. Children's privacy — COPPA

Sway is not directed at children and is intended for users aged 18 and older. We do not knowingly collect personal information from individuals under the age of 13. If we learn we have collected personal information from a child under 13, we will delete it promptly. Contact us at privacy@swayon.app if you believe we have done so.

12. Data retention

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law.

• Account data: Duration of your account plus 90 days post-deletion request.
• Analytics data: Product analytics retained until you ask us to delete it; GA4 governed by Google's settings.
• AI prompt context: Not retained by Sway after session ends. AI providers retain per their terms (typically 30 days).
• Error and crash reports: Up to 90 days.
• Submitted bug reports/logs: 12 months.

13. Security

We implement industry-standard technical and organizational security measures to protect personal data, including TLS encryption for data in transit and access controls for data at rest. No system is completely secure. In the event of a breach affecting your personal data, we will notify you as required by applicable law.

14. Your choices and rights

• Opt out of emails: Every marketing communication includes an unsubscribe link. Transactional emails related to your account may still be sent.
• Delete your account: Email privacy@swayon.app. We will delete your account data within 30 days.
• Local data: Delete Sway's local data by removing the app and its Application Support folder (~Library/Application Support/Sway).
• Analytics opt-out: Use your browser's cookie controls or a GA4 opt-out browser extension.
• AI prompt context: Disable Sway's AI features entirely in Settings to prevent any text from being sent to AI providers.

15. Changes to this policy

We will update this Policy as our practices evolve. For material changes, we will provide at least 14 days' notice by email or prominent notice on this page before the change takes effect. The latest version is always at swayon.app/privacy.

16. Contact and complaints

For all privacy questions, data requests, or complaints:
privacy@swayon.app

If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Idea Boundary Inc.
Ontario, Canada