TGDC Swap privacy notice

Your documents are read, analysed and rewritten on your device. None of that requires an account, and none of it involves sending the document anywhere. One thing in the app does send data, and only when you ask for it: handing a swapped document to us, from an explicit screen that shows what leaves the device.

Finding the personal data in a page and replacing it with stand-ins both happen on the device. There is no network call anywhere in that path: no upload for text extraction, no remote model, no server that sees a page of yours in order to give an answer back. Turn the device to airplane mode and the app still does its job, which is the simplest way to verify this claim yourself.

Adding a document, swapping it, saving it and sharing it with whoever you meant to share it with all work while you are signed out. An account exists in the app, but it is attached to the counters, the achievements and the ranking, never to the ability to process a document.

The app asks for camera access when you scan a page and for access to a file or photo when you pick one. Those permissions exist to get a document into the app; the resulting image is processed on the device and is not transmitted. You can decline both and still open PDFs that you hand to the app from elsewhere.

To give the same person the same stand-in in a document you process next month, the app has to remember which real value became which replacement. That table is stored encrypted on the device, with its key held in the iOS keychain. It is never uploaded, to us or to anyone else. You can inspect every entry in the app, delete a single identity, or empty the whole vault. Emptying it means the next document about the same person gets a new stand-in, which is the expected consequence, not a defect.

The app offers a separate action for handing a swapped document to The General Data Company, where it becomes part of the corpora we license. It never runs on its own. You select it, an explicit consent screen shows what is about to be transmitted, and only then does anything leave the device.

What is transmitted is the swapped document and a count of how many values of each type were replaced. The original file and the name vault are not merely excluded by policy: the upload accepts a type that holds neither of them, and a test asserts that this type exposes no original. There is no code path that would carry them, so there is nothing to switch off.

If you create one, we store your email address (in the authentication system), a username you choose, two counters (documents processed and values replaced), the achievements you have unlocked, and the documents you chose to share. Alongside those sits what a database has to keep in order to work: a created and updated timestamp on each row, your ranking setting, the storage location and page count of a document you shared, and a lower-case copy of your username so that two people cannot take names that differ only in capitals. That is the whole of it. No contact list, no device identifiers, no location, no address book, no behavioural profile.

The username is visible to other people on the in-app ranking if you leave that setting on. You can turn it off, and you can pick a username that says nothing about who you are.

Account data and the documents you chose to share are held in our Supabase project. Sign-in emails are delivered by Resend. Those are the only two parties we send your data to, and we send them nothing until you create an account. Nothing on the processing side of the app touches either of them. Apple is involved the way it is for any iOS app (the App Store, and Sign in with Apple if you pick that route), and this website is served by Vercel.

The app contains no analytics, no crash-reporting service, no advertising identifier and no third-party tracking library. Nothing reports how often you open it or what you do inside it. There are no cookies, because there is no web view carrying our content.

Removing the app removes the documents you kept in it and the vault along with it. If you have an account, email us and we delete the profile row, the achievements, the documents you shared and the sign-in record. You do not have to give a reason.

One limit, stated here rather than left in the terms: a document you chose to share may already have been delivered to a customer under a licence, and a delivered copy cannot be called back. We remove it from our own systems on request. That is precisely why sharing is a deliberate decision taken per document, on a screen that shows what leaves the device, and not a setting you switch on once.

You can ask what personal data we hold about you, request a copy, request correction or deletion, or object to processing. Write to hello@thegeneraldata.com and we will respond within a reasonable time. In practice the answer for most people is short, because without an account we hold nothing about you at all.

The General Data Company, San Francisco, USA.
hello@thegeneraldata.com

If the app changes what it does with data, this page changes with it, and the date below moves. The current version always lives at this address.