1. Who we are
swag.ai (“we”, “us”) is run by Ian Huang. We decide what personal data swag.ai uses and why, which in the words of the EU and UK GDPR makes us its controller. The companies in section 5 host and process it for us, only on our instructions and under data processing agreements: Render, for example, runs our servers and database in Frankfurt, Germany, and doesn't use your data for anything of its own.
- Run by
- Ian Huang
- Company
- Not registered yet
- swagai.app@gmail.com
For anything about your data, from a question to a copy of it, a correction or its deletion, write to swagai.app@gmail.com. Write from the address on your account, so we know the request is yours. We answer within one month.
2. What we collect
Your account: the email address and account identifier Clerk gives us when you sign up, your plan and credit balance, when a paid plan began and when one ended, and, if you subscribe, the Stripe customer and subscription identifiers. We don't receive or store card details or passwords.
What you do in the app: pictures you upload, items you save to your wishlists (the product details, the shop's photo of the product that our search found, a crop of the garment, and the country the scan searched as), the shop links you paste to add a wish (the link, the name you give it, and the title and picture the shop's page shows for it), what you add to a wish (a note, a star, how many, and whether you received it as a gift), the names, descriptions and banners you give your lists (a banner is one of the site's own patterns, never a picture you upload), which of your wishes is each list's cover, and whether each is shared with your friends, the prices our nightly checks find for those items and the cheaper listings of the same kind of piece those checks see (Pro), which matches you tap or save, the listing you open each time you press Buy (the product, its shop and price as the scan showed it), and your answer when a card asks whether its best match is the right piece (with what you said was off, or that it was close, which other link you said was the one, anything you wrote in your own words, the piece and listing as the card showed them, and a fingerprint of the picture; pressing your answer again, or Undo, deletes it). On Pro, your recent scans: each piece's name and its first two shop links. If you use the feed: the posts you share, your comments and upvotes, the reports and appeals you send, the accounts you report, your tag (your feed name) and when you last changed it and your name, and any moderation decision about your posts, comments or account. If you use Friends: who you asked and who asked you, when, what came of it, and the items in friends' lists you like. If you block someone: who, and when. For each scan we also record statistics without the picture: the country the search ran as, whether it was a photo or a screenshot, how many garments were found and matched, and how long it took. If you pressed Accept on the cookie notice: which menu items your account presses, counted by day, and nothing about the page, the time or your device (the Cookie Policy says how to change your answer).
What you tell us about yourself. After you create an account we ask your birthday, which you have to give: swag.ai is for people 16 and older, so a date that makes you younger isn't kept and the account can't be used. Your birthday is never shown to anyone, is used only to check your age, and you can change it in Settings. Then three questions, each of which you can skip: your gender (man, woman, other, or prefer not to say), which country you shop from, and your sizes for tops, pants and shoes (a shoe size as a men's or women's US size). Until you choose a country we search as the United States. Closing the questions counts as skipping them. Until 28 October 2026 we also asked how much you typically spend on clothing each month and on a single item, and where you shop; we no longer ask, and answers you gave then stay with your account until you delete it or ask us to remove them. You can change any answer whenever you like in Settings.
Invites: your account has a code for its invite link. When someone makes a new account after opening your link, we keep that their account came through your code, so the 10 credits are given once; you see how many friends joined and the credits that earned, never who, and they don't see who invited them in their account either.
To stop abuse, your IP address is counted against rate limits and then forgotten after about two minutes. A scan on the front page without an account is also counted against a daily limit for your address, as a one-way code made from it rather than the address itself, forgotten after two days.
We also keep a record of what happened to your account: when it was created, when you downloaded or deleted your data, plan changes, changes to email settings, reports, and moderation and admin decisions such as a suspension. It holds identifiers and the action, not your email address or anything you wrote.
3. Your pictures
Location and other metadata are removed from an upload before anything else happens to it. We find the garments in the picture, cut out each one, and search for it. The uploaded picture is deleted within 24 hours.
Pictures and crops are kept in private storage that nobody can browse. Visual search looks at a crop through a link that only works for a short time (an hour at most), and the same kind of link shows you your own pictures. When you save an item to your wishlist, a copy of its crop is kept until you remove the item. Nightly price checks search with the shop's own product photo, not your crop, and as the country the item was found in, even if you have chosen another country since.
On Pro, your recent scans open again whole, with the picture, for the same 24 hours. After that the picture and the full results are deleted as for everyone, and only each piece's name and its first two shop links stay on your list of recent scans.
We keep a short fingerprint of each picture (a perceptual hash) so the same picture scanned again gets its results without being processed again. We don't use facial recognition, identify people, or keep anything derived from faces. Your pictures are never sold or used in advertising.
You can scan a picture on the front page before you have an account. It is handled like every scan: the metadata removed, the picture deleted within 24 hours, the crops kept for up to 24 hours, and it is searched as the United States. You are shown the pieces we found and how many shops sell them; which shops, with the names and prices, are kept with the scan, and the account you create or sign in to in the same browser within those 24 hours can open the whole scan. So that only your browser can, it keeps the scan's id and a random code (see the Cookie Policy). If no account opens the scan, it is deleted with your picture. If the scan can't run without an account (the day's free scans are used, or it didn't go through), the picture you picked stays in that browser tab's memory, not in its storage, and is ready on the scan page if you create an account or sign in with your email in the same tab. It is gone when the tab is closed or reloaded, or when signing in with Google takes you away from the site, and nothing is scanned until you choose to.
Nothing is shown to other people unless you post it or share a list with your friends. When you post to the feed, the garments you tick are shown to everyone signed in to swag.ai: a copy of each garment crop, the matches we found for it, your caption and your feed name (never your email). Your full picture is not posted. Before a post goes up, Google Gemini looks at the picture it comes from for nudity, violence, hate symbols and children, and a post it flags waits, hidden, for one of our moderators; the picture isn't kept for this. Captions, comments and the names of lists you share are checked against a list of slurs, and text with one isn't saved. Comments and upvotes are visible to signed-in users too. Deleting a post deletes its crops and comments. Posts and comments can be hidden after reports from other users while we review them; when something of yours is hidden, we tell you why on the Feed page and by email, and you can ask us to look at it again. The Community Guidelines say what the feed allows.
Friends add each other by feed name, never by email, so nobody can use Friends to find out whether an address has an account. Someone you send a friend request to sees your feed name. Your lists are private until you share one with your friends; then the friends you accepted see the products in it, their prices, its name, description and banner, and your feed name, and never the crops of your pictures. What you add to a list you share also shows in their feed, with the list's name and when you added it. Your friends can like what is in a list you share: you see how many like each item, never who, and each friend sees their own like. You can stop sharing a list, remove a friend or withdraw a request at any time; a like can be taken back. If you decline a request, the person who sent it isn't told, not even in their data download: to them it stays a request that hasn't been answered. The posts of people you are friends with are gathered on the feed's Friends tab; they are the same posts everyone signed in can see.
You can block someone from their post, their comment, their page or your friends page. Then neither of you sees the other's posts, comments or lists, a friendship or request between you ends, and neither of you can ask the other to be friends. The person you block isn't told, not even in their data download; who you blocked is in yours, and in Settings, where you can unblock them. Unblocking brings nothing back: a friendship has to be asked for again. You can also report an account to us from its page; it isn't told who reported it.
4. Why, and on what basis
To provide the service you signed up for: finding matches, keeping your wishlists and, on Pro, your recent scans, checking prices and emailing you about drops (which you can turn off), showing what you post to the feed, your friends and the lists you share with them, and billing. This is necessary to perform our contract with you. When you turn on “Show friends what I open to buy” in Settings, the pieces you open with Buy appear on your friends' feeds, never your picture; it is off unless you turn it on, and turning it off hides what was shared. Your country, your gender and your sizes are used the same way: to pick and label what a scan shows you. Your gender picks the shoe sizes we offer you and leaves out listings a shop marks as the other section; “other” and “prefer not to say” show both. Your country goes with each search to SerpApi, so it finds shops that sell there.
Inspiration, a section Pro accounts see on the scan page, shows the listings that the most people opened with Buy or saved to a wishlist in the last 30 days. They are counted without names, a listing appears only once at least three different accounts chose it, and only the shop's listing is shown, never anyone's picture or who chose it. We rely on our legitimate interest in showing what is popular on swag.ai.
The answers you may have given before 28 October 2026 about what you spend on clothing and where you shop don't change what a scan shows. We use them only as totals across every account, to understand who uses swag.ai, and we never sell them or use them for advertising. We rely on our legitimate interest in knowing our customers, and you can object by writing to us, which removes them.
To keep the service and its people safe: rate limits and spending limits, error reports, the checks on pictures and text before they are posted, reviewing reported posts, comments and accounts and the appeals against our decisions, suspending or banning accounts that break the rules (with what the suspension or ban was for, which the account is told), scan statistics, a record of which matches people tap or save, and how often people tell us a best match was right, which is how we measure whether matching works. We rely on our legitimate interest in running a secure, working service, and, where the EU Digital Services Act requires it, on our legal obligation. You can object by writing to us.
A scan before you have an account is done because you asked for it, to show you what swag.ai finds, and its daily limit is our legitimate interest in a service that isn't abused. Our admins look at one account (its email, plan, how much it used swag.ai as counts, and its answers) only to run, support and moderate the service, for example when you write to us or an account is reported. They don't see what an account scanned, saved or opened. Your answers are otherwise only ever seen as totals across every account.
The record of account events and moderation decisions is kept so that we can show how we handled your data and your content, which the law requires of us.
To improve matching, but only if you turn it on in Settings: when you tap or save a match, we keep a numeric fingerprint of that garment crop (not the picture) with the product you chose, if the scan made one. Scans don't make these fingerprints at the moment, so nothing is kept this way yet. This is based on your consent. It is off unless you turn it on, and turning it off deletes any fingerprints already kept.
To make matches better, when you answer whether a card's best match is right: the next time anyone scans the same picture, its listings are put in order by what was said about them, and a shop that different accounts keep saying no to stops coming first. We recognise the same picture by a short fingerprint, from which the picture can't be rebuilt, and we don't keep a picture or a crop for this. Nobody else using swag.ai can see that an answer was yours. The swag.ai team can see which account gave it, to find where matching goes wrong. We do this because we have a legitimate interest in showing the right piece. You don't have to answer, and your answers go when your account does.
To see which parts of the site people use, but only if you pressed Accept on the cookie notice: which menu items your account presses, counted by day. This is based on your consent; Necessary only, or changing your answer in Settings, stops it at once, and the counts go after 90 days. The tag you go by and the shop links you paste for wishes are part of the service you asked for, like the rest of section 4.
To email you reminders and news, but only if you said yes, at sign-up, in the question after a scan or in Settings. Using swag.ai doesn't depend on it. This is based on your consent (and, in Canada, your express consent), which you can withdraw at any time: in one click from any of those emails, or in Settings, and it stops at once. We send one email at most a week, or a month if you choose that, and we stop after three with no visit from you. To choose which one, we use what is on your account: when you made it, how many times you have scanned, a friend request waiting, your plan, when you bought it or it ended, the credits you have left and when they refill, what you saved, and the last day you used swag.ai, which we only note if you said yes, and only as a day. We don't put tracking pixels in these emails or rewrite their links, so we don't know whether you opened one or what you pressed in it. Their pictures load from swag.ai itself, and a saved piece's photo through our own image proxy, at the same address for everyone, so loading them tells us nothing about you.
We don't make decisions about you by automated means that have legal or similar effects. The automatic check on a post only holds it for a person to look at; a person decides whether it stays down.
5. Who processes it
These companies process data on our behalf, only to provide their part of the service, under data processing terms that bind them to our instructions:
Our servers and database are in the EU. Several of these companies are based in the United States, so some data is processed there. Where your data leaves the EU and EEA, it is protected by the EU-US Data Privacy Framework for companies certified under it, or otherwise by the European Commission's standard contractual clauses, and the UK's equivalents for data from the UK. Write to us for a copy of the safeguards. We don't sell your personal data, share it for advertising, or give it to anyone else, and we disclose it to authorities only where the law requires it.
6. How we keep it safe
- Everything between your browser and swag.ai is encrypted: the swagai.app domain only works over HTTPS, which browsers enforce for it.
- Your data is encrypted where it is stored: our database and its backups at Render, and pictures and crops at Cloudflare R2, with AES-256.
- The database takes no connections from the internet, only from our own servers. Pictures sit in private storage and are only reachable through links that expire.
- We never see your password or card: signing in is handled by Clerk, and payments by Stripe, which is certified to the card industry's highest standard (PCI DSS Level 1).
- Uploads are opened in an isolated process, stripped of their location and metadata, and deleted within 24 hours.
- Only the people who run swag.ai can reach account data, and every admin action on an account is recorded in our audit log.
No service can promise perfect security. If a breach put your data at risk, we would tell you and the authorities as the law requires.
7. Other websites
Product photos in your results are fetched by our server and passed on to your browser, so the shops and Google see our server's address, not yours, when you view results. We don't send them anything about you. When you paste a shop link to add a wish, our server opens that one page once, to read its title and picture; the shop sees our server, not you, and we read nothing else from the page, its price included.
When you tap through to a shop, the shop sees an ordinary visit. Some links may pass through an affiliate network first so that we earn a commission on a purchase; neither the network nor the shop receives your identity or your picture from us. The Cookie Policy covers cookies these sites may set.
8. How long we keep it
9. Your rights
Wherever you live, you can do these yourself in Settings, which opens from your profile picture: download everything we store about your account, change your answers and settings, or delete your account. Deleting it removes your account, wishlists, saved crops, price history, recent scans, match records, posts, comments, upvotes, friends, friend requests, reports and blocks straight away, cancels any subscription, and deletes your sign-in account. Deleting your sign-in account from the profile's Security page does the same. We keep only a one-way hash of your email so that free credits aren't given out twice, anonymous scan statistics, and the record of account events described above.
You can also ask us to tell you what we hold about you and how we use it, to correct it, to restrict or stop a use of it, or to move it to another service, and you can withdraw a consent at any time. Write to swagai.app@gmail.com. We don't charge for this, and using a right never changes the service or the price you get. You must be 16 or older to use swag.ai. It isn't meant for children, and if we learn an account belongs to someone younger, we delete it.
10. Where you live
The EU, the EEA and the UK
The GDPR and the UK GDPR give you the rights in section 9: access, correction, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawing consent. We answer within one month. If you are unhappy with how we handled your data, you can complain to the Danish Data Protection Agency (Datatilsynet), to the data protection authority where you live, or in the UK to the Information Commissioner's Office.
California and other US states
In the last 12 months we have collected these categories of personal information, from you and from your use of swag.ai: identifiers (your email address, account identifier and feed name, and IP address for rate limits), commercial information (your plan and payments, through Stripe), internet activity on swag.ai (scans, saves, Buy taps, posts and friends), the pictures you upload, and the characteristics you choose to give us (gender, sizes, country). We use them only for the purposes in section 4 and disclose them only to the processors in section 5. We don't sell personal information or share it for cross-context behavioural advertising, and we don't use sensitive personal information to infer anything about you, so there is nothing to opt out of.
Under the California Consumer Privacy Act and the privacy laws of other US states, you can ask to know what we collected about you and why, to get a copy, to correct it and to delete it, and you won't be treated differently for asking. Write to swagai.app@gmail.com from your account's address, which is how we confirm the request is yours; someone you authorise can ask for you with your written permission. We answer within 45 days. If we turn down a request, you can ask us to reconsider by replying, and if you still disagree, contact your state's attorney general.
Canada
Under PIPEDA and Quebec's privacy law, you consent to the uses in section 4 by using swag.ai, and you can withdraw that consent, ask to see your information and have it corrected by writing to us. Your information is stored and processed outside Canada, in the EU and the United States, where the authorities may be able to access it under their laws. If you are unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.
Everywhere else
You get the same rights as everyone in section 9, and any further rights the law where you live gives you.
11. The launch waitlist
Before swag.ai opened you could join a waitlist. It closed when swag.ai opened, on 12 October 2026. If you joined, we stored your email address, the sentence you ticked to agree to it, when you ticked it, and which form on the page you used. Nothing else: no name, no IP address, no tracking, and joining did not create an account. The basis is your consent, which you gave by ticking the box. Your IP address only counted against a limit on how often the form can be used, kept apart from your email address and forgotten after two hours.
We use it for one email, sent when scanning opens, and for the free credits that email promises on the account you make with that address. We keep your address until you take it off the list. The link in that email removes it in one click, and you can write to swagai.app@gmail.com instead. Removing it deletes the row: there is nothing left to keep, so unsubscribing and erasure are the same thing here. Deleting your account takes the address off the list too. Until that email is sent, the list is stored in our own database and no third party sees it; sending it goes through Resend, the email provider named above.
12. Changes to this policy
When what swag.ai does with your data changes, this page changes with it, and the date at the top says when. If a change matters to how your data is used, we tell you on the site before it applies.