Privacy Policy — Step Swap

Version: 2.4 · Effective date: 2026-11-02

Step Swap helps people with mismatched shoe sizes find a match and swap shoes. This policy explains what personal data we process and your rights over it.

Data controller: Vitalii Bartashchuk, sole trader (živnostník), registered place of business Za vodou 161/2, 032 03 Liptovský Ján, Slovak Republic, IČO 54225337 (Trade Register of the District Office Liptovský Mikuláš, no. 540-24297). Contact: info@vaet.sk, phone: +421 952 681 072. We have not appointed a Data Protection Officer; for any privacy matter, contact info@vaet.sk.

1. Data we collect

We do not sell your personal data.

Providing your shoe sizes is needed to be matched; your address and phone are needed to ship a swap. Without them you can use the app but cannot complete an exchange.

2. How we use it

• Create your account and authenticate you (Google or Apple sign-in, or a one-time link or code we send to your e-mail address).
• Match you with other members by shoe size (style is a ranking signal).
• Enable chat and the shoe-exchange flow.
• Generate shipping labels for an exchange (address + phone shared with our shipping partner only for the swap you initiate).
• Take payment for the per-swap shipping fee where applicable (card details are entered on Stripe's hosted checkout and never reach our servers; we store only payment status, amount and Stripe identifiers).
• Diagnose crashes (reports are scrubbed of address, phone, names and message text).
• Keep the website secure: automatic security reports from your browser, reduced as described in §10, are forwarded to Sentry so we can find and fix what our security policy blocks.
• Handle support requests, disputes and trust & safety reviews. For this, our trust & safety administrators can look up your account in a read-only view (see §6).
• Understand aggregate usage to improve the app.
• Before sign-in, let you browse the landing page, search by shoe size and see anonymized match counts and examples, and view public delivery-fee rates. Size searches are sent to our servers only to compute previews and are not stored until you sign in; pending sizes may be kept in browser sessionStorage until then. Examples never include names, photos, email, address or phone.
• If you join the size waitlist, e-mail you once when a member with a matching size signs up. We send nothing else to that address — no newsletter, no advertising — and every e-mail has an unsubscribe link.
• If we invite you to the mixed-pair price question, ask whether you would want a mixed pair put together for you and at which service fee, so we can judge demand before we build or offer such a service. Nothing is sold, ordered or charged through it. To choose whom to invite we use data already in your profile: your shoe sizes and which foot you wear, the models you marked as owned or wanted, and our block, fraud (sybil) and linked-account checks, so that we invite only two members whose sizes mirror each other. Your answers are never shown to other members.
• Show a typical swap fee hint from your browser language region — we do not use GPS or precise location.
• We do not use automated decision-making that produces legal or similarly significant effects about you — matching by size is a non-binding suggestion you choose to act on.

3. Legal bases (GDPR)

We rely on different bases for different purposes (Art. 6 GDPR):

• Performance of a contract (Art. 6(1)(b)) — your account, sign-in (Google, Apple or a one-time link or code sent to your e-mail address), matching, chat, the exchange flow, shipping labels and the per-swap fee. Signing in is how we provide the service, so it rests on contract, not consent.
• Consent (Art. 6(1)(a)) — optional crash/error diagnostics, any non-essential analytics or storage (see §10), and the size-waitlist e-mail you sign up for (unsubscribing withdraws it). You can withdraw it at any time.
• Explicit consent for special-category data (Art. 9(2)(a)) — if you wear a shoe on one foot only, we use that fact to match you only after you tick an explicit consent in the app. We invite you to the mixed-pair price question only if you have first agreed, in Profile → Settings, that we may use the difference between your left and right shoe sizes for it; we store your answer (and your sizes with it) only with that consent. You can refuse or withdraw either consent at any time in Profile → Settings: we then stop that use and, for the price question, delete your row including stored sizes.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse and fraud, and debugging; balanced against your rights. This includes the reduced security reports described in §10. It also covers our trust & safety administrators looking up a member's account in a read-only view to handle support requests, disputes and trust & safety reviews, and the log we keep of those look-ups (see §5 and §6). It also covers the mixed-pair price question (§2): our interest in finding out whether members want a mixed pair put together, and at what service fee, before we build or offer that service. Answering is optional, and you can ignore or hide the question. You can object at any time in the app (“Don't ask me again”) or by e-mailing info@vaet.sk, and we will then delete your answers.
• Legal obligation (Art. 6(1)(c)) — retaining payment and shipping records for tax and accounting (see §5).

4. Who we share it with

Processors acting on our instructions: Supabase (auth, database, avatar file storage, hosting), Sightengine (automated scan of optional profile avatar uploads for explicit/offensive content before they are stored; images are sent to Sightengine for analysis and not retained by them beyond the API call per their policy), Google (sign-in), Apple (Sign in with Apple (OAuth). If you use Hide My Email, Apple operates the private relay that forwards our email to your real address, so Apple sees that we emailed you. See Apple's privacy policy), Sentry (PII-scrubbed error/crash diagnostics; on the web build only, masked session replays are recorded for sessions that hit an error — all text, inputs and media are masked; the installed app does not record session replays; on the web, also reduced security-policy reports that need no consent (see §10)), the parcel carrier serving your route (currently Packeta/Zásielkovňa for Slovakia/CEE; Sendcloud with its carrier, e.g. Österreichische Post, for Austria/Western Europe; Packlink for parcels sent from Germany, Posti from Finland, Hrvatska pošta from Croatia, and Econt from Bulgaria) (recipient name, address, phone, and for home delivery email — to produce the label and deliver the parcel), Resend (e-mail delivery: sign-in links and codes, swap notifications, size-waitlist match e-mails, withdrawal confirmations, and operational alerts to our own team; Resend processes the recipient's e-mail address and the content of each message, and stores the messages and delivery logs in the United States), and Vercel (web hosting and privacy-friendly analytics).

Independent controllers. Stripe processes the per-swap shipping fee and handles your card data as its own controller, under its own privacy policy — we never see your card number and receive only payment status, amount and transaction identifiers. For that payment, Stripe — not Step Swap — decides how your card data is used.

Other members see only your display name, avatar, sizes and styles. Your postal address and phone number are not shown to other members — they are used only to generate the shipping label and shared with the carrier to deliver the parcel.

5. Data retention

• Apple sign-in revocation token — if you signed in with Apple, we store the token Apple issues for your session solely so that, when you delete your account, we can tell Apple to revoke Step Swap's access to your Apple account (Apple requires this of apps offering Sign in with Apple). It is never used to read anything from Apple, is not readable by other members or by the app itself, and is deleted together with your account.
• Profile and general account data — your profile (name, avatar, shoe sizes, style), contact details and push tokens, and any chat that was not part of a swap that reached the payment or shipping-label stage — kept while your account is active and removed promptly when you delete your account (see §7), apart from the limited identity link we keep with the records below.
• Payment, shipping and exchange records — we must keep invoicing and transaction records under Slovak tax and accounting law, generally for up to 10 years, even after you delete your account. Because such a record has to identify who it relates to — so a payment can be tied to the person who made it, for accounting, chargebacks and fraud — we keep them with a restricted link to your identity for that period; access is limited to those purposes. Legal bases: legal obligation (Art. 6(1)(c)) and our legitimate interest in a secure, fraud-free service (Art. 6(1)(f)).
• Chat for paid/shipped swaps — for a swap that reached the payment or shipping stage we also keep the chat messages exchanged for it, with the restricted identity link, for up to 3 years (the general limitation period under Slovak law) after account deletion — and longer only while a specific dispute, legal claim or authority request is open — then deleted. Held under restricted access and used only to handle reports, disputes, fraud and legal claims. Legal basis: our legitimate interest in a safe, fraud-free service and in the establishment, exercise or defence of legal claims (Art. 6(1)(f) GDPR). Art. 17(3)(e) GDPR is not a legal basis for processing; it is the exception that lets us keep this data despite an erasure request, for those same claims.
• Support-message audit — when a member of our support team sends a message into a chat to help resolve an issue, we keep a record of which staff member did so and when — an accountability log for support actions (it adds no new personal data about you beyond the chat itself). This record is kept for up to 3 years, is not readable by members, and — because it logs a staff action — is retained even if that staff member later leaves. Legal basis: our legitimate interest in an accountable, abuse-resistant service (Art. 6(1)(f) GDPR).
• Staff access log — when one of our trust & safety administrators searches for members or opens a member's account (see §6), we log which administrator did it, when, which account, which part of it they viewed, the reason they recorded and the search terms they used. The log is kept for up to 3 years, is not readable by members, and is kept even if that administrator later leaves. If you ask for a copy of your data (Art. 15 GDPR), we include the log entries about your account. Legal basis: our legitimate interest in an accountable service that can show who looked at member data and why (Art. 6(1)(f) GDPR).
• Diagnostics — error reports are kept for a limited period (typically up to 90 days) and contain no address, phone, names or message text.
• Size waitlist — deleted within a day after you unsubscribe, 30 days after a match was found and e-mailed to you, and at the latest 12 months after you joined.
• Special-category consent records — we keep a record of the Art. 9(2)(a) consents you give (kind, wording version, when given or withdrawn) while your account is active, and delete them with the account. Withdrawing one-foot consent resets that setting to both feet (your filled size stays). Withdrawing or refusing the size-difference consent deletes your mixed-pair price-question row, including stored sizes.
• Mixed-pair price question — your answers, together with the model, the sizes and the fees you were shown, are deleted 12 months after the question closed (it closes 14 days after we sent it), whether you answered or not, or earlier if you delete your account. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR, see §3) for selecting invitees; Art. 9(2)(a) for storing an answer.
• Abuse-prevention counters — to limit spam and abuse, we count how often certain actions (for example messages, reports, searches or waitlist sign-ups) are performed within a short time window, and refuse further attempts once a limit is reached. A counter holds the action, the count and when the window started, together with your account ID — or, if you are not signed in, a hash of your IP address instead of the address itself (for the online withdrawal form: your account ID or the e-mail address you entered). Each counter is deleted automatically at the latest 3 days after its window started. Legal basis: our legitimate interest in a secure, abuse-free service (Art. 6(1)(f) GDPR).

6. Security

Data is encrypted in transit and at rest. Database access uses row-level security so a member can read only their own data and that of people they share a chat with, and access to our systems is limited to what is needed to run the service. If a personal-data breach is likely to risk your rights, we will notify you and the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR) as required by the GDPR.

Staff access to member accounts is limited to our trust & safety administrators. To open a member's account, an administrator must sign in with a second factor (a code from an authenticator app) and record a reason. The view is read-only: it does not let them sign in as you, act on your behalf or change your data. It shows your profile (including your address, phone number and e-mail address), when you signed up and last signed in, your shoe sizes, the spare shoes you listed, the shoes you marked in the catalog (such as your wishlist), your swaps and their status, and a list of your chats without the message contents. Every search and every view is logged (see §5), and each administrator can make only a limited number of look-ups per hour.

For the mixed-pair price question, an administrator who has signed in with a second factor can also see the answers each invited member gave, listed by member ID with the sizes and fees that member was shown, without names or contact details. That list is not part of the account view, so it is not recorded in the staff access log.

7. Your rights & account deletion

You can access and correct your data in the app, and delete your account at any time — we delete your associated data promptly, apart from the limited records we must or may keep as described in §5 (tax/accounting records, and records needed for safety, fraud prevention or legal claims): in the app via Profile → Settings → Delete account. The same Settings page lets you withdraw the consents in §3 and object to the mixed-pair price question (“Don't ask me again”). Or by request — see account deletion. Depending on your location you may also have rights to portability, objection/restriction, to withdraw consent, and to lodge a complaint with your data protection authority. Our lead supervisory authority under the GDPR one-stop-shop mechanism is the Slovak Úrad na ochranu osobných údajov SR (dataprotection.gov.sk). If you live elsewhere in the EU or EEA, you may complain to your own national authority — the European Data Protection Board keeps a directory of all of them (edpb.europa.eu).

8. International transfers

Some providers above (e.g. Google, Stripe, Sentry, Vercel, Resend) may process data outside the EEA, including in the United States. Resend stores the e-mails it delivers for us, and their delivery logs, in the United States. Such transfers rely on appropriate safeguards — EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the provider is certified. You can request details by emailing info@vaet.sk.

9. Children

Step Swap is not directed to children under 18 and we do not knowingly collect their data.

10. Cookies and local storage

We keep cookies and local storage to a minimum:

• Strictly necessary — Supabase sets storage/cookies to keep you signed in and to secure the app. These are required for the service to work and do not need consent.
• Security reports (strictly necessary) — on the website, when your browser finds content that our security policy does not allow, it sends an automatic report to our server. We keep only the rule that was triggered, the origin of the blocked content (for example https://example.com, without the rest of the address) and the path of our page without its query or fragment. We discard your IP address, browser details, cookies and the referring page, and forward that reduced record to Sentry so we can fix the site; Sentry keeps it for the same limited period as error reports (§5). Nothing is stored on or read from your device, so no consent is needed.
• Guest browse (convenience) — if you search sizes before sign-in, pending sizes may be kept in browser sessionStorage until you sign in or close the tab; language preference may be stored in localStorage. No account is created until you sign in with Google, Apple or a one-time link or code we send to your e-mail address.
• Price-question card (convenience) — if you hide the mixed-pair price question, the app remembers that on your device in localStorage (stepswap-price-question-dismissed, the IDs of the questions you hid) and sends nothing to us. It only keeps the card hidden, so it does not need consent.
• Diagnostics & analytics (consent) — crash/error reporting (Sentry) and product analytics (Vercel Analytics) are used only with your consent, in line with the Slovak Electronic Communications Act (Act No. 452/2021 Coll.). Where required we ask before any non-essential storage is set, and you can change or withdraw your choice at any time: under “Usage analytics & diagnostics” in the footer of the start page, or in Profile → Settings when you are signed in. We do not use advertising or cross-site tracking cookies.

11. Changes

We may update this policy. The current version number and effective date appear at the top, and we keep prior versions available on request. We will announce material changes in the app or on our website before they take effect. Continued use after the effective date means you accept the updated policy.

12. Contact

Questions or requests: info@vaet.sk.