Privacy notice — Swapshop

This explains what personal information Swapshop collects, why, who can see it, how long we keep it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Who is responsible

Swapshop is run by Smallism, a one-person, self-funded non-profit, which is the controller of your personal information. Contact: admin@smallism.org.

What we collect

Your account: email address, first name, postcode district (we deliberately keep only the first half of your postcode, like SW9), a securely hashed password, confirmation that you're 18 or over, and when you accepted our terms.
What you post: your bio, listings, photos and testimonials, swap proposals and their history, messages, and reviews. Every photo is re-processed when you upload it, which removes hidden data such as the location where it was taken.
Safety records: reports you make or that are made about your content (including a copy of the reported content), blocks, and any moderation decisions.
Technical: two essential cookies (one keeps you signed in, one protects forms against forgery). We don't use analytics, advertising or tracking cookies, so there's no cookie banner. Our servers briefly process your IP address to keep the site secure and to limit abuse.

Why we use it, and our lawful basis

To provide Swapshop (your account, listings, matching, swaps, messages, emails about your swaps): contract, because you've asked to use the service.
To keep members safe (checking listings and photos, handling reports, blocking, suspending accounts, preventing abuse): legitimate interests in running a safe community.
To understand how swaps value different skills, using a record of completed swaps (what kind of work, roughly how much): legitimate interests. This is used in aggregate to design Swapshop's credits.
To meet legal obligations, if we're ever required to: legal obligation.

We don't sell your information, use it for advertising, or make automated decisions about you with legal or similarly significant effects.

Who can see what

Anyone: your first name, postcode district, bio, approved listings, photos and testimonials, reviews of you, and how many swaps you've completed.
Other members: the above, plus your messages and swaps with them. Your email address is never shown.
Smallism (the person running Swapshop): what's needed to check content and handle reports. We don't read private messages unless one is reported, and then only the reported message and the ten before it.
Service providers acting on our instructions: Hetzner Online (hosting, servers in Finland, EU) and Resend (sending email; servers in the EU, Ireland; a US company, with transfers protected by standard data protection clauses and the UK addendum).

How long we keep it

Your account and what you've posted: until you delete your account, or we close it.
Reports and moderation records: for two years after they're resolved, so we can deal with repeat problems. Reports keep a copy of the reported content but lose the link to your account if you delete it.
The record of completed swaps: kept, but no longer linked to you once you delete your account.
Backups: our databases are backed up nightly and encrypted. Server backups are kept for up to three months, and an encrypted off-site copy for up to six months. Deleted information disappears from backups as they expire.

Your rights

You can ask to access, correct, delete or restrict the use of your information, object to how we use it, or ask for a copy to take elsewhere.

Download your data and delete your account yourself, from your profile.
You can correct most information yourself on your profile and listings.
For anything else, email admin@smallism.org. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.