Legal

Privacy policy

Last updated 19 August 2026. Swell is in early access, and this policy will change as the product does.

This policy explains what Swell collects, why, who else touches it, and what you can do about it. Swell is a personal dashboard, so most of what it holds is data you typed in yourself — including data about your health, which the law treats with extra care. That is covered in detail below.

Who we are

Swell is the data controller for the personal data described here — we decide what is collected and why.

  • Legal entity name: TODO — legal review
  • Registered address: TODO — legal review
  • Contact: hello@swellapp.co.uk

There is no separate data protection officer. Email the address above for anything in this policy, including any request about your rights.

Your entries are sent to an AI provider

This is the least obvious thing Swell does, so it goes first.

When Swell generates a plan for you, the log data for that area leaves the app and is sent to Anthropic's API for processing. Plans are generated one area at a time, so a plan draws on the data for the area it is for, not on everything you have logged. Across the different areas, that can include health data — what you ate, how you slept, your workouts, your weight — as well as money and mind data.

Some plans are generated automatically and some only when you ask for them, so this transfer can happen without a specific action from you at the time. That is why we ask for your explicit consent to it up front, when you create your account, rather than at the moment each plan is written.

Anthropic processes this on our instructions as a processor, and Anthropic is based in the United States, so this involves a transfer outside the UK. See International transfers. Anthropic does not use data submitted through its API to train its models.

Because some plans generate on their own, simply not opening the plan features is not a reliable way to prevent this transfer. If you would rather your data was not sent to an AI provider at all, email hello@swellapp.co.uk — we will tell you what has already been sent and stop further plans being generated for your account. Deleting the data for an area, or deleting your account, also prevents it. Whether a per-area switch exists in the app: TODO — confirm against the current build.

What we collect, why, and our lawful basis

UK GDPR requires a lawful basis for everything we process. Some of what Swell holds is special category data under Article 9, which needs a second, higher condition on top of the Article 6 basis. We keep the two apart below rather than blurring them.

How we ask for consent

Where we rely on consent — and for health and mind data, on explicit consent — we ask for it when you create your account, before any of that data is collected or sent anywhere.

The signup flow sets out what each category covers and what happens to it, including that your logs are sent to Anthropic to generate plans. Nothing is pre-ticked, and agreeing is a positive action you take rather than something we infer from your continuing to use the app. You can change your mind afterwards at any time — see Withdrawing consent.

Account data — ordinary personal data

Your email address, and the authentication data needed to keep your account secure.

  • Why: to create your account, sign you in, and send you essential service email.
  • Lawful basis: Article 6(1)(b) UK GDPR — necessary to perform our contract with you. You cannot use Swell without an account.

Health data — special category data

Sleep, weight, diet (including calories and nutrients where you record them), and workouts.

  • Why: this is the core of the product. It is shown back to you as your own numbers and trends, and used to generate plans for that area.
  • Lawful basis (Article 6): Article 6(1)(a) — your consent.
  • Special category condition (Article 9): Article 9(2)(a) — your explicit consent. Data concerning health is special category data, and explicit consent is the condition we rely on. We do not rely on any other Article 9 condition.

This means health tracking in Swell is optional in the strict legal sense: it runs on your consent, and you can withdraw that consent at any time without losing your account. See Withdrawing consent.

Mind data — treated as special category data

Meditation and self-improvement logs.

  • Why: the same as health data — shown back to you, and used in plans for that area.
  • Lawful basis and condition: Article 6(1)(a) consent, and Article 9(2)(a) explicit consent.

Records of meditation and personal development can reveal something about a person's mental health, so we have chosen to treat this category with the same protection as health data rather than the lower standard. TODO — legal review to confirm this classification is the right one.

Money data — ordinary personal data

Spending and income figures you record.

  • Why: to show you what you spent and saved, and to generate plans for your money areas.
  • Lawful basis: Article 6(1)(a) — your consent. This is not special category data, and we do not treat it as such.

Swell has no connection to your bank. Nothing here is imported from a financial institution — these are figures you type in.

Employment status and occupation — ordinary personal data

Not yet collected. Shortly, Swell will ask for employment status and occupation as tap-select categories.

  • Why: to give career and money figures useful context.
  • Lawful basis: Article 6(1)(a) — your consent.
  • These are ordinary personal data, not special category data. Occupation on its own does not reveal health, beliefs, trade union membership or anything else under Article 9, and we do not claim otherwise.

Who else touches your data

Swell runs on a small number of third-party providers. Each acts as our processor, handles data only on our instructions, and receives only what it needs.

  • Supabase — database and authentication. Holds your account and everything you log: health, mind and money data. This is where your data lives at rest.
  • Anthropic — AI processing. Receives the log data relevant to a plan when a plan is generated, as described above. United States.
  • Vercel — hosting for the website and app. Handles requests in transit, and processes technical data such as IP address in server logs as a normal part of serving the site.
  • Resend — transactional email. Receives your email address in order to send account email such as sign-in and password reset. Not used for marketing.

We do not sell your data, share it with advertisers, or use it to build profiles for anyone other than you.

International transfers

Anthropic is based in the United States, so generating a plan transfers your data outside the UK. Our other providers may also process or store data outside the UK depending on their region configuration.

The transfer mechanism relied on for these transfers — UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer risk assessment — is TODO — legal review. We are not asserting a mechanism here until that review is done.

How long we keep it

  • While your account is active: we keep what you log for as long as you have an account, because the point of the product is the record building up over time. We do not silently delete your history.
  • After you delete your account: your account and your logged data are removed from our live systems immediately.
  • Backups: residual copies can persist in encrypted infrastructure backups for a short period after deletion before those backups roll over. Exact backup retention window: TODO — legal review.
  • Email records: if you have emailed us, we keep that correspondence for as long as needed to deal with the matter and any follow-up.

Deleting your account

You can delete your account yourself from within Swell. You do not need to email us and you do not need our permission.

Deleting your account removes your account and all of the data you have logged across every pillar — health, mind and money — from our live systems. It takes effect immediately, and it cannot be undone. Residual copies in encrypted backups are handled as described above.

If the in-app deletion does not work for you for any reason, email hello@swellapp.co.uk and we will do it manually. We will respond within one month, as UK GDPR requires.

Health, mind and money data are processed on your consent. Withdrawing consent is as easy as giving it.

You can withdraw at any time by deleting the data in question in the app, or by deleting your account entirely. You can also email hello@swellapp.co.uk and ask us to do it. You do not have to give a reason, and withdrawing consent for one category does not affect the others.

Exact location of the in-app control: TODO — confirm against the current app build.

Withdrawing consent does not make our earlier processing unlawful — it stops the processing going forward.

Your rights

Under UK GDPR you have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — have inaccurate data corrected.
  • Erasure — have your data deleted. In Swell you can do this yourself at any time.
  • Restriction — ask us to limit how we use your data while something is being resolved.
  • Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
  • Objection — object to processing carried out on the basis of legitimate interests.
  • Withdraw consent — at any time, as described above.

Email hello@swellapp.co.uk to exercise any of these. We will respond within one month. Exercising your rights is free.

Complaining to the ICO

If you think we have handled your data badly, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can complain to the ICO without contacting us first, though we would rather have the chance to put it right.

Cookies and analytics

This website sets no cookies at all. It has no analytics, no tracking pixels, no advertising tags, and no third-party scripts beyond the web font used to display it.

The app sets one essential cookie: the Supabase authentication cookie that keeps you signed in. It is strictly necessary to provide a service you have asked for, so it does not require consent, and there is no cookie banner for that reason.

We do not use Google Analytics or any equivalent. If that changes, this policy will be updated first, and anything non-essential will ask your consent before it runs.

Security

Data is held in Supabase with access controls that restrict each account to its own rows, and is encrypted in transit. No system is perfectly secure, and we will not pretend otherwise, but we will tell you promptly if something goes wrong in a way that affects you.

Minimum age

TODO — the minimum age for a Swell account has not been set yet. This section will state the age and how it is checked once that decision is made.

Changes to this policy

We will update this page when the product changes. If a change materially affects how we use data you have already given us, we will tell you by email rather than quietly editing this page.

Questions about any of this go to hello@swellapp.co.uk. See also the terms of service.