SwipeType Alpha Privacy Notice

Effective date: 4 August 2026

SwipeType is operated by SwipeType (dbdoo), an individual developer. Privacy and raw-session deletion requests can be sent to dbdoo.dev@gmail.com. The controller location is the United States.

Normal keyboard use

Normal typing is processed on the iPhone. SwipeType does not send ordinary messages, surrounding document text, app names, clipboard contents, contacts, or a history of everything typed to the SwipeType research receiver. Full Access is not required for normal typing.

The keyboard keeps settings, language choice, and personalization locally so it can work and improve for that device.

Optional guided research sessions

Research is off by default. It starts only after the tester chooses a language, chooses a 25-, 50-, or 100-word set, opens the plain-language summary, and taps the explicit I Agree button. The tester may delete the local session instead of sending it.

If the tester taps Send Session, SwipeType sends:

• only the 25, 50, or 100 words shown by the selected research exercise;
• the result and candidate words produced for those prompts;
• taps, swipe paths, finger/action grouping, and session-relative timing;
• whether the input used taps, strokes, or a mix;
• corrections, boundary decisions, and decoder performance timing;
• keyboard geometry, coarse device model, iOS version, app build, and exact source revision;
• selected research language and calendar day; and
• random contribution and contributor codes.

The random contributor code links multiple voluntary sessions from the same installation so one person cannot leak across model-training and evaluation groups. It is not a name, email address, account, advertising identifier, or hardware device identifier.

Why the data is used

The optional data is used to measure SwipeType accuracy and latency, find decoder failures, prevent training/evaluation leakage, and develop improved keyboard models for the selected language. It is not used for advertising, cross-app tracking, sale, or building a profile of ordinary communications.

Where consent is the applicable legal basis, consent may be withdrawn for future use by contacting the address above with the random research code shown in the app. Withdrawal does not affect processing completed before the request.

Storage, access, and service providers

A session file reaches the operator by one of two routes. The app tells the tester which one it is using before anything is sent.

By email. The app opens a pre-addressed draft with the session attached. The tester reviews it and chooses whether to send. The message passes through the tester's own mail provider and is received in a Google-hosted mailbox (dbdoo.dev@gmail.com), so Google LLC processes it in transit and at rest. Nothing is transmitted until the tester sends the message themselves.

By direct upload. The app sends the file over HTTPS to a receiver that stores it in a private Cloudflare, Inc. R2 bucket with no public read or directory endpoint.

Both routes are covered here so the notice stays accurate as the alpha grows; early testers use the email route. Access is limited to the SwipeType operator and to the provider handling that route. No other processor receives submitted sessions, and neither route is used for ordinary typing.

Retention and deletion

Raw submitted sessions and validated copies are retained for no longer than 12 months, unless a shorter period is required or the tester requests deletion. Rejected or unusable submissions are retained for 30 days only when needed to diagnose an intake problem.

To request deletion, send the random research code displayed under Last sent research code to dbdoo.dev@gmail.com. The operator will remove identifiable raw and staged copies and prevent that contribution from future model work. Aggregate measurements and models already produced from multiple testers may not permit one contribution to be separated or reversed.

A minimal suppression record containing that random research code is retained in the private receiver storage and operator registry after deletion solely to refuse the same submission and prevent it from being downloaded or processed again. It does not contain typing paths, prompted results, device details, or ordinary text.

Deleting a session in the app removes the local copy from that iPhone. If the session was already sent, use the research code and contact above to request deletion of the submitted copy.

The app also keeps the selected set's completion count and last and best accuracy locally on that iPhone. This progress record contains the language, signed set identifier, word count, aggregate correct count, and random request code. It does not contain words, candidates, touch paths, or timing, and it is never included in a research upload.

International processing

The operator is located in the United States, and submitted sessions are reviewed and stored there.

Testers outside the United States should understand that sending a session transfers it to the United States, whose data-protection laws differ from those of their own country. The providers described above (Google LLC for the email route, Cloudflare, Inc. for the direct-upload route) operate globally and may process data in other countries in the course of delivering and storing it.

Where a transfer mechanism is legally required — for example for testers in the European Economic Area or the United Kingdom — the operator relies on the providers' published Standard Contractual Clauses. A tester who would rather not transfer data internationally should simply not send a session; normal keyboard use is unaffected.

Tester choices and rights

Participation is optional and does not affect normal keyboard use. Depending on location, a tester may have rights to access, correct, delete, restrict, or object to processing, withdraw consent, or complain to a data-protection authority. Contact dbdoo.dev@gmail.com to exercise an applicable right.

Children

SwipeType research is for adults aged 18 and over. The operator does not knowingly accept research sessions from anyone under 18, and testers are not recruited from children.

If the operator learns that a session came from someone under 18, it will be deleted without being used for model work. To report such a session, send the random research code to dbdoo.dev@gmail.com.

This restriction applies only to the optional research sessions. Normal keyboard typing is processed on the device, is not collected, and carries no age restriction.

Changes

Material changes to this notice will receive a new effective date and, when required, renewed research consent in the app.