Privacy policy

Last updated Sep 10, 2026

1. Who is responsible

Levan Abashidze, running Critswap as a sole trader, decides what Critswap collects and why. In data protection terms, that person is the controller.

Anything on this page — a question, a correction, a request to see or delete what we hold — goes to support@critswap.com.

2. What we collect

Sign-in: Your email address, and a password if you set one. If you sign in with Google, GitHub or Discord we receive your email address and your identifier at that provider; we never receive your password there.
Profile: A display name if you set one, any links you add, and a referral code we generate for you.
What you write: Your crits — the rating, the text, the answer to the maker’s question — and your projects: the title, the URL and the one question you are asking.
What you do: Your Echo balance and every entry that moved it, which projects you were assigned and which you skipped, which crits were marked helpful, reports you filed and reports about you, promo codes you redeemed, and who referred you.
Purchases: The amount, the currency, what you bought and a reference from the payment provider. We never receive or store your card details.
Email: What we have sent you, and which kinds of email you have switched off.
Technical: Our hosting providers log ordinary request data — IP address, browser, time — to keep the service up and to spot abuse.

3. Why we are allowed to

To provide what you signed up for: your account, the exchange, your balance and your purchases. That is our contract with you.
To keep the exchange honest: moderation, reports, strikes, spotting accounts made to farm Echo, and checking the reputation of a submitted URL. That is our legitimate interest, and yours.
To meet legal obligations, which is why records of payments are kept.
Because you agreed: the notification emails. Every one carries an unsubscribe link, and switching one off never removes the same notification from the app.

4. Who sees what

A crit is shown to the owner of the project it was written for, without your name. The data their page receives contains no identifier for you at all.
Reviewers are not told who owns a project. If you switch on the follow card for one of yours, reviewers who have finished it see the links you chose to add to your profile — and nothing else.
An admin can read any crit, project or report, in order to moderate it. There is one admin role and it belongs to the operator.
Nobody else. We do not sell personal data, we do not share it for advertising, and there is no advertising or analytics tracker on any page.

5. Who processes it for us

Critswap is a small service built on other people’s infrastructure. These are the companies that handle your data on our behalf, and the only ones:

Supabase: Sign-in and the database. Everything above other than payments is stored there.
Whop: Payments. Your card details go to them and never reach us; we receive a reference and the outcome.
Resend: Sending email. They receive your address and the message.
Google Safe Browsing: Checking a submitted project URL against known-bad sites. Only the URL is sent — never anything about who submitted it.
Vercel and Railway: Hosting the site and the API, and the request logs that go with running them.

Some of them process data outside the country you are in. Each is engaged under its own published data processing terms, and we rely on those.

6. Cookies

Critswap sets two kinds of cookie, and neither is for tracking:

Sign-in cookies from Supabase Auth, which are what keep you signed in.
One referral cookie, if you arrive through somebody’s referral link. It holds that eight-character code and nothing else, the browser cannot read it, and it expires on its own.

There is no analytics, no advertising and no third-party tracker anywhere on the site. That is why there is no cookie banner asking you to accept any.

7. How long we keep it

Your account and what is attached to it, for as long as the account is open.
A project stops taking crits at the end of its life, but the record of it stays with your account until the account goes.
Records of payments for as long as we are required to keep them.
After a deletion request, as set out below.

8. Your rights, and how deletion works

You can ask to see what we hold about you, to correct it, to have it deleted, to receive a copy of it in a portable form, to object to the processing we do for our legitimate interests, and to withdraw your agreement to notification emails at any time. Write to support@critswap.com and we will answer within a month.

There is no button in the app that deletes an account, so deletion is by that request. This is exactly what it does:

Your email address is replaced everywhere we hold it, including in the sign-in system, and your display name is removed.
Your sign-in is closed for good. Password, Google, GitHub and Discord all stop working, and the account cannot be reopened.
The links on your follow card and your email preferences are deleted outright.
Projects you submitted are kept, with nothing on them that names you. Other people wrote crits for those projects, and deleting the project would delete their work too.
Crits you wrote for other people’s projects are kept and detached from you. They already carry no name, and they are part of another maker’s record of their own project.
Your Echo balance and the history behind it are kept as figures with no name attached, because we have to be able to show that the books add up.
Records of payments are kept where the law requires, reduced to what the law requires.
An Echo balance is not money and is not refunded.

If you think we have handled your data badly, tell us first — but you are entitled to complain to the data protection authority for the country you live in.

9. Security

Passwords are handled by Supabase Auth. We never see them and we cannot read them.
Everything travels over HTTPS.
The database enforces access per row, so a signed-in browser can read its own rows and no one else’s.
Admin access belongs to the operator alone.

10. Children

Critswap is not meant for children, and we do not knowingly collect anything about one. If you believe a child has an account here, write to support@critswap.com and we will delete it.

11. Changes to this policy

When this policy changes, this page and the date at the top of it change with it. Questions go to support@critswap.com.