Last updated: July 26, 2026
Two commitments before we get into the detail:
This privacy policy explains how Swipcall collects, uses, and protects information when you use the Swipcall Android application and this website. Swipcall is a local-first customer management app built for tradespeople such as plumbers, electricians, and locksmiths. We designed Swipcall so that your personal and business data stays on your device. This policy is written in plain language so you can understand exactly what happens with your data.
This policy describes how we process your data when you use Swipcall, and the legal bases we rely on for each processing activity, as detailed in Section 4 below.
The data controller responsible for your data is:
Swipcall
Operated by Cadvix, an unregistered partnership based in Israel
Email: admin@swipcall.com
Given the nature and scale of our processing activities, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. For all privacy-related matters, contact us at admin@swipcall.com.
For all privacy-related requests, including exercising your rights under the GDPR, please contact us at the email above. We aim to respond within 30 days.
Swipcall is a local-first app. The vast majority of data never leaves your device. Below is a complete list of data categories, where they are processed, and who can access them.
This data is stored in a local SQLite database on your Android device. Swipcall has no server that receives this data. We cannot access, read, or recover it.
One exception, and only when you start it: if you send us a bug report from inside the app, the report carries a small amount of information off your device. It never contains customer records, phone numbers, call details, or message content - only counts and system settings. Section 3.4 lists exactly what is in it.
Voice notes (removed feature): Earlier versions of Swipcall included a voice notes feature, which has been removed. If you upgrade from a version that had it, any leftover voice notes on your device are deleted on first launch via a database migration. Voice notes were never sent to or stored by us.
| Data | Service | Purpose |
|---|---|---|
| Email address, display name | Google Sign-In (optional) | Only if you choose to sign in. Swipcall does not require an account: sign-in is offered at the moment you connect Google Calendar sync or Google Drive backup, and nothing else depends on it. |
| Anonymous crash reports (stack traces, device model, OS version - no personal data) | Firebase Crashlytics (Google) | Identifying and fixing bugs |
| Anonymous usage events (feature tap counts, screen views - no personal data) | Firebase Analytics (Google) | Understanding which features are used so we can improve the app |
| Email address, display name, occupation, user ID, purchase receipts | RevenueCat | Managing subscriptions, verifying purchases, and understanding our user base to improve the service |
| Bug reports you choose to send: your description, device and build details, counts (not content), recent app error messages, and the diagnostic report - see Section 3.4 | Google Apps Script and Google Sheets | Receiving and triaging support requests you send us |
| Approximate location (derived from IP address - city/country level only), device identifiers, in-app events, install attribution data | AppsFlyer | Mobile marketing attribution, measuring the effectiveness of advertising campaigns, and detecting installation fraud. AppsFlyer forwards aggregated event data to advertising platforms (e.g., Meta, Google Ads) to enable campaign optimization. No personally identifiable information is shared with advertising platforms. |
| Data | Service | Purpose |
|---|---|---|
| Encrypted backup file (AES-256-GCM encrypted copy of your local database) | Google Drive (your personal account) | Backup and restore, initiated by you |
| Appointment details you choose to sync | Google Calendar (your personal account) | Two-way calendar sync, initiated by you |
The app has a bug report form and a Health Check screen. Nothing here happens on its own: a report is only ever built and sent when you tap send. When you do, the report is transmitted to a Google Sheet of ours through a Google Apps Script endpoint, and it contains:
The same diagnostic report can also be shared by you directly from the Health Check screen, for example into a support chat. That is your action and your choice of recipient.
Under Article 6 of the GDPR, every type of data processing must have a legal basis. Here is the legal basis for each processing activity in Swipcall:
| Processing activity | Legal basis (Art. 6 GDPR) | Explanation |
|---|---|---|
| On-device processing of call logs, contacts, and customer records | Art. 6(1)(b) - Performance of a contract | This processing is necessary to provide the core service you downloaded the app to use (caller identification and customer management). |
| Google Sign-In (email, name) - optional | Art. 6(1)(a) - Consent | Signing in is not required to use Swipcall. You choose to sign in when you want Google Calendar sync or Google Drive backup, and you can sign out at any time. |
| Firebase Crashlytics (anonymous crash reports) | Art. 6(1)(f) - Legitimate interest | Our legitimate interest is maintaining app stability and fixing bugs. The data is anonymous and the impact on your privacy is minimal. |
| Firebase Analytics (anonymous usage counts) | Art. 6(1)(a) - Consent | Firebase Analytics is only initialized after you opt in within the app settings. You can withdraw consent at any time by disabling analytics in the app settings. |
| RevenueCat (subscription management) | Art. 6(1)(b) - Performance of a contract | Necessary to process and verify your subscription purchase. |
| Google Drive backup (encrypted) | Art. 6(1)(a) - Consent | You choose to enable this feature. You can stop at any time. |
| Google Calendar sync | Art. 6(1)(a) - Consent | You choose to enable this feature. You can disconnect at any time. |
| Bug reports and the diagnostic report | Art. 6(1)(b) - Performance of a contract | Processing your report is how we provide you with support, which is part of the service. A report is only ever created and sent when you choose to send it. |
| AppsFlyer (marketing attribution) | Art. 6(1)(a) - Consent | AppsFlyer is only initialized after you opt in within the app. You can withdraw consent at any time by disabling analytics in the app settings. Data transmitted is limited to anonymous device identifiers, approximate location (city-level), and app event metadata. |
Swipcall never asks for permissions up front. Each one is requested at the moment the feature that needs it is used, with a one-line explanation of why. Below is the complete list declared by the app.
| Permission | What it is for |
|---|---|
| READ_PHONE_STATE | To detect that a call started and ended, which is what triggers the post-call popup. |
| READ_CALL_LOG | To read the number, time, and duration of the call that just ended, so the popup can show who it was. Processed entirely on your device. |
| SYSTEM_ALERT_WINDOW | To display the floating popup on top of other apps after a call. |
| READ_CONTACTS | To match an incoming number with a contact name saved on your device, and to let you pick a colleague from your contacts. Contact data is read locally and is never transmitted to us. |
| POST_NOTIFICATIONS (Android 13 and above) | To deliver appointment and callback reminders. |
| SCHEDULE_EXACT_ALARM (Android 12 and above) | To fire the hour-before appointment reminder at the exact minute rather than whenever the system decides. |
| REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | To ask you to exempt Swipcall from battery optimization, without which Android stops the call detection in the background and the popup silently stops appearing. |
You can revoke any of these at any time through your Android device settings. Revoking one disables the feature that depends on it; the rest of the app keeps working. The Health Check screen inside the app shows you which of these are currently missing and what each one costs you.
These are Android "normal" permissions. The system grants them without asking, they expose no personal data, and there is no device setting to toggle them:
Some third-party libraries we depend on try to add permissions of their own. We strip the following from the app before it is built, so they do not appear in the app's declared permissions on Google Play:
Swipcall does not request location, camera, or microphone permissions at all.
The following third parties process data on our behalf or as part of the services you use through Swipcall:
| Processor | Role | Data processed | Privacy policy |
|---|---|---|---|
| Google LLC (Firebase Crashlytics) | Sub-processor | Anonymous crash data | Google Privacy Policy |
| Google LLC (Firebase Analytics) | Sub-processor | Anonymous usage events | Google Privacy Policy |
| Google LLC (Sign-In, Drive, Calendar) | Independent controller / processor | Email, name, backup files, calendar events | Google Privacy Policy |
| RevenueCat Inc. | Sub-processor | Email address, display name, occupation, user ID, purchase receipts | RevenueCat Privacy Policy |
| Google LLC (Google Play) | Processor | Payment and subscription data | Google Privacy Policy |
| Google LLC (Apps Script, Google Sheets) | Sub-processor | Bug reports you choose to send: your description, device and build details, counts, recent app error messages, and the diagnostic report (Section 3.4) | Google Privacy Policy |
| AppsFlyer Ltd. | Sub-processor | Approximate location, device identifiers, in-app events, install attribution | AppsFlyer Privacy Policy |
We do not sell, rent, or share your personal data with third parties beyond the processors listed above. We use AppsFlyer for marketing attribution (measuring the effectiveness of our own advertising campaigns, with your consent). We do not engage in cross-app behavioral tracking, behavioral ad targeting, or sharing your data with advertisers for their own purposes.
Swipcall is operated from Israel, which has an adequacy decision from the European Commission, meaning the Commission recognizes Israel as providing an adequate level of data protection.
AppsFlyer Ltd. is headquartered in Israel and benefits from the same EU adequacy decision. AppsFlyer also has operational data centers in the United States, which are protected by the same safeguards (EU-US Data Privacy Framework certification and Standard Contractual Clauses) as the other US-based processors listed above.
Some third-party processors listed above (Google LLC and RevenueCat Inc.) are based in the United States. Data transferred to these US-based processors is protected by the following safeguards:
We apply the following retention periods:
| Data | Retention period | How to delete |
|---|---|---|
| On-device data (customers, calls, appointments, settings) | Kept until you delete it or uninstall the app | Use "Delete all data" in Settings, or uninstall the app |
| Google Drive backups | Kept in your personal Google Drive until you delete them | Delete the backup files from your Google Drive, or disconnect backup in the app |
| Google Sign-In data (email, name) | Stored locally on your device; kept by Google as part of your Google account | Local copy is deleted when you uninstall the app or use "Delete all data" in Settings. To remove from Google, revoke Swipcall's access in your Google account security settings |
| Firebase Crashlytics data | 90 days (Google's default retention) | Automatically deleted by Google after the retention period |
| Firebase Analytics data | 14 months (Google's default retention) | Automatically deleted by Google after the retention period |
| RevenueCat subscription data | Subscription duration plus up to 7 years as required by Israeli tax law | Contact us at admin@swipcall.com to request deletion after subscription ends and the tax retention period has elapsed |
| Bug reports you sent us | Kept for up to 24 months in our support sheet, then deleted | Email admin@swipcall.com and we will delete your reports on request |
| AppsFlyer attribution and event data | Up to 90 days for raw event data, longer for aggregated reports per AppsFlyer's data retention policy | Contact us at admin@swipcall.com to request earlier deletion |
If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights regarding your personal data:
For data stored on your device, you can exercise your rights directly through the app:
For data held by third-party processors (Firebase, RevenueCat, Google), email us at admin@swipcall.com with the subject line "GDPR Data Request". Please include your email address so we can identify your account. We will respond within 30 days. There is no fee for exercising your rights. If your request is complex or you make multiple requests, we may extend the response period by up to 60 additional days and will inform you of the extension.
Where we rely on your consent as the legal basis for processing (Google Sign-In, Firebase Analytics, Google Drive backup, and Google Calendar sync), you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.
To withdraw consent:
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You can do this in the EU/EEA member state where you live, where you work, or where the alleged violation took place.
A list of EU/EEA data protection authorities is available on the European Data Protection Board website.
If you are in Israel, you may also lodge a complaint with the Israeli Privacy Protection Authority (PPA).
We encourage you to contact us first at admin@swipcall.com so we can try to resolve your concern directly.
Providing your data to Swipcall is not a statutory or contractual requirement. However:
Swipcall does not use automated decision-making or profiling as defined in Article 22 of the GDPR. No decisions with legal or similarly significant effects are made about you based on automated processing.
When you tap "Send WhatsApp" in the app, Swipcall opens the WhatsApp application using a standard Android intent (deep link) with the customer's phone number. This is a direct device-to-app communication. No data passes through any Swipcall server. The phone number is sent directly from your device to WhatsApp on your device. WhatsApp's own privacy policy governs how WhatsApp handles that data.
Swipcall lets you hand a job you cannot take to another tradesperson. When you do, the app composes a message for you - in WhatsApp, SMS, or whichever channel you use - containing the customer's name, phone number, job description, and address, plus a swipcall.com/r link. You send that message yourself, from your own account, to the colleague you picked.
The customer's details ride inside that link, after the # sign. That part of a web address is a fragment: browsers and link-preview services never send it to any server. The details are encoded, not encrypted - anyone holding the link can read them, exactly as anyone holding the message can read the same details written in its text.
The important consequence: no Swipcall server ever receives the lead. There is no server in this path at all. The handoff is device to device, inside your own private conversation, and it is governed by the privacy policy of whichever messaging app you send it through.
When your colleague opens the link, their copy of Swipcall reads the details out of the link on their own device and saves them as a customer record there. From that point the colleague is responsible for those details, as the controller of their own customer list. If your colleague does not have Swipcall, the link simply opens the Google Play listing, and the details stay only in the message text you sent.
The Swipcall website (this site) uses only essential local storage (localStorage) to remember your accessibility widget settings (font size, line height, letter spacing, contrast, grayscale, link highlighting, readable font, cursor size, and paused animations) and your choice on the storage notice itself. We do not use tracking cookies, advertising cookies, or any third-party cookies. A localStorage notice banner is displayed to inform you about this storage. localStorage does not track you across sites.
Swipcall is a business tool designed for professionals. It is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data, please contact us at admin@swipcall.com and we will take steps to delete that data.
We take the following measures to protect your data:
Swipcall is operated from Israel and is subject to the Israeli Protection of Privacy Law, 5741-1981. In addition to the GDPR rights described above, all users have the following rights under Israeli law:
To exercise these rights, contact us at admin@swipcall.com.
If you believe your privacy rights under Israeli law have been violated, you may lodge a complaint with the Israeli Privacy Protection Authority (PPA).
Under the Israeli Protection of Privacy Law, database registration with the Registrar of Databases is required when a database contains personal data of more than 10,000 individuals. Swipcall will complete this registration if and when this threshold is reached.
We may update this privacy policy from time to time to reflect changes in the app, the law, or our practices. When we make changes:
We encourage you to review this page periodically.
If you have questions about this privacy policy, want to exercise your data rights, or have a concern about how your data is handled, please contact us:
Email: admin@swipcall.com
Subject line for data requests: "GDPR Data Request"
We aim to respond to all inquiries within 30 days.
Swipcall