Last updated May 18, 2026
This Privacy Policy describes how Swellyo Inc. ("Swellyo," "we," "us," or "our") collects, uses, and shares personal information in connection with the Local Portal — our web and mobile application and all related services (collectively, the "Services").
The Local Portal is a gamified application in which invited residents of surf towns ("Contributors") play a chat-based game that records and verifies information about local service providers — accommodations, surf instruction, photography, board and motorbike rentals, tours, restaurants, non-profits, and similar businesses ("Providers"). The Local Portal builds Swellyo's verified database of local Providers. It is a separate application, on separate infrastructure, from the main Swellyo app.
This policy covers two different groups of people: Contributors, who use the app, and Providers, who do not use the app but whose information is recorded in it. If you are a Provider, Section 11 ("Information for Providers") is written for you.
Where the Local Portal is available. The Local Portal is offered in the United States and other regions, but it is not offered in the European Economic Area, the United Kingdom, Switzerland, or Brazil, and is not directed to people in those regions.
By using the Local Portal, a Contributor agrees to this Privacy Policy and our Terms of Service. If you do not agree, please do not use the Services. Questions, concerns, or requests? Contact us at app@swellyo.com.
This summary highlights the key points of our Privacy Policy. The full detail is in the numbered sections that follow.
These terms are used throughout this policy:
The company responsible for your personal information is:
Swellyo Inc.
8 The Green
Dover, DE 19901
United States
app@swellyo.com
Swellyo is responsible both for information about Contributors and for information about Providers. For any privacy question, contact us at app@swellyo.com.
This policy describes two distinct relationships:
If you are a Provider, the section written for you is Section 11 ("Information for Providers"). It explains what we hold, why, and how you can see, correct, or remove it — without needing an account.
We collect the following information about Contributors:
We collect a Contributor's real email address or phone number only if the Contributor records themselves as a Provider. We do not collect analytics or device-tracking data, payment information, date of birth, or precise location.
For each Provider recorded in the Local Portal, we may hold:
Some of this is purely business contact information. For some Providers, however, it includes a named individual's personal information — for example, an owner's personal mobile number or personal Instagram account. We therefore treat Provider Information as personal data and give Providers the rights described in Section 11.
If you are a Contributor who also records yourself as a Provider, the information about you as a Provider is governed by the Provider rules in Sections 11 and 12.
Verification artifacts (such as website screenshots and raw responses from third-party services) are generated only briefly to confirm details and are not kept as part of the database (see Section 12).
We collect data in three ways:
The Provider Information we hold therefore comes from (a) information submitted by a Contributor who identified the business, and (b) automated research of publicly accessible online sources. The automated step is a targeted look-up of a defined, limited set of contact fields for a specifically named Provider — it is not open-ended scraping of the internet.
We use personal information for these purposes:
We use personal information only where we have a proper basis to do so:
The Local Portal uses artificial intelligence provided by OpenAI, through OpenAI's developer API, for the following functions:
| Function | Information involved |
|---|---|
| The Demo Travelers you chat with | Your chat messages and the information you enter in the in-chat forms |
| Opening and closing messages | Game context |
| Chat summaries and a rolling context summary for long conversations | Your chat content |
| Researching Provider contact details | The Provider's name, location, and service type |
In practice, almost all information you share through the Local Portal — your chat content and Provider Information — passes through OpenAI at some point.
OpenAI's role. OpenAI acts as our service provider and processes this information only on our instructions, under OpenAI's API terms.
Training. OpenAI does not use data sent through its developer API to train its models.
Retention by OpenAI. OpenAI may retain API inputs and outputs for a limited period (generally up to about 30 days) for abuse monitoring and then deletes them, except where it must retain data to comply with law.
The Demo Travelers are AI. The "travelers" you chat with are AI chatbots, not real people. The app also tells you this when you begin.
Before you first use an AI feature, the app shows you a consent screen that names OpenAI and describes the information involved, and asks for your permission before any information is sent to OpenAI. If you do not accept, you cannot use the Services, because the game depends on these AI features. To stop AI processing afterwards, delete your account (see Section 24).
This section is written for Providers — the local businesses and individuals recorded in the Local Portal. You do not use the app, and you may not know your information is held. This section tells you what we hold and how to control it.
Who holds your information. Swellyo Inc., 8 The Green, Dover, DE 19901, United States; app@swellyo.com.
What we hold. Your business name, location, and service type, and contact details such as a contact name, a phone or WhatsApp number, an Instagram account, and a website address (see Section 6).
Where it came from. We obtained your information from (a) a Contributor who identified your business, and (b) automated research of publicly accessible online sources, such as your own website and public social media.
Why we hold it. To build and maintain Swellyo's verified directory of local service providers, and to refer and recommend Providers to travelers — that is, to send you potential customers — including through a planned paid recommendation feature in the main Swellyo app. We rely on our legitimate business interest in operating this directory; the contact details we hold are generally ones you have already published to attract customers, and our purpose aligns with your own interest in being found.
Who receives it. Our service providers — OpenAI (research), Supabase (storage), and a website-screenshot service (verification of Provider websites) — and travelers, through Swellyo's referral and recommendation features. We do not sell your personal information to third-party data brokers.
Where it is stored. In the United States (see Section 19).
How long we keep it. For as long as you remain an active local business relevant to our directory, with periodic re-verification; we delete records that are closed, no longer relevant, or that you ask us to remove (see Section 20).
Your rights. You have the right to ask us what information we hold about you; to have it corrected; to have it deleted; and to object to our holding or use of it. If you object or ask to be removed, we will remove your information from the directory unless we have a compelling legal reason to keep it, which for a referral directory will rarely be the case.
How to contact us or be removed. You do not need an account or the app. Use our data request page at https://swellyo.com/delete-account or email app@swellyo.com. We respond within 30 days, free of charge. Where we or a Contributor contact you directly, we provide this same information in that first communication.
To confirm that a Provider is a real, identifiable business, the Local Portal may display the Provider's own publicly available content by reference:
This is the Provider's own published content, shown by reference to confirm the business is real. Swellyo claims no ownership of it.
The Contributor reviews and confirms the researched contact details. Information is saved to our database only after it passes this verification; if the Contributor marks the information as wrong, it is not stored. Because of this, Provider Information is "contributor-confirmed" — we do not warrant that it is accurate, and Providers may ask us to correct it (see Section 11).
The core activity of the Local Portal is that Contributors record information about third parties — Providers — through the in-chat forms and conversation. This contributed content is reviewed and verified (Section 12), stored, and licensed to Swellyo under our Terms of Service.
The compiled Provider database, and the verification and organization of it, are Swellyo's property. The license a Contributor grants over verified Provider Information continues even if the Contributor later deletes their account (see Section 24). Providers can correct or remove information about them as described in Section 11.
Contributor identity. We do not display a Contributor's name or identity to other people. If in the future we would show a Contributor's name anywhere — for example, to attribute captured information in another Swellyo app — we will do so only if that Contributor has agreed to it.
The Local Portal is a game. As you play, we record game progress data — points, levels, badges, status tiers, and streaks. We use this data to operate the game you signed up to play.
This data is visible only to you and to Swellyo. There is no leaderboard and no ability for Contributors to see one another — the Local Portal is a solo experience. Game points and badges have no monetary value; the full rules are in our Terms of Service.
We use the following third-party service providers, each bound to process data only on our instructions:
| Service provider | Purpose | Information involved |
|---|---|---|
| OpenAI | Demo Traveler chatbots, messages, summaries, and Provider research | Contributor chat content; Provider Information |
| Supabase | Database, authentication, and storage (West US / Oregon region; a separate project from the main Swellyo app) | All Local Portal data |
| Instagram (Meta Platforms) | Loading a Provider's public Instagram page in an embedded view during verification — the device connects to Instagram the same way a web browser does (Swellyo does not call Instagram's APIs) | Provider Instagram username (used to build the page URL); standard web-traffic information from the contributor's device to Instagram |
| screen-shot.xyz | Capturing a screenshot of a Provider's website for verification | Provider website addresses |
| Google Maps | Letting Contributors select a location | Contributor location selections |
| Netlify | Hosting the Local Portal web application and its serverless functions | Standard web traffic data |
We may also disclose personal information: to comply with the law, a court order, or a lawful request; to protect the rights, safety, and security of Swellyo, our users, Providers, or others; and in connection with a merger, acquisition, or sale of assets.
We may use information within Swellyo's own applications, including the main Swellyo app and a planned paid recommendation feature. Using information to operate our own services is not a sale of personal data.
The Local Portal uses no analytics provider, no advertising networks, and no data brokers.
The Local Portal web application uses only essential cookies and similar technologies — the session and authentication cookies needed for the Access Code login and for the app to function.
We use no analytics tool, no advertising cookies, no tracking pixels, and no behavioral-advertising networks. We do not track you across other apps or websites, and we use no advertising identifier (such as Apple's IDFA or the Android Advertising ID).
There is no uniform standard for "Do Not Track" browser signals, so we do not currently respond to them. We do honor the Global Privacy Control signal as described in Section 33.
We use reasonable technical and organizational measures to protect personal information, including encryption in transit (TLS/HTTPS), encryption at rest for data stored with Supabase (West US / Oregon), and access controls that limit access to authorized personnel. Our service providers maintain their own security measures. No system can be guaranteed 100% secure.
Data breaches. If a personal-data breach occurs, we will notify the relevant authorities and affected individuals where and as required by applicable law, including US state breach-notification laws and Australia's Notifiable Data Breaches scheme.
Swellyo is based in the United States, and the Local Portal's data is stored and processed in the United States (with Supabase, in the West US / Oregon region). If you use the Local Portal from outside the United States, you understand that your information will be stored and processed in the United States.
The Local Portal is not offered in the European Economic Area, the United Kingdom, Switzerland, or Brazil.
We keep personal information only as long as needed for the purposes described in this policy:
| Information | Retention |
|---|---|
| Contributor account, credentials, location, chat content, profile photo, and game progress data | Kept while the account is active; deleted within 30 days of an account-deletion request |
| Provider Information | Kept for as long as needed for the verified-directory purpose, subject to periodic re-verification; deleted when a Provider is closed or no longer relevant, or on a valid objection or removal request |
| Verification artifacts (screenshots, raw research responses) | Kept only briefly for verification, then deleted |
| Information we must keep for legal reasons | Kept for the period required by law, then deleted; isolated and not used for other purposes |
You can report content — including a message from an AI Demo Traveler — by pressing and holding the message, choosing "report," and selecting a category. The report is sent to Swellyo for review.
We review reports and may remove or correct content, suspend a Contributor, or revoke an Access Code. Because the Local Portal is a solo app in which Contributors never see one another, there is no need to "block" another user.
Depending on where you live, you may have the right to: access the personal information we hold about you; have it corrected; have it deleted; object to certain uses of it; receive a copy of it; and make a complaint. Specific US state rights are described in Sections 28–33.
Where you object to a use of your information that we base on our legitimate business interests, we will stop that use unless we have a compelling reason to continue — for example, to keep the Services secure, to prevent fraud or abuse, or to establish or defend legal claims. A Provider's objection to our use of their information for the directory is described in Section 11.
These rights apply to both Contributors and Providers. Providers, who have no app account, exercise them through the account-free channel described in Section 11. We verify identity before acting on a request, respond within the time the law allows, and do not charge a fee. For how to make a request, see Section 40.
The Local Portal uses AI to suggest Provider contact details, but a human Contributor reviews and confirms that information before it is saved. Because there is meaningful human involvement, this is not a decision made solely by automated means.
We do not use AI or automated processing to make decisions that produce legal or similarly significant effects about any person, and we do not carry out profiling of that kind.
A Contributor may delete their account at any time, both within the app and through our data request web page at https://swellyo.com/delete-account. This is the single web address for account deletion and for Provider removal requests; other sections of this policy refer back to it.
When a Contributor deletes their account, we delete the Contributor's account, generated credentials, location data, profile photo, chat content, and game progress data within 30 days, and instruct our service providers to delete it, except for anything we must keep for legal reasons.
Provider Information is treated separately. Provider records are controlled by Swellyo for the directory and are not deleted simply because the Contributor who first identified that Provider deletes their account. A Provider can have their information removed through the channel in Section 11. If a Contributor recorded themselves as a Provider, that Provider record is governed by the Provider rules (Sections 6 and 11), survives deletion of their Contributor account, and can be removed through the Provider channel.
The Local Portal is intended only for people aged 18 and older. We do not knowingly collect personal information from anyone under 18. Contributors are invited and personally vetted by a Swellyo team member before they sign up, which functions as our age check. If we learn that someone under 18 has access, we will revoke the Access Code and delete the account and associated data.
The Local Portal does not access your device camera. It does let you, optionally, choose an image from your device's photo gallery to set as your Contributor profile photo. This is optional — the app works without a profile photo — and the app requests access to your gallery only when you choose to set or change your photo. On Android, the app uses the system Photo Picker, so it does not request broad access to your photo library. The photo you select is stored as described in Sections 5 and 20.
The Local Portal may send you push notifications — for example, reminders about your game progress or streaks, and service updates. You are asked to allow notifications, and you can turn them off at any time in your device settings. Our notifications do not contain sensitive personal information.
Residents of US states with comprehensive privacy laws — currently around twenty states and growing, including California, Colorado, Connecticut, Texas, Virginia, and Oregon, among others — have privacy rights regarding their personal information. We voluntarily extend the rights described in Sections 29–34 to all US residents.
These rights also apply to Providers who are US residents: a Provider is a "consumer" under these laws even though they do not use the app, and may exercise their rights through the account-free channel in Section 11.
In the terms used by US state privacy laws, we collect the following categories:
| Category | About Contributors | About Providers |
|---|---|---|
| Identifiers and contact information | Generated account email, Access Code, user ID | Business name, contact person's name, phone/WhatsApp, Instagram, website |
| Geolocation | Place-name location (country/city/town/beach) — not precise geolocation | Business location (place-name) |
| Internet or other electronic activity | Game chat content, game progress data | — |
| Visual information | Optional profile photo | — |
| Professional or commercial information | — | Service type and related business details |
We do not ask for or intentionally collect Sensitive Personal Information, and we do not use information to infer sensitive characteristics about anyone. We collect no precise geolocation, no payment or financial data, no government identifiers, and no date of birth in the app. Because the game involves free-text conversation, please do not enter sensitive information into the chat; if you do, we do not use it for any purpose beyond operating the game. We collect the categories above from Contributors directly, from their use of the Services, and — for Providers — from Contributor input and publicly available online sources, for the business purposes described in Section 8.
Swellyo does not sell personal information, and does not share it for cross-context behavioral advertising. We therefore do not offer a "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of.
This remains true for our planned paid recommendation feature. Charging a traveler for a recommendation that includes a Provider's contact details is selling a service to that traveler — our own customer — not selling personal data to another business. We use no advertising networks and no data brokers.
If you are a US resident, you may have the right to: know about and access the personal information we hold; delete it; correct it; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising; opt out of profiling used for decisions with legal or similarly significant effects; limit the use of sensitive personal information; receive equal service without discrimination (Section 34); and appeal a decision if we decline your request.
We collect no sensitive personal information, do not sell or share data, and do not carry out profiling of that kind, so several of these opt-outs have nothing to act on — but the rights are stated here for completeness. We respond to verifiable requests within 45 days (extendable by a further 45 days where permitted). To make a request, see Section 40.
On our web application, we honor the Global Privacy Control (GPC) and other recognized universal opt-out signals, and treat them as a valid request to opt out of the sale or sharing of personal information and of targeted advertising — although, as noted in Section 30, we do not sell or share personal information.
We will not discriminate against you for exercising any of your privacy rights. We will not deny you the Services, charge a different price, or provide a different quality of service because you exercised a right.
If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply to your personal information. You may access and correct your personal information, and you may complain to the Office of the Australian Information Commissioner (OAIC). The Local Portal is intended only for people aged 18 and older. As described in Section 19, your information is stored and processed in the United States.
If you are in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). We obtain meaningful consent where required, you may access and correct your personal information and challenge our compliance, and we remain accountable for personal information handled by our service providers. You may complain to the Office of the Privacy Commissioner of Canada.
If you live in a country not specifically addressed above, you may still have privacy rights under your local law. We will honor applicable local rights. To exercise them, contact us at app@swellyo.com or use the data request page in Section 40. As noted above, the Local Portal is not offered in the European Economic Area, the United Kingdom, Switzerland, or Brazil.
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top. If we make material changes, we will provide a more prominent notice, such as an in-app notice. Please review this policy periodically.
For any privacy question or request, contact us at:
Swellyo Inc.
8 The Green
Dover, DE 19901
United States
app@swellyo.com
This contact route works for both Contributors and Providers. Providers can also use the account-free channel in Section 11.
This section explains how to make a privacy request. It is the single reference for how requests work; other sections point here.
We will verify your identity before acting on a request, using a proportionate level of verification. We respond within the time the law allows — generally within 30 to 45 days (extendable where permitted). Requests are free of charge. If we decline a request, we will explain why and, where the law provides it, how to appeal.