1. Who we are
EasySwaps EV ("we", "us", "our") is operated as a personal project by the developer. Our website is easyswapsev.co.uk and you can contact us at support@easyswapsev.co.uk.
We are the data controller for the personal information described in this policy.
2. What information we collect
We collect information you provide directly when you use the app:
- Account information: your name, email address, and password (stored as a one-way hash — we cannot read it).
- Vehicle registration: optionally, the registration plate of your EV.
- Usage data: queue entries (join/leave times), charging session records (start time, battery percentage, estimated duration), and ping activity.
- Guest vehicle data: vehicle registration plates and optional names added by other users on your behalf when you have not logged in yourself.
We do not collect location data, contacts, photos, or any data from your device beyond what you explicitly enter.
3. How we use your information
- To provide and operate the queue management service.
- To send you transactional emails — specifically, password reset codes. We do not send marketing emails.
- To show your group members your queue position, session status, and vehicle registration so the queue can function.
- To generate anonymous monthly usage statistics visible within your group (e.g. swap compliance rates).
- To maintain the security of your account (authentication tokens, rate limiting).
4. Legal basis for processing (UK GDPR)
- Contract performance: processing your name, email, and usage data is necessary to provide the service you signed up for.
- Legitimate interests: security logging and fraud prevention.
- Consent: we rely on your consent where we ask for it explicitly (e.g. push notification permissions on your device).
5. Who we share your data with
We do not sell your data. We share it only with the following sub-processors where necessary to operate the service:
- Railway (Railway Corp): our backend API and PostgreSQL database are hosted on Railway's infrastructure in the EU/US. Railway Privacy Policy.
- Resend (Resend Inc): used to send password reset emails. Only your email address and name are passed to Resend for this purpose. Resend Privacy Policy.
Your data is visible to other members of the same group within the app, as this is necessary for the queue to function.
6. Data retention
- Account data is retained for as long as your account is active.
- Completed queue and session records are retained for 12 months for statistics purposes, then deleted.
- Password reset tokens expire after 15 minutes and are deleted after use.
- Authentication refresh tokens expire after 30 days and are automatically purged.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data — you can update your name and vehicle registration in the app at any time.
- Delete your account and all associated data — email us at support@easyswapsev.co.uk.
- Restrict or object to processing.
- Data portability.
- Lodge a complaint with the Information Commissioner's Office (ICO).
To exercise any of these rights, contact us at support@easyswapsev.co.uk. We will respond within 30 days.
8. Security
Passwords are hashed using bcrypt and never stored in plain text. All data in transit is encrypted using TLS. Authentication tokens are stored in your device's secure Keychain. We apply rate limiting to sensitive endpoints to protect against brute-force attacks.
9. Children
EasySwaps EV is not directed at children under 13. We do not knowingly collect data from children.
10. Changes to this policy
We may update this policy from time to time. We will notify you of material changes through the app or by email. Continued use of the service after the effective date constitutes acceptance of the updated policy.
11. Contact
Questions about this policy: support@easyswapsev.co.uk.