Privacy
What we collect
If you don’t sign in (browsing only)
- Nothing on our servers. No account, no profile, no record of your visit.
- One IP geolocation call to ipapi.co on first visit to guess your starting city. The result is cached in your browser — we never see your IP or the city on our side.
If you RSVP without an account
- Your name and email — so the host can reach you, and so we can send the confirmation.
If you sign in
- Your email (the magic link target)
- A Stytch user ID so we can recognize you on return visits
If you host events
Everything above, plus:
- Phone number if you post or edit by SMS or WhatsApp (we need it to deliver the reply)
- The event content you submitted — title, time, venue, description, images, tags, visibility setting
What we don’t collect
- No third-party ad networks. No Google Analytics, no Meta pixel, none of that.
- No cross-site tracking. We don’t have data-sharing deals where someone else tells us what you’ve been up to.
- No background location. The browser geolocation prompt only fires when you tap Use my current location.
- No contact or calendar access. The browser can’t give us that, and we don’t ask.
Third-party services we use
Infrastructure:
Feature vendors:
- Stytch — magic-link sign-in
- Mapbox — city autocomplete and venue geocoding
- Twilio — SMS and WhatsApp delivery
- SendGrid — transactional email
- Anthropic — parsing inbound flyers and messages into event drafts
- Replicate and OpenAI — AI cover generation
- ipapi.co — first-visit city geolocation (called from your browser)
Each is scoped to the job above. None of them get bulk exports or analytics about your usage on Swirl.
What’s in your browser
Swirl uses localStorage and sessionStorage — no cross-site cookies, no ad cookies. Wipe whenever, in your browser’s site-data settings.
| Key | What it stores |
|---|---|
swirl-loc | Your location pill state (city, radius, unit, coords) |
swirl-loc-recent | Your recent location picks (up to 5) |
swirl-watch | Your Interested list (event slugs) |
swirl-search-recent | Recent search queries (up to 8) |
swirl-ipgeo | A flag noting we already ran the first-visit IP geo lookup |
theme | Your dark/light/auto preference |
swirl-auth | Cached sign-in status (keeps the UI from flickering on page transitions) |
swirl-back-path | The last page you were on (for the back link on event pages) |
The swirl-auth cache and a session cookie are the only things tied to a signed-in identity. Sign out and they’re cleared.
Your data
If you have an account:
- Export — email events@swirl.events and we’ll send a JSON dump of everything tied to your account.
- Delete — same address. Deletion is immediate and irreversible.
For anonymous data (RSVPs you submitted without an account), email us with the original address and we’ll remove it.