Last updated August 2026
Ad Swap is run by one person (Emma Goldberg), not a company. This policy describes, in plain language, what's actually collected and why — no boilerplate you'd have to dig through a privacy team to verify.
When you submit your site through the form, we store: the site name, site URL, tagline, an optional logo (either a file you upload or an image URL you paste), and an optional contact email. All of this is stuff you typed in yourself and chose to make public — it's the ad copy shown on other members' sites, so it's meant to be seen.
If you upload a logo file, it's stored in Firebase Storage and served publicly, the same as the rest of the ad content.
Before a submission is accepted, our server fetches the page at the URL you gave us to confirm the embed code is actually live there. That fetch is server-side (it doesn't come from your browser or expose your IP to the site being checked), and only the fact that verification succeeded — plus the URL checked and a timestamp — is kept.
To stop the verification check from being spammed or used to probe arbitrary URLs, we briefly rate-limit it by IP address. That means an IP address and a request count get stored for a short rolling window — it's a counter, not a profile, and it isn't linked to any submission or site.
When someone submits a site, the site name and tagline (not the email or logo) are sent to a push-notification service (ntfy.sh) so the admin knows to review it. That's the only third party in this flow beyond our hosting provider.
Everything above runs on Firebase (Google Cloud) — Firestore for data, Cloud Storage for logo files, Cloud Functions for the verification check, and Firebase Auth for the admin login only. Google's infrastructure inherently logs standard connection information (like IP address) as part of serving any web request, the same as any hosting provider.
The homepage (ad-swap.web.app) uses Google Analytics to understand traffic — page views, general location, device/browser type, and how visitors got here. It sets a standard analytics cookie and isn't used for ad targeting or cross-site tracking. It only runs on the homepage — not on the ad widget itself (frame.html/widget.js), so it never tracks visitors on a member site.
The only cookies set on this site come from Google Analytics on the homepage, described above — they distinguish returning visitors and aren't used for advertising or shared with ad networks. The ad widget itself (frame.html/widget.js), the part that actually runs on member sites, sets no cookies at all. You can block or clear these cookies anytime in your browser; nothing on Ad Swap depends on them working.
Ad Swap isn't directed at children, and submitting a site means representing that you're at least 13 years old. We don't knowingly collect information from anyone under 13 — if that's happened, message @ad_swap and it'll be removed.
Wherever you're located, you can ask to see what's stored about your submission, correct it, or have it deleted entirely — message @ad_swap on Instagram with the site you submitted, and it'll be handled directly (deletion means logo, listing, and all — honored regardless of where you're located). If you're in the EU or UK, you also have the right to lodge a complaint with your local data protection authority, though reaching out directly will almost always be faster since this is a one-person project, not a company with a formal request process.