Privacy and analytics

Updated October 17, 2026.

SocialSwarm uses first-party analytics to understand useful project discovery and fix failures. Usage records are stored in a private Cloudflare D1 database and are available only to accounts with the database admin role.

What we record

Browser records include page categories, navigation order, broad referral sources, country, device/browser categories, link categories, setup-copy actions, form attempts, visible-page time, performance measurements and error categories. A random ID in session storage groups activity within a browser tab and expires after 30 minutes of inactivity. Signed-in activity may be associated with your verified account ID.

Server and MCP records include route or tool names, response status, duration, authentication presence, search-filter presence, result counts and error categories. MCP client names are grouped from the client’s self-reported initialization information. Public, stateless MCP calls do not reliably identify individual users or agents.

What analytics excludes

We do not store raw IP addresses, full user-agent strings, passwords, access tokens, request or response bodies, prompts, search text, filter values, form contents, full referral URLs, query strings or session replay in the analytics database. Route templates hide private listing identifiers. We do not send these analytics events to advertising networks.

Controls and retention

Optional browser collection respects Do Not Track and Global Privacy Control. You can also disable it below. Necessary server request and reliability records continue so we can detect failures and abuse. Analytics records are scheduled for deletion after 90 days; deletion runs daily. Provider backup retention may extend beyond deletion from the active database.

Account and project data

Supabase stores authentication and directory data separately from analytics. Account email addresses are used for sign-in and confirmation; passwords and administration tokens are not part of analytics. Published project listings and their contribution instructions are public. Drafts and account workspaces require authentication. Cloudflare and Supabase also process operational data to provide their services.