Privacy policy

Last updated: 24 October 2026

Who we are

Swastik Codes is operated by Shwastik Tech Solutions Pvt Ltd, a company registered in India ("we", "us"). For anything in this policy, contact us at support@swastik.codes or +91 76545 31678. You can also use our contact form.

What this policy covers

This policy covers:

• the marketing website at https://swastik.codes (these pages);
• the Swastik Codes web application at https://swastik.codes/app, its account pages, and the related services under swastik.codes (the API, authentication and realtime endpoints, mock server URLs and published documentation pages).

It does not cover third-party APIs that you choose to call through Swastik Codes. When you send a request to someone else's API, that API's operator receives the request and handles it under their own terms.

Information we collect

Account information

When you create an account we collect your email address, an optional display name and your password. Passwords are stored only as salted Argon2 hashes; we never store or see them in plain text. You may add an avatar URL in your account settings. We record whether your email address has been verified.

If you sign in with GitHub, we receive from GitHub your GitHub user ID, username, name, profile picture URL and the email addresses on your account with whether GitHub has verified them. We store your GitHub user ID and username to recognise you next time, and use your verified email, name and picture for your account. We ask GitHub only for read access to your profile and email addresses, use the GitHub token once during sign-in and do not keep it. Signing in never gives us access to your repositories.

If you connect GitHub under Account settings → GitHub (separately from signing in), you allow us to read the repositories you choose to document, public and private, and to add a webhook to them. We store that GitHub token encrypted, never send it to your browser, and use it only to list your repositories, download the code of a repository you asked us to scan, check it for new commits and add or remove its webhook. Downloaded code is unpacked in a temporary folder, read to find API routes and deleted as soon as the scan ends; nothing in it is run, and we keep only the resulting collection, the repository name, branch, folder and the last commit scanned. Disconnecting deletes the token and revokes it at GitHub.

Sessions and security data

When you sign in we create a session. For each session we store a refresh token (hashed), the IP address and browser user agent used, which app it came from (web, desktop or command line), and when it was created and last used, so that you can review and sign out your devices under Account settings. We also keep records needed to enforce rate limits and to lock an account after repeated failed sign-in attempts. If you create API keys, we store a hash and a short prefix of each key, its name and when it was last used.

Content you create

If you are signed in and use a cloud workspace, we store what you put in it on our servers: collections, requests, examples, folders, environments and globals (initial values only, see below), API specifications, flows, mock server and monitor settings, comments, pull requests and reviews, version history, workspace webhooks and published documentation settings. If you join a team we store your membership and role.

Current values of variables are not synced. Swastik Codes keeps the "current value" of environment and global variables on your device and strips it before anything is stored on our servers. Only "initial values" are synced and shared. Do not put secrets in initial values if you do not want them stored and shared with your workspace.

Requests you send and their results

The web app cannot send arbitrary requests directly from your browser, so our server sends them for you (for example through /api/execute, the collection runner, load tests, flows and the protocol clients for WebSocket, gRPC, MQTT and others). To do this, the request you send, including its URL, headers, body and any credentials it contains, passes through our server, and the response passes back. We use this data only to perform the request and return the result to you. If you use the local bridge (swc bridge), the request and response travel between your browser and your computer through our server in memory, without being stored by the bridge feature itself.

If you are signed in, the app saves a request history of what you sent and what came back, so you can reopen it later. We keep up to the 500 most recent entries per user and workspace; very large response bodies are truncated or left out. You can delete individual entries or clear your history at any time in the app.

Mock servers, monitors and published docs

• Mock servers. When someone calls one of your mock server URLs, we log the last 100 calls for that mock (method, path, query, status, the request headers and body, and timing) so you can inspect them. The values of Authorization, Cookie, X-Api-Key and Proxy-Authorization headers are replaced with [redacted] before they are stored.
• Monitors. When a monitor runs your collection on a schedule, we store the results of each run (we keep up to 200 runs per monitor), and we send alerts to the email addresses and webhook URL you configure.
• Published documentation. When you publish a collection's documentation, it becomes publicly readable at swastik.codes/docs/<slug>. Secret variables, credentials in auth settings and sensitive headers are blanked in the public copy, but the rest of the collection (descriptions, URLs, examples) is public. Unpublish it at any time.

Messages you send us

When you use the contact form we store your name, email address, optional company, the topic and your message, together with the IP address and user agent of the submission (to fight spam and abuse). The message is also emailed to our support inbox. When you email us directly, we keep the correspondence.

Server logs

Our servers keep technical logs, which include IP addresses, requested URLs, timestamps, response status codes and user agents. We use them to operate, secure and debug the service. Logs are rotated and deleted on a rolling basis. We count installer downloads per file and day; these counts hold no IP address or account.

Information stored on your device

The app stores data in your browser's local storage and IndexedDB: your session tokens (so you stay signed in), local workspaces (including the Scratch Pad, whose data stays on your device), open tabs, settings, the current values of variables, a cookie jar for the APIs you call, and, if you use it, your encrypted vault. This data stays on your device unless you sign in and choose to use a cloud workspace. Clearing your browser data removes it. See our cookie policy for details.

This marketing website itself sets no cookies and uses no analytics, advertising or tracking scripts.

How we use information

We use personal data to:

• create and secure your account, verify your email and reset your password;
• provide the service: sync your workspaces, send requests on your behalf, run collections, monitors, mocks and flows, and publish documentation you choose to publish;
• send you service emails, such as verification and password-reset links, team invitations, review requests, comment mentions and monitor alerts you configured;
• answer your messages and support requests;
• protect the service and its users: rate limiting, abuse prevention, blocking requests to private network addresses, and investigating security incidents;
• comply with legal obligations.

We do not sell personal data, we do not use it for advertising and we do not use the content of your workspaces to train machine-learning models.

Legal basis

Where data protection laws such as India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR apply, we process personal data because it is necessary to provide the service you asked for (performing our contract with you), for our legitimate interests in keeping the service secure and working, to comply with legal obligations, or, where required, with your consent, which you can withdraw at any time.

Who we share it with

We share personal data only as needed to run the service:

• GitHub, only if you choose to sign in with GitHub or connect GitHub: your browser is sent to GitHub to approve it, and for connected repositories our server calls GitHub's API with your token.
• Hosting and infrastructure. Our servers and database are operated on infrastructure we rent from hosting providers, who process data on our behalf.
• Email delivery. Service emails are sent through an SMTP email provider.
• Your team. Content in a team or public workspace is visible to its members (or, for public workspaces, to anyone with access), together with your name, email and avatar on comments, reviews and activity.
• APIs you call. Requests you send go to the destinations you choose.
• Legal reasons. We may disclose information if required by law or to protect the rights, safety and security of our users, the public or us.

If the business is ever reorganised or sold, data may transfer to the successor, who will remain bound by this policy.

Where data is stored

Account and workspace data is stored in a database on servers we operate. Our servers may be located outside your country. Where we transfer personal data internationally, we take steps to protect it as required by applicable law.

How long we keep it

• Account data: for as long as your account exists.
• Workspace content: until you or your workspace admins delete it. Deleted collections, environments, specs and flows move to the trash and are purged after 30 days.
• Request history: up to the 500 most recent entries per user and workspace, until you delete them.
• Mock call logs: the last 100 calls per mock. Monitor runs: the last 200 runs per monitor.
• Sessions: refresh tokens expire after 30 days of inactivity or when you sign out.
• Contact messages: as long as needed to handle your request and keep a record of it.
• Server logs: rotated and deleted on a rolling basis.

When you delete your account (Account settings → Security → Delete account) or ask us to, we delete your account data, linked sign-ins, sessions, API keys and the content of your personal workspaces, except where we must keep some information to meet legal obligations, resolve disputes or prevent abuse.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to nominate someone to exercise your rights. Many of these you can do yourself in the app: edit your name, change your password, review and sign out sessions, delete API keys, clear history, export collections and environments, and delete workspace content. You can delete your account yourself under Account settings → Security. For any other request, email support@swastik.codes from the address on your account. We will respond within the time required by law.

If you are not satisfied with our response, you can complain to your local data protection authority.

Security

We protect data with HTTPS, Argon2 password hashing, short-lived access tokens with rotating refresh tokens, role-based access to workspaces, rate limiting and network safeguards on requests our servers send for you. No system is perfectly secure; read more on our security page and tell us about any vulnerability you find.

Children

Swastik Codes is a tool for software developers and is not intended for children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy as the service changes. We will change the "Last updated" date above and, for significant changes, notify signed-in users by email or in the app.

Contact

Shwastik Tech Solutions Pvt Ltd, India. Email: support@swastik.codes. Phone: +91 76545 31678.