> ## Documentation Index > Fetch the complete documentation index at: https://security.tryswell.co/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy > How San Gregorio Labs Inc. collects, uses, discloses, and retains information when you use Swell. **Effective date:** July 14, 2026\ **Contact:** [hello@tryswell.co](mailto:hello@tryswell.co) This Privacy Policy was last substantively revised July 14, 2026, to reflect current architecture. Our [Terms of Service](/terms) (effective June 15, 2026) have not required changes since initial publication. San Gregorio Labs Inc. ("Swell," "we," "us," or "our") operates the Swell macOS application and related services available at tryswell.co (the "Service"). This Privacy Policy describes how we collect, use, disclose, and retain information when you use the Service. By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service. ## 1. Information we collect ### Account information When you sign in with Google via WorkOS, we receive your email address and a user identifier from our authentication provider. We do not collect or store your password directly. The sign-in screen links to our Terms of Service and Privacy Policy before authentication. ### Audio and transcription data When you start a coaching session, the app captures microphone and system audio only after you grant macOS permissions. Audio is streamed in real time to Swell's coaching relay over an encrypted WebSocket. Our servers send audio to our speech-to-text provider (Deepgram) for transcription. The Mac app does not connect directly to Deepgram or hold speech-to-text credentials. We do not store raw audio recordings. ### Transcript and coaching data We store transcript text, coaching suggestions, session identifiers, and related metadata to provide the Service. This content is automatically deleted after 24 hours unless we notify you of a different retention period. ### Profile preferences You may optionally save preferences such as sales framework settings associated with your account. ### Diagnostic and technical data * Crash and error reports: If enabled, we collect diagnostics via Sentry from the Mac app and from Swell's web API and coaching relay. We configure the SDK with default PII collection disabled and scrub sensitive fields before upload. * Logs and metadata: We collect timestamps, app version, API request metadata, and similar technical data for security, debugging, and rate limiting. We do not use cookies or cross-app tracking in the macOS application. Sign-in occurs in your web browser via WorkOS. ## 2. How we use information We use information to: * Provide real-time transcription and coaching * Authenticate you and maintain your account * Operate, secure, and improve the Service * Enforce rate limits and prevent abuse * Respond to support and privacy requests * Comply with legal obligations ### AI processing Coaching features use third-party AI services to analyze transcript text and generate suggestions. We use these services to provide the Service, not to build public models from your call content. We do not use your call transcripts to train Swell's own models. The two server-side AI paths differ: * **Brain (Claude, via Vercel AI Gateway)**. Every Brain request sets `zeroDataRetention: true` on the AI Gateway call (enforced in application code). * **Ear (OpenAI Realtime)**. Connects directly to the OpenAI Realtime API (not via AI Gateway). Per [OpenAI's API data controls](https://developers.openai.com/api/docs/guides/your-data), data sent to the API, including `/v1/realtime`, is **not used to train or improve OpenAI models**. On Swell's standard account (no Zero Data Retention approval), OpenAI may retain Realtime session content in abuse-monitoring logs for up to **30 days**; application state is not persisted by OpenAI for this endpoint. Application code sets `tracing: null` to exclude Ear sessions from the OpenAI Traces dashboard; this does not disable abuse-monitoring log retention. Review your subprocessors' terms and our API configuration periodically; update this policy if our practices change. ## 3. How we share information We share information with service providers that help us operate the Service: | Provider | Role | | ----------------- | ----------------------------------------------------- | | WorkOS | Authentication | | Deepgram | Speech-to-text | | OpenAI | Real-time coaching analysis ("Ear") | | Vercel AI Gateway | LLM request routing for Brain suggestions | | Anthropic | Coaching suggestion generation ("Brain") | | Convex | Database | | Vercel | API hosting | | Railway | Real-time coaching infrastructure | | Sentry | Crash and error reporting (Mac, web API, coach-relay) | | Upstash | Rate limiting (request metadata) | See our [Subprocessor list](/subprocessors) for security documentation links. We may also disclose information: * To comply with law, regulation, legal process, or governmental request * To protect the rights, safety, and security of Swell, our users, or others * In connection with a merger, acquisition, or sale of assets (with notice where required) We do not sell your personal information. ## 4. Data retention | Category | Retention period | | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Transcripts and coaching content (live application data) | 24 hours, then automatic purge | | Convex platform backups | **Not enabled** on production. Manual backups, if taken, follow Convex defaults (up to 7 days manual/daily; up to 14 days weekly). | | Vercel runtime logs (API) | **1 day** (Pro plan) | | Railway runtime logs (coach-relay) | **7 days** (Hobby plan) | | Account and profile data | Until deletion requested | | Diagnostic data | Per provider defaults (typically 30-90 days) | You may request deletion of account data by contacting [hello@tryswell.co](mailto:hello@tryswell.co). ## 5. Security We implement technical and organizational measures including: * TLS encryption for data in transit * Authenticated API access (WorkOS JWT) * User-scoped database reads bound to the authenticated JWT * Server-only database writes gated by per-service sync secrets * Third-party AI and speech-to-text credentials stored server-side only * Automatic transcript purging (hourly cron; default 24 hours) * Keychain storage for local auth tokens * Production logs avoid transcript text, tokens, and full user identifiers No method of transmission or storage is completely secure. See our [Security Overview](/) for technical details. ### Security incident notification **Needs founder/counsel sign-off before merge.** This clause is a new legal commitment. If we confirm unauthorized access to personal information or call content involving Swell systems, we will notify affected customers without undue delay and, where required by law, within **72 hours** of confirmation. Notifications will describe what happened, what data was involved, and steps we are taking. Contact [hello@tryswell.co](mailto:hello@tryswell.co) with security concerns. ## 6. Your choices and rights ### Permissions You can revoke microphone or system audio access in System Settings, Privacy and Security, on your Mac. Revoking permissions prevents coaching sessions from functioning. ### Access, correction, and deletion Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. To exercise these rights, email [hello@tryswell.co](mailto:hello@tryswell.co) from the address associated with your account. We will respond within 30 days. ### California residents (CCPA / CPRA) We do not sell personal information. California residents may request disclosure of categories collected, deletion, or correction as described above. ### EEA / UK residents (GDPR) Legal bases for processing include: * Contract: providing the Service you requested * Legitimate interests: security, fraud prevention, and product improvement * Consent: macOS audio permissions (where applicable) You may lodge a complaint with your local supervisory authority. ## 7. International transfers We and our subprocessors may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses made available by subprocessors or contractual commitments. ## 8. Children's privacy The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. Contact [hello@tryswell.co](mailto:hello@tryswell.co) if you believe we have collected a child's information. ## 9. Changes to this policy We may update this Privacy Policy from time to time. We will post the revised version with a new effective date. Material changes may be communicated through the app or by email. ## 10. Contact us San Gregorio Labs Inc. Email: [hello@tryswell.co](mailto:hello@tryswell.co) Address: 2 Wall Place Suite C, San Francisco, CA 94109