KeySwap is a small site run by Oliwia, one person, for free. This explains exactly what it stores about you, who else can see it, and how to delete all of it.
From Steam, when you sign in. Your Steam ID, display name and avatar, and — if your Steam profile is public — the date you joined Steam. If your profile is private, that date is simply missing; KeySwap cannot see it and does not try.
When you answered the age question. The first time you sign in, KeySwap asks your date of birth, to check you are old enough to use it. Your date of birth is not stored — only the date you answered. If you are too young, your account is removed and nothing about the answer is kept.
How many games you own is recorded when you import your library, because it is simply the size of the list you imported. Your Steam level and playtime are shown on a profile page when Steam is asked for them as the page loads — they are not stored.
The lists you build. The games in your library and on your want list, and the spare keys you list. You choose what goes in these, either by importing from Steam or by typing them in.
Key codes, encrypted. A key you add — Steam or GOG — is encrypted before it is stored and is only ever decrypted for the person you traded it to, on the trade page. It is never shown to anyone else and never put in an email. Beside it KeySwap keeps a one-way fingerprint of the code, so that the same code cannot be listed twice by mistake; the code cannot be worked out from the fingerprint. It also notes whether the code looked like that store’s codes when you saved it — a yes or no, never the code itself.
Backups. KeySwap’s host keeps no automatic copies, so the moderator can download one by hand to keep your data from being lost. That copy holds the same rows described here, and key codes stay encrypted inside it — nothing in the file can reveal a key on its own. Three things are left out of it on purpose: the devices notifications go to, who you follow, and the notifications in your bell.
Your trades. Who traded what with whom, when, and how it ended.
Your email address, only if you give one. It is optional. It is used to tell you about your own trades and, if you leave that switch on, when someone lists a game on your want list — nothing else: no newsletters, no marketing, and it is never given to anyone. Each kind has its own switch on your Profile tab.
Notifications, only if you turn them on. For each phone or computer you turn them on for, KeySwap keeps the address your browser gave it for delivering them and two keys to encrypt them with — nothing about the device itself. That is removed when you turn notifications off on that device, sign out there, or delete your account, and it is not included in backups. Each device also keeps your on-or-off choice for the optional kinds. A notification never contains a key code.
Your notifications. Everything KeySwap tells you — an offer, an accepted swap, an offer withdrawn or declined, a game you want or someone you follow listing something, a failed trade — is also kept in the bell at the top of each page, so you can read it there even with emails and phone notifications off. Only you see yours. Each is the same short text the notification carries, never a key code, and is deleted after 90 days, or with your account. They are not included in backups.
Who you follow. If you follow someone, KeySwap keeps that you follow them and since when, so their new listings can be shown on your dashboard and, if you turn it on for a device, sent to it as a notification. Only you can see who you follow: the person is not told, and nothing anywhere shows how many followers anyone has. It is removed when you unfollow them, or when either of you deletes your account.
Your numbers. Your Profile tab shows you how many keys you have listed, swaps you have completed, games you got from them, and an estimate of what those games would cost on Steam. They are counted from your listings and trades each time — nothing extra is kept about you — and only you see them. Everyone sees the same totals for the whole site, which name nobody. The estimate uses each game’s public price on Steam’s euro store, which KeySwap asks Steam for about the game, not about you.
Your level, achievements and seasonal challenges. Your KeySwap level comes from the swaps you have completed (100 XP each) and the badges you have earned, and is worked out each time, not stored. When you reach a milestone — your first listing, your first swap, a swap for a game you wanted, games people want, a clean record, or one of the season’s challenges — KeySwap keeps which one and when, and tells you in your notifications. To count a season, KeySwap notes when each swap ended. Your level and the achievements you have earned are shown on your profile to anyone signed in. You can hide all of it on your Profile tab: then nobody, you included, sees your level, badges or challenges, and they send no notices, but what you earn is still kept so that showing them again brings it back. They are deleted with your account, and they are included in backups.
Invitations. Your Profile tab has an invite link. If someone joins KeySwap through it, KeySwap notes that you invited them, so you can earn an achievement once they complete a swap. You see only how many people joined through your link and how many have swapped — never who. The note is kept with their account; if you delete yours, it is cleared, and if they delete theirs, it goes with it. The link carries your account’s id, the same one in your profile’s address, and nothing else.
Game pages are public. A game’s page on KeySwap can be opened without signing in — by somebody you send the link to, by a link preview in Discord, Reddit or a similar site, and by search engines such as Google, which may list it. Signed out, the page shows only the game (its name and Steam’s picture) and numbers: how many keys are on offer, how many of them are GOG codes, how many people want it and how many swaps of it have been completed. It shows nothing about any person or listing — who is offering a key is what signing in shows. Only games Steam recognises have a public page. Everything else on KeySwap, including profiles, lists and trades, still needs you to sign in.
Reports. If you report someone, the report is kept along with who filed it, so the same trade cannot be reported twice and repeated problems can be seen. Until a moderator dismisses it, a report lowers the trust score of the person it is about (see below), which shows how many such reports there are but never who filed them or what they said.
Suspensions and appeals. If your account is suspended, KeySwap keeps until when and why — the reason a moderator gave, or the number of failed trades that triggered it. Other signed-in people can see that the account is suspended, but only you and moderators see why. If you appeal, KeySwap keeps what you wrote, what you were appealing, the moderator’s decision and their reply, for as long as your account exists, so the same thing is not decided twice.
Your trust score. Worked out each time it is shown from things KeySwap already keeps: your Steam account’s age, your completed and failed trades, how many trades the other person marked complete, and how many reports about you a moderator has not dismissed. Nothing extra is collected for it. Moderators also see a list of accounts whose record is worth a look — for example a brand-new Steam account already trading, or more failed trades than completed ones — made from the same things. Being on it changes nothing by itself; a person decides.
When codes do not work. If you mark a trade failed, KeySwap keeps what you chose went wrong. When people you have traded with say your codes did not work — or several codes you listed did not look like real ones — a moderator is sent an email naming your account and those trades, so they can look into it. It never contains a key code.
Counts that stop floods. To stop scripts hammering the site, KeySwap counts how often something has been done in the last few minutes — signing in, making offers, changing listings and the like. When you sign in nobody is known yet, so that count is kept against your network address, but only as a scrambled code made with a secret key, which cannot be turned back into the address. The counts hold nothing else, and are cleared away once the period they count over has passed — from a minute to a week, depending on what they count.
Which days you used KeySwap. So moderators can see how many people use the site each day, KeySwap notes the days your account was signed in and looked at a page — one line per day, nothing about what you did. Each line is deleted after 90 days, and all of them go when your account does. Visits to the sign-in page are counted too, as a number per day with no account, address or device attached. So each visitor counts once a day, the scrambled code of your network address described under “Counts that stop floods” is kept for that day.
What moderators do. When a moderator suspends someone, lifts a suspension, decides a report or an appeal, clears a fault, settles a disputed trade or takes a backup, KeySwap keeps a record of who did it, when, to which account or trade, and the reason they gave. It is kept so that what moderators do can be checked, and nobody can change it. If the account it concerns is deleted, the record stays but is no longer linked to it.
When something goes wrong. If the site fails to answer properly or a trade action cannot be completed, KeySwap notes which kind of page it was, when, and a short description of the error, with account and trade identifiers, key codes, email addresses and anything in quotation marks taken out first. These notes name nobody and are deleted after 30 days.
All three of your lists are visible to other signed-in users — your spare keys, your want list, and your library. That is the point of the site: matching you with someone depends on both of you seeing what the other has and wants, and your library is what stops people offering you games you already own. Your name, avatar, Steam join date, trade record, trust score and what it is made of, and taste tags are visible on your profile too.
Your key codes and your email address are not. A key is shown only to the person who traded for it. An email address is never shown to anyone, ever. Nor is where you got a key — the shop you pick when you list one is there to help you find the code later, and only you see it. Nor are who you follow and your own numbers on your Profile tab.
Somebody not signed in sees no person at all. A game’s public page counts the keys on offer and the people who want it; it never says whose they are.
To run the thing you signed up for: matching you with trades, letting you carry one out, and keeping a record of what happened. Beyond that, report and trade history are kept to spot people who take keys without giving any — which protects everyone else using the site.
The database is in the EU (Paris). The site itself runs on Vercel and email goes through Resend, both of which are US companies, so some of your data is handled outside the UK and EU. Both carry the standard contractual clauses that exist to cover exactly that.
If you turn notifications on, they are carried by the company that made your browser — Google, Mozilla, Apple or Microsoft — encrypted so that it cannot read them.
Steam is the exception worth naming separately: signing in with Steam means Valve, in the US, handles that sign-in. That is unavoidable — it is how you log in.
Nobody else. Your data is not sold, rented, or shared with advertisers, and there are no advertisers.
KeySwap counts page visits with Vercel Web Analytics, from the company that already runs the site. It records which page was opened, which site the visitor came from, their country, and their kind of device and browser. It sets no cookies and stores nothing on your device. Visitors are told apart only for a day, by a code that is thrown away after 24 hours, so nobody can be followed from one day to the next or onto other websites.
Before a visit is counted, KeySwap cuts out the parts of a page’s address that could point at a person: which trade or which profile it was, and everything after a “?” or “#”. What is left is the kind of page, such as “a trade page”.
There are no advertising pixels and no other third-party scripts. The only cookie KeySwap sets is the one that keeps you signed in, which is why there is no cookie banner.
Until you delete your account. Doing that removes your profile, your lists, your spare keys and any key codes you had stored, immediately and permanently.
Trades you were part of are kept, with your name removed from them. Someone you traded with keeps their own record of what they gave and received — that record is partly theirs, and erasing it would take away their history along with yours.
Reports split the same way. A report about you goes when you do. A report you filed about someone else stays, without your name on it, because it is what warns the next person who trades with them. Your appeals go with your account.
One exception, and only if your account is suspended when you delete it. KeySwap keeps a single line recording that your Steam account is suspended and until when — no name, no email, no lists, nothing else. Without it, deleting and signing up again would take seconds and would be a way around every suspension, which would make the whole thing pointless for the people it protects. That line is removed once the suspension runs out. Delete an account in good standing and nothing at all is kept.
On your Profile tab, at the bottom. It happens straight away and cannot be undone.
The one time it is refused is while a trade of yours is still running — you cannot disappear holding someone else’s key. Finish or cancel the trade, then delete.
If you are in the UK or EU, you have the right to see what is held about you, correct it, delete it, or object to it being held. Deleting is the button above.For anything else, write to admin@key-swap.app and you will get an answer.
You also have the right to complain to your data protection regulator — in the UK that is the Information Commissioner’s Office.
If this changes in a way that matters, the date at the top changes. KeySwap will not quietly start collecting something this page does not mention.
KeySwap is run by Oliwia, as an individual rather than a company. That means she decides what this site holds and why — so she is the person data protection law calls the controller, and the person to take it up with.
There is no office to write to: this is a hobby project run from home and out of her own pocket, so the address below is how to reach her. If that ever changes — if KeySwap becomes a company — this page says so before it does.
admin@key-swap.app