Privacy Policy
Last updated: 1 November 2026
SwiftDrop is a university software engineering project: a courier and parcel delivery system. This policy
explains what the SwiftDrop sign-in service (auth.getswiftdrop.me) stores about you, why, and
for how long. We collect only what sign-in needs.
What we store
- Account details: your email address, your display name, and your roles (for example customer, courier, merchant).
- Password: never stored as text. We store only a one-way Argon2id hash, which cannot be turned back into your password.
- Sign in with Google: your Google account's identifier, email address and name, which Google shares with us when you choose to sign in with Google. We never receive your Google password.
- Sessions: a fingerprint (hash) of your sign-in session token, with its creation and expiry times, so you stay signed in and can sign out on every device.
- Security records: the number and time of recent failed sign-in attempts on your account, used to lock out password guessing. They are forgotten after one hour without failures.
- Merchants only: the business name and registration number you submit when applying for a merchant account.
Technical data
- IP address: used briefly to limit how many sign-in requests one network can make per minute (protection against attacks). These counters delete themselves within minutes. Your IP address may also appear in short-lived server logs used to investigate faults and attacks.
- Cookies: one cookie,
SWIFTDROP_LOGIN, only during a Google sign-in. It lasts at most 5 minutes and is needed for the sign-in to work securely. We use no advertising or tracking cookies.
Why we use it
To create and protect your account, to sign you in to SwiftDrop, to send you account emails (such as confirming your email address), and to stop attacks such as password guessing.
Who we share it with
We do not sell your data and do not use it for advertising. Other SwiftDrop components receive only what they need to know who is signed in (your account identifier and roles). Our service runs on Oracle Cloud Infrastructure; Google is involved only if you choose "Sign in with Google".
How long we keep it
Account data is kept while your account exists. Session records end when you sign out or when the session expires (at most 7 days). Rate-limit counters last minutes; failed-attempt counters are forgotten after an hour.
Security
All connections use HTTPS. Passwords are hashed with Argon2id, connections to our database and cache are encrypted, and access to stored data is limited to the sign-in service.
Your choices
You can ask us to show you, correct, or delete your account data at any time by email. Because SwiftDrop is a university project, the service may be shut down after the project ends; all data is then deleted.