Public Builder Privacy Policy

Last Updated: December 16, 2025

🛡️ No Sign-In Required • Anonymous Use • Ephemeral Data

1. Introduction & Anonymous Use

Welcome to public.swaplab.net (the "Public Service"), a specialized build engine operated by SwapLab. This service is designed for rapid prototyping, testing, and debugging without the need for user accounts or authentication.

Zero-Knowledge Identity: We do not know who you are. We do not collect your name, email address, GitHub credentials, or payment information on this specific service. You are identified solely by a temporary, random "Guest ID" generated by your browser.

By uploading a file to this Public Service, you agree to this Privacy Policy. If you need a signed release version, please use our Private Builder instead.

2. Information We Collect (And Don't Collect)

A. No Personal Information

Unlike our main service, this Public Builder does not collect:

  • ❌ No Names or Email Addresses.
  • ❌ No GitHub OAuth Tokens or Passwords.
  • ❌ No Credit Card or Payment Information.

B. Technical Data (What We DO Collect)

To operate the build engine securely, we process:

  • Project Files (Temporary): The .zip file you upload containing your source code.
    (Retention: Deleted immediately after extraction. See Section 3).
  • Network Logs: Your IP address is logged temporarily for rate-limiting purposes (to prevent abuse/DDoS) and security monitoring.
  • Browser Guest ID: A random string (e.g., `guest-123xyz`) stored in your browser's local storage to track the progress of your active build. This ID is not linked to any real-world identity.

3. Data Lifecycle: "Ephemeral by Design"

This service operates on a strictly ephemeral (short-lived) basis. We do not want your data. Once the job is done, the data is gone.

Phase 1: Input Data (Your Source Code)
  • Upload: Your .zip file is uploaded to a secure, encrypted storage bucket (Cloudflare R2) via a pre-signed URL.
  • Extraction & Deletion: The moment our build server receives the file, it extracts the contents into a temporary memory space. The original uploaded .zip file is instantly and permanently deleted from storage.
Phase 2: Build Environment (Docker)
  • Isolation: Your code is compiled inside a fresh, isolated Docker container.
  • Destruction: Once the build finishes (success or fail), the entire container is destroyed. No residual code remains on our build servers.
Phase 3: Output Data (Your APK)
  • Artifact Storage: The final build artifact (e.g., debug.apk) is uploaded to Cloudflare R2 solely to generate a download link.
  • Strict 1-Hour Expiry: We enforce an automated lifecycle rule that permanently deletes all artifacts after 60 minutes. If you do not download your file within this window, it is lost forever.

4. Transparency & The Public Repository

To build trust in an anonymous service, we operate with a "transparency first" model.

Important: Public Build Infrastructure

Your builds are orchestrated through a Public GitHub Repository (public-build-swaplab-engine). This allows anyone to audit our build scripts (`.yml`) to verify that we are not injecting malicious code.

What this means for you:

  • Metadata Visibility: The fact that a build is running (and its status) might be visible in the public GitHub Actions tab.
  • Log Privacy (Masked): We have configured our build runners to be "Silent." The detailed logs (which might contain file names) are NOT printed to the public GitHub console. They are streamed securely via WebSocket only to your browser session.
  • Recommendation: Do not include highly sensitive secrets (like API keys for production banking services) in the `config.xml` or source code you upload to this public tool, just as a precaution.

5. Security Scanning

Just because it's anonymous doesn't mean it's unsafe. We apply the same rigorous security standards as our premium service.

  • Malware Scan: Every uploaded project is scanned before processing. If malware is detected, the build is rejected immediately.
  • Dependency Audit: We run `npm audit` and `Trivy` to check for known vulnerabilities in your dependencies.
  • Static Analysis: We run `Semgrep` to detect potentially dangerous code patterns.

Note: Aggregated, anonymized statistics about vulnerabilities found (e.g., "10 Critical CVEs found today") are displayed on our public Security Dashboard, but never linked to your specific project or IP.

6. Limitations & Liability

AS-IS SERVICE: This Public Builder is provided "AS IS" and "AS AVAILABLE" without any warranties.

  • We are not responsible for any data loss resulting from the 1-hour auto-deletion policy.
  • We do not guarantee the successful compilation of every project uploaded.
  • Use of this service for illegal purposes, hosting malware, or mining cryptocurrency is strictly prohibited and will result in an immediate IP ban.

7. Contact

Since we do not collect email addresses for this service, we cannot proactively contact you. If you have privacy concerns regarding a specific build, you must provide the Build ID (e.g., `pub-xxxx`) available in your browser logs.

Email: swaplab.help@gmail.com