Privacy notice

Updated 6 November 2026. Short version: you can browse without an account, and browsing contacts no other company. If you sign up to claim a video or an idea, we store the minimum needed to keep claims to one per person, and you can delete it any time.

Who runs this site

Swipe Library is run by Theo (@theoxmotion on X). For questions or data requests, send a DM to @theoxmotion on X.

Browsing

Browsing needs no account, and this site sets no cookies while you browse. There are no ads, analytics, trackers, third-party scripts or third-party fonts. Our host, Cloudflare, processes your IP address to deliver the site and keep it secure.

Browsing loads nothing from third parties. The video covers come from this site: when we build the library we save a small cropped copy of each post's own cover picture and serve it from our own address, so YouTube, TikTok and Instagram aren't contacted while you browse.

The first 48 videos are open to everyone. To open the rest, we ask you to follow @theoxmotion on X. Tapping Follow opens X's own follow page in a new tab; we don't check whether you followed. Your browser remembers the tap in its local storage (swipe.follow: the time of the tap), so the wall stays open next time. It stays on your device and is never sent to us.

Claimed videos and their players

Before a claim, a video shows as a still and a breakdown. Once you claim a video, it unlocks for you: when you press play, the site loads that platform's own official player, either YouTube (in its privacy-enhanced mode, youtube-nocookie.com), TikTok or Instagram. That player comes from the platform, not from us. It may set its own cookies and process your data under the platform's privacy policy. Nothing loads from these platforms until a claimer presses play. Views count for the creator, and we don't copy or re-host anyone's video.

If a platform's player reports that a video is removed, private or not allowed to be embedded, your browser tells us the video's id so we can drop it from the library. That report holds no personal data. Repeat reports from the same connection are limited with a keyed hash of the IP address, deleted after 24 hours.

What we store when you sign up to claim

With X: your X user id and your handle. You sign in on X's own page. We ask X only for your basic profile (permissions users.read and tweet.read, plus your account's creation date, which we check and don't store). For the lucky wheel we also ask X whether you follow @theoxmotion: at sign-in while you have a spin and no confirmed follow, or when you press "Check it with X". If you do, we store that yes and when X confirmed it. We don't keep your X tokens, never see your password, and can't post, like or follow anything for you.
With a phone number (when this option is open): a one-way keyed hash of your number, used only to make sure each number claims once. We never store the number itself. The text message code is sent and checked by our SMS provider, Twilio, which receives your number to do that.
Your claims: which idea and which video you claimed, and when. A claimed video or idea shows as claimed to everyone else, without your name.
The lucky wheel (X accounts): how many spins you have and have used, the extra claims you won, and for each spin its time, the site's secret number (kept hidden until that spin, then shown to you), your browser's random number and the result, so you can re-check every spin.
Your consent: the time you ticked the box agreeing to this notice.
Your session: one cookie (sid, HttpOnly, 30 days) holding a random token. We store only a hash of the token.
Abuse limits: keyed hashes of IP addresses and phone numbers with a timestamp, used to limit sign-in attempts, text messages and claims. They are deleted after 24 hours.

Why, and on what basis

We use this data to keep claims to one per person (plus what you win on the wheel) and to stop abuse, nothing else. The legal basis is your consent (GDPR Art. 6(1)(a)) for the account, the claim, the wheel and its follow check. For the short-lived abuse-limit records it is our legitimate interest in keeping the site working (Art. 6(1)(f)). We don't sell or share your data, and we don't send you messages.

Who else handles it

Cloudflare hosts the site and the database. The database is in the EU. X handles your sign-in if you use X, and Twilio sends the code if you use a phone number. YouTube, TikTok and Instagram serve their own players when someone who claimed a video presses play. We fetched the cover pictures from them once, when building the library, without any visitor data. These providers may process data outside the EU under their standard contractual clauses.

How long we keep it

Your account, claims and wheel spins stay until you delete them. A session ends after 30 days or when you sign out. Abuse-limit records are deleted after 24 hours.

Your rights

To delete everything at once, open your account (top right) and press Delete my data. Your account, session, claims, wheel spins and follow check are removed straight away, and the videos and the idea become available again. You can also ask for a copy of your data or a correction by DM. Withdrawing consent works the same way as deleting. If you think we've handled your data wrongly, you can complain to your local data protection authority.

Other people's videos

Videos in the library play only in their platform's own player, for the person who claimed them, and link to the original post on TikTok, Instagram or YouTube. Nothing is copied or re-hosted here, and the view counts are public numbers read on the date shown. If you run a page that's listed and want it removed, DM @theoxmotion and it will be taken out.