Privacy policy

Last updated: 13 August 2026

This policy explains how OohWhat (“we”, “us”) handles personal information when you use oohwhat.co.uk or join a swap. It is written for UK GDPR. Our Terms of use and Safety & trust pages sit alongside it.

Controller: OohWhat, United Kingdom. Contact info@oohwhat.co.uk.

1. Information we collect

Depending on how you use OohWhat, we may collect:

• Account: name, email, and sign-in details from Google (or another login we offer)
• Profile: display name, bio, craft tags, optional Instagram / TikTok / shop / website links
• Delivery: recipient name, UK address, and any delivery notes you give us
• Swap applications: item photos and descriptions, materials, estimated value, preferences, answers to survey questions, and whether you can be a backup sender
• Swap activity: interest, approval status, matches, packed/sent/received updates, postage service, tracking or reference numbers, ratings and reviews
• Messages with us: emails you send to info@oohwhat.co.uk
• Technical: basic device and log data needed to run and secure the site (for example IP address, browser type, pages requested)

We do not ask for payment card details on OohWhat. Postage is paid to your chosen postal service. Optional Ko-fi donations are handled by Ko-fi, not by us.

2. How we use it

We use personal information to:

• create and look after your account
• run swaps: interest, applications, review, matching, shipping updates, reveal, and reviews
• show your match the delivery details they need to post to you
• email you about your account, your swap, reminders, and (if you opt in) updates or marketing
• keep the community safer and deal with disputes or missed sends
• improve OohWhat and keep the site secure
• comply with the law

3. Legal bases

Under UK GDPR we rely on:

• Contract: to provide the swap you asked to join (account, application, matching, addresses, journey emails)
• Legitimate interests: to run and protect a small community platform, prevent abuse, and understand how the site is used — balanced against your rights
• Consent: where we ask for it, including optional marketing emails. You can turn those off in Settings or by emailing us
• Legal obligation: if we must keep or disclose information for the law

4. Addresses and other sensitive swap details

Your delivery address is never shown on a public profile. After matching, only the person assigned to send your parcel (and OohWhat admins who need it to run the swap) can see the delivery name and address.

Senders must use that information solely to complete the exchange. They must not publish it, copy it for other uses, or contact you outside OohWhat except as we allow.

Tracking numbers should be entered in OohWhat, not posted publicly. Item photos are used to review your application and run the swap; they are not a public shop listing.

5. Who we share information with

We share information only as needed:

• Your matched sender: delivery name and address (and any note needed for posting)
• After reveal: if you added public social or shop links, your recipient may see those so they can thank you or find your work
• Service providers: hosting, database, authentication (for example Google sign-in), and email delivery. They process data on our instructions
• The law: if we are required to disclose information, or to protect someone's safety or rights

We do not sell your personal information. We do not share addresses with advertisers.

6. Emails and preferences

We send emails that are part of the service (sign-in, interest, application, matching, reminders to post or review). You can choose whether to receive optional swap updates, reminders, or marketing in Settings.

7. Cookies and similar tech

We use cookies and similar storage that are necessary to sign you in and keep the site working (for example session cookies from our auth provider). We do not currently use advertising cookies. If we add analytics later, we will update this policy and, where required, ask before non-essential cookies are set.

8. How long we keep information

We keep account and swap records for as long as needed to run OohWhat, handle “someone didn't send” issues, and keep a fair history of participation. If you ask us to delete your account, we will erase or anonymise what we reasonably can, unless we need to keep something longer (for example to resolve a dispute or meet a legal duty).

9. International transfers

Some providers (hosting, auth, email) may process data outside the UK. Where that happens, we use providers who offer an appropriate safeguard recognised under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

10. Your rights

You can ask us to:

• access the personal information we hold about you
• correct inaccurate information
• delete information (in some cases)
• restrict or object to certain processing
• receive a copy in a portable format (in some cases)
• withdraw consent where we rely on consent

Email info@oohwhat.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO).

You can update much of your profile, address, and notification preferences yourself in your account.

11. Children

OohWhat is for adults aged 18+. We do not knowingly collect personal information from children. If you think a child has created an account, please tell us and we will delete it.

12. Changes

We may update this policy. The “last updated” date will change. If the change is material, we will try to email the address on your account.

13. Contact

Privacy questions: info@oohwhat.co.uk. Full contact details: Contact us.