Private Builder Privacy Policy & Terms

1. The "Digital Bridge" & Authentication

Welcome to private.swaplab.net. Unlike our public builder, this service is designed to work directly with your own private repositories. In this workflow, SwapLab acts strictly as a Digital Bridge (Trigger) to orchestrate builds on your own GitHub Action runners.

                    You are always in control:
                    Because this service integrates with your private repositories, GitHub Sign-In is required to authenticate the connection. However, you maintain absolute control over this access. You can securely Sign Out or permanently Revoke Access directly from your Account Settings UI at any time.
                

2. Repository Security & Ephemeral Metadata

A. Private Repository Requirement

The Target Action Repository URL provided in our UI must be a private repository. It must contain the required workflow configurations (e.g., .github/workflows/swaplab-workflow-cache.yml). If you attempt to link a public repository, the system will automatically reject the request.

B. Keystore Injection (RAM-Only Processing)

When you compile a Release build (APK/AAB), your base64-encoded keystore must be securely stored as a KEYSTORE_BASE64 secret inside your GitHub repository. The additional keystore metadata (passwords and alias) entered in our UI is handled with extreme security:

Just-In-Time (JIT) Injection: Keystore metadata is encrypted during transit and injected strictly at the final step—right before Gradle compilation begins—ensuring it safely bypasses initial security validations like Semgrep (SAST) and Trivy (SCA).
Strictly in RAM: The credentials are set as environment variables (e.g., android.injected.signing.store.password) and processed entirely in RAM. They are never written to disk.
Instant Destruction: Once the Gradle job completes, whether successful or failed, the environment is torn down and all memory is immediately purged.

3. Absolute Infrastructure Isolation

To guarantee the highest level of privacy and security, the provider, backend, and server infrastructure for private.swaplab.net are completely separated from our anonymous public service (public.swaplab.net).

For instance, they operate on entirely different cloud providers (e.g., one on Hetzner, the other on Contabo) to ensure that the environment handling authenticated user workflows never crosses paths with public or anonymous workloads.

4. GitHub Usage, Quotas & Performance

Because SwapLab triggers workflows on your own connected repository, the build process consumes your personal or organizational GitHub Actions minutes.

A. GitHub Terms & Quota Abuse

Warning on Abuse & Quota Gaming: You are fully responsible for complying with the GitHub Terms of Service. Do not attempt to game the free quota system (e.g., creating mass fake accounts for extra minutes). GitHub employs advanced detection and will issue mass suspensions and account terminations without notice for such violations.

B. Pro Tip: Self-Hosted Runners for Faster Builds

Release builds (compiling APKs/AABs) are highly resource-intensive. Standard, free GitHub-hosted runners may take a significantly longer time to complete these tasks compared to debug builds.

💡 Need faster compilation? You have the option to configure Self-Hosted Runners on your GitHub repository. By using your own VPS (Virtual Private Server) equipped with higher RAM and CPU specifications, you can drastically reduce your build wait times.

5. Fair Use, Anti-Abuse & Free Community Model

SwapLab is built by developers, for developers. We operate under a strict, non-profit community model.

100% Free Forever: We do not sell anything, we do not take a profit, and we do not offer any paid or premium tiers. Both our public and private services are completely free.
"As-Is" Resources: Because this is a free community service, the hardware resources (RAM/CPU/Bandwidth) supporting our triggering engines are limited. They are provided strictly on an "as is" and "as available" basis.
Strict Anti-Abuse Policy: You may not overload our infrastructure. This includes DDoS attacks, malicious spamming, or attempting to trigger a massive amount of concurrent builds at the same time. Actions that force our servers to work excessively hard for a single user—thereby degrading the experience for others—will not be tolerated. We reserve the right to instantly block or ban any user, IP, or connected GitHub account that abuses the service, without prior notice.

6. App Store Compliance & Limitation of Liability

We provide the engine; you provide the code. You retain full ownership and legal responsibility for the source code and compiled assets generated through this service.

Policy Compliance: You are solely responsible for ensuring that your application complies with the Google Play Developer Content Policy and any other relevant app store guidelines.
No Guarantee of Approval: We do not guarantee that any APK or AAB generated by our service will be approved, published, or maintained by Google Play or any other app store.
No Liability for Actions Taken by App Stores: App rejections, policy strikes, app suspensions, or developer account terminations are enforced strictly at the discretion of the respective app store reviewers. SwapLab is not liable for any damages, loss of revenue, or business interruption resulting from such actions.

7. Children's Privacy (COPPA Compliance)

Our services are designed for developers and professionals. We do not knowingly collect, maintain, or use personal information from children under the age of 13. If we learn that we have collected the personal information of a child under 13, we will take steps to delete the information as quickly as possible.

8. Contact

If you have any questions or concerns regarding your privacy, security, or this policy, please contact us at:

Email: swaplab.help@gmail.com