Governing language: The Simplified Chinese version is authoritative. This translation is provided for convenience.

Privacy Policy

Effective date: August 5, 2026

摇月 Swaymoon (“we,” “us,” or “our”) takes your privacy seriously. This policy explains how we collect, use, store, share, and protect personal information when providing 摇月 Swaymoon Account (the “Swaymoon Account” or “this Service”), and the rights you have. By using this Service, you represent that you understand this policy. Where we need additional consent, we will obtain it separately in the relevant context.

This policy is prepared in light of applicable requirements, including the Personal Information Protection Law of the People’s Republic of China. Where cross-border processing or users in the United Kingdom or the European Union are involved, we follow the stricter of UK GDPR / GDPR in principle.

1. Information We Process

1.1 Information you provide or that is generated at registration

• Account identifiers: phone number, email, username, and other sign-in identifiers
• Profile information: display name, avatar, and other profile details you set (if any)
• Security information: credential data related to two-factor authentication and passkeys you enable, and information necessary for recovery and verification
• Content you submit: such as descriptions in support requests and reasons for account deletion

1.2 Information generated while using the Service

• Sign-in and sessions: sign-in time, approximate device/client information, session identifiers, and the list of signed-in devices
• Authorization records: the scope of permissions you grant to third-party applications, time of consent, and similar data (the consent ledger)
• Hide My Email: alias addresses assigned when authorizing applications, enabled/disabled status, and the binding needed for forwarding (your real email is used for delivery and is not shown to third-party applications)
• Security and operations logs: logs necessary for abuse prevention, troubleshooting, and audit (minimized and access-controlled where feasible)

1.3 Content we do not actively collect

We will not require you to provide sensitive personal information unrelated to Swaymoon Account features. During forwarding, the email relay processes headers and content necessary for transmission, solely to complete Hide My Email forwarding that you have enabled; the body and attachments of relayed messages are deleted within seconds after forwarding is completed, and we do not retain email content long-term. See the Hide My Email guide for details.

2. Purposes of Processing and Legal Bases

We process personal information mainly to:

Where consent is required (for example, first agreeing to the Terms of Use and Privacy Policy, or authorizing a third party), we will give a clear prompt in the interface. Processing necessary to perform a contract, to comply with a legal obligation, or to protect vital lawful interests will be carried out in accordance with applicable law.

3. Sharing, Transfer, and Public Disclosure

We do not sell your personal information. We share or disclose it only in the following circumstances:

1. Third-party applications you authorize: within the permission scope you agree to, we provide necessary information to that application (for example identifiers, email or a Hide My Email alias, profile fields, and the like, as shown on the authorization page).
2. Processors: such as cloud infrastructure and SMS/email delivery providers, who may process data only on our instructions and for purposes necessary to provide the Service, and who assume corresponding confidentiality and security obligations.
3. Legal circumstances: pursuant to laws and regulations, litigation, or mandatory requirements of competent government authorities.
4. Business combination: in the event of a merger, division, or asset transfer, we will require the successor to remain bound by this policy and, where required, seek your consent again.

4. Cross-Border Processing and Storage

Personal information related to your Swaymoon Account (including account profile, sign-in identifiers, authorization and sessions, Hide My Email alias mappings, and the like) is processed and stored in Jiangsu, China. We protect data through access control, encryption, minimized transmission, and similar measures.

To provide globally accessible websites and APIs, static content or edge acceleration may be transmitted via overseas content delivery networks; this does not change the storage and processing location of the account data described above. Third-party channels such as SMS and email delivery receive contact information you submit or that is necessary for the business only to the extent required to provide the corresponding feature, and process it under their terms of service.

Retention is limited to what is necessary to achieve the purpose: while the account exists, we retain information necessary to provide the Service; after deletion is completed and the grace period has ended, we will delete or anonymize related personal information, except where laws and regulations require retention. Audit and security logs may be retained for a shorter period, or a longer period if required by law. Bodies and attachments of messages forwarded through the Hide My Email relay are deleted within seconds after forwarding is completed and are not within the scope of long-term retention.

5. Your Rights

Under applicable law, you generally have the right to:

• Access and copy: view account and authorization-related information on pages such as “Privacy” in Swaymoon Account
• Rectify and complete: update profile and sign-in identifiers (subject to verification and security policies)
• Delete and cancel: request account deletion; after the request, a grace period may apply, during which signing in again can cancel the request
• Withdraw consent: revoke authorization granted to third-party applications; disable Hide My Email aliases
• Export: request an export of account-related data (such as account information, authorized applications, sessions, and the consent ledger, as actually provided by the product)
• Constraint on automated decision-making: this Service does not use automated decision-making that has a material impact on your rights and interests as the sole basis for a decision

After signing in at passport.swaymoon.com, you may manage Hide My Email, third-party application authorizations, export, and account deletion on the “Privacy” page. When you exercise your rights, we may verify your identity.

6. Cookie and Local Storage

To maintain sign-in sessions, security protections, and basic preferences, we may use Cookie or similar technologies (including session Cookie). You may manage Cookie through your browser; disabling them may prevent sign-in or make some features unavailable.

7. Minors

If you are a minor, please read this policy and use this Service under the guidance of a guardian. We will not knowingly collect personal information of minors without guardian consent. If you become aware of such a situation, please contact us so we can address it.

8. Security Measures

We take technical and organizational measures commensurate with business risk, including encryption in transit and at rest, access control, key management, audit, and least-privilege authorization, to prevent unauthorized access, leakage, tampering, or loss of personal information. You should also fulfill your security obligations on the account and device side.

9. Policy Updates

We may update this policy and will publish the updated version and effective date on the documentation site. Material changes will be highlighted in a prominent manner. If an update requires consent to be obtained again, we will obtain your consent in the relevant context.

10. Contact Us

For requests or complaints related to personal information protection, email hello@swaymoon.com, or visit docs.swaymoon.com to read Contact Swaymoon and the latest information.