Privacy Policy

SWAVE · Last updated: 2026-08-03

This Privacy Policy explains what information SWAVE ("we", "us", "our" — ARTSTRIO GAMES PTE. LTD. ) collects when you use the SWAVE mobile app (the "App"), why we collect it, and how you can control it. By using the App you agree to the practices described here.

1. Information We Collect

1.1 Account information

When you register or sign in, we collect your email address through our authentication provider, Supabase Auth. You can sign up with an email and password, or sign in with Google or with Apple — in those cases the provider returns your email address and a stable user identifier to us. We never receive your Google or Apple password.

Your account record also stores an optional display name and avatar image if you set one, plus the account creation and update timestamps.

1.2 App usage data

To provide core features, we store, linked to your account:

Watch progress — which episodes you have watched, the playback position in seconds, and whether an episode was finished, so playback can resume where you left off on any device.
Favorites — dramas you have saved, so your list is available across sessions and devices.
Episode unlocks — which episodes you have unlocked and how (for example, by watching a rewarded video), so an unlock is permanent and survives reinstalling the App.

This data is functionally required for the App to work as intended. It is not shared with advertisers and is not used to target advertising.

1.3 Subscription and purchase data

If you purchase a subscription, the purchase itself is made with Apple (App Store in-app purchase) or Google (Google Play Billing). The store returns a purchase receipt to the App, which sends it to our server for validation against Apple's and Google's own APIs. We store the result: subscription status, the plan you bought, the platform, the original transaction identifier, whether auto-renewal is on, and the current period end date. We also store the renewal and cancellation notifications Apple and Google send our server about your subscription.

We never receive or store your payment card details, billing address, or store account password — those stay entirely with Apple and Google.

1.4 Advertising and device identifiers

The App shows advertising to users who are not subscribed. Ads are delivered through TopOn (an ad mediation SDK, operated by AnyThink), which in turn requests ads from ad networks — currently Google AdMob . To select, deliver, cap and measure those ads, the ad SDKs collect:

Advertising identifiers — the Google Advertising ID (GAID) on Android and, only if you allow tracking, the Identifier for Advertisers (IDFA) on iOS. The App also has access to the Android App Set ID.
Device and network information — device model, operating system version, language, screen size, network type, and IP address (from which an approximate, city-level location can be inferred).
Ad interaction events — that an ad was requested, shown, clicked, or watched to completion.

We do not send your email address, watch history, or favorites to any ad network. Ad frequency limits (how often an ad may appear, and a daily cap on rewarded unlocks) are enforced using counters stored on your own device.

The advertising identifier is also sent to our marketing-attribution provider, Adjust; see §4. Unlike the ad SDKs above, Adjust is used whether or not you are subscribed.

The Android build of the App also includes the Google Play and Samsung Galaxy Store install referrer libraries, which can report how the App was installed. See Third-Party SDKs for the full component list.

1.5 Product analytics

To understand how people navigate the App — and so decide what to fix and what to commission next — we record a defined set of usage events through PostHog , a product-analytics service. Those events are:

Screens and content — which screens you open, which dramas you tap on the home page, which episodes start playing and which you finish, and a summary written when you leave an episode (the seconds you actually watched and how far through the episode you reached).
Subscription funnel — that a paywall was shown or dismissed, and that a purchase was started, failed, or completed.
Account and list actions — that you signed up or signed in and by which method (email, Google or Apple), and that a drama was added to or removed from your favorites.

Each event carries your app version, language, whether you were a subscriber at the time, and the device and network information any HTTP request reveals (device model, operating system version, IP address — from which an approximate, city-level location can be inferred). Events are attached to a pseudonymous identifier — your SWAVE account ID . If you are not signed in, events are recorded anonymously and are not linked to any account.

No advertising identifier is sent to PostHog, and session recording (session replay) is switched off — we do not record your screen, your taps, or anything you type. Your email address, display name and account contents are never sent. A copy of the paywall and purchase-funnel events is also written to our own Supabase database, so we can reconcile them against subscription records.

1.6 What we do not collect

Apart from the PostHog events described in §1.5 and the Adjust attribution SDK described in §4, the App contains no other analytics or attribution SDK: there is no Firebase, no Google Analytics, no Singular, no AppsFlyer, and no crash-reporting SDK. We do not collect your contacts, photos, precise GPS location, microphone, message content, biometrics, or health data.

2. How We Store Your Data

Structured data (accounts, favorites, watch progress, unlocks, subscription status) is stored in Supabase (hosted PostgreSQL). Access is enforced by row-level security policies scoped to your account, so one user cannot read another user's rows.

Video, subtitles and cover images are stored on Huawei Cloud object storage and delivered over HTTPS through a Huawei Cloud CDN. Playback addresses are signed by our server and expire after a short period; requesting one tells our CDN provider your IP address, as any HTTP request does.

The product-analytics events described in §1.5 are processed by PostHog on its United States cloud, under a pseudonymous account identifier and separately from the account database above.

3. Why We Process This Data

Data	Purpose
Email address, display name, avatar	Account authentication, cross-device sign-in, support communication
Watch progress & favorites	Core app functionality (resume playback, saved lists)
Subscription status & purchase receipts	Unlocking paid content, entitlement checks, fraud prevention, purchase restoration
Episode unlocks	Honouring unlocks you earned by watching a rewarded video, and enforcing the daily cap
Product-analytics events	Understanding how the App is used so we can improve the catalogue, the player and the purchase flow
Advertising & device identifiers	Serving, capping and measuring ads for users who are not subscribed; and marketing attribution — measuring which advertising campaign produced an install, subscription or ad revenue

Where the GDPR applies, we rely on: performance of our contract with you (account, playback, subscriptions); your consent (advertising identifiers, whether used for personalized advertising or for marketing attribution); and our legitimate interests (security, fraud prevention, keeping the service working, and measuring how the App is used so we can improve it).

4. Data Sharing

We share data only with the service providers necessary to run the App:

Supabase — database, authentication and account emails
Huawei Cloud — media storage, transcoding and CDN delivery
Apple — Sign in with Apple, in-app purchases and receipt validation
Google — Google Sign-In, Google Play Billing and receipt validation, and Google AdMob advertising
TopOn / AnyThink — ad mediation
PostHog — product analytics: the usage events in §1.5, under a pseudonymous account identifier. No advertising identifiers, and no session recording.
Adjust — marketing attribution: which advertising campaign led to an install, and which campaigns go on to produce subscriptions and ad revenue. It receives your advertising identifier where you have allowed tracking, and may share attribution data with the ad network that delivered the ad you clicked.

A per-SDK breakdown, with links to each provider's own privacy policy, is in Third-Party SDKs .

We do not sell your personal information , and we do not share it for cross-context behavioural advertising beyond the advertising identifiers described in §1.4.

5. Advertising Choices

Subscribe. An active subscription removes ads. When you are subscribed the App does not request an ad at all. Note that this stops advertising, not attribution — see the next item.
Marketing attribution (Adjust). Unlike the ad SDKs, Adjust runs whether or not you are subscribed, because it measures which campaign brought you to the App. It is driven by your advertising identifier, so the controls below apply to it as well: resetting or deleting that identifier in your system settings limits what Adjust can tie together, and on iOS declining the App Tracking Transparency prompt means the IDFA is never made available to it. See §4 for what Adjust receives.
iOS. The first time you open the App we ask, through Apple's App Tracking Transparency prompt, whether we may track you. If you decline, the IDFA is not available to the ad SDKs and you still get full use of the App — ads simply become less relevant. You can change your answer later in Settings → Privacy & Security → Tracking .
Android. You can reset or delete your advertising ID in Settings → Google → Ads (wording varies by device). Deleting it stops apps receiving an advertising identifier.
Rewarded videos are always optional. They only play when you choose to tap "watch an ad to unlock".

6. Data Retention & Deletion

We keep your account data for as long as your account exists. You can delete your account from inside the App — About → Delete account — or on the web at swave.pencil-stub.com/swave/legal/delete-account.html .

Deletion is immediate and permanent: your authentication record is removed, and your profile, favorites, watch progress, unlocks and subscription rows are deleted with it. It cannot be undone, and it does not cancel an active store subscription — cancel that in the App Store or Google Play (see Membership Terms ).

Copies may briefly persist in routine encrypted backups and server logs held by our infrastructure providers until those age out on their normal schedule. Purchase and tax records that we are legally required to keep are retained for the period the law requires, in a form no longer linked to your account.

7. Your Rights

You may access, correct, or delete your personal data at any time. Your profile and email are editable in the App; deletion is described in §6.

Depending on where you live you may have additional rights — for example, under the GDPR: access, rectification, erasure, restriction, portability, objection to processing, withdrawal of consent, and the right to lodge a complaint with your supervisory authority; or under the CCPA/CPRA: the right to know what we collect, to delete it, and to opt out of sale or sharing (we do not sell or share personal information as those terms are defined). We will not discriminate against you for exercising any of these rights. Contact us using the details in §9 and we will respond within the time your law allows.

8. Children's Privacy

The App is not directed at children under 13 (or under 16, or the higher minimum age required by your local law — for example where the GDPR sets that threshold), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

9. Governing Law & Contact

SWAVE is operated by ARTSTRIO GAMES PTE. LTD. , based in Singapore . This policy is governed by the laws of Singapore , without regard to conflict-of-law principles.

Questions about this policy or your data? Contact us at blueming333@gmail.com .

10. Changes to This Policy

We may update this policy as the App evolves. Material changes will be reflected by updating the "Last updated" date above; continued use of the App after a change constitutes acceptance of the revised policy.