01Who this policy covers
Swalfa is operated by Hoolefu. This policy explains how information is handled in the app and website, including social profiles, messages, paid text and voice conversations, party rooms, games, purchases and support. For support, privacy or child safety concerns, contact support@kyberworld.com or use the Help & support form without signing in.
02Information we process
Account information includes your registered phone number and country code, account ID, password hash, nickname, avatar, country, gender, biography and language preferences. Optional profile photos and voice introductions are processed when you add them. We also process messages and their attachments, social relationships, room participation, game actions and results, transaction references, virtual balances, gift recipients and support requests. Phone verification and Google sign-in are handled through Google Firebase Authentication, including sending and verifying SMS codes and Google account authorization. Google account data we receive is limited to a unique account identifier, display name, profile photo and email address, where available. We save the Google account email for account contact and security; we do not merge accounts based on email addresses. Apple sign-in also uses Google Firebase Authentication; we receive the Apple account identifier and, where provided, name and email address (which may be an Apple relay address). We save that email for account contact and security, not for merging accounts.
03Technical information and permissions
We process IP addresses, device and app information, session identifiers, connection status, service timings and diagnostic events to authenticate accounts, operate real-time features and investigate errors or abuse. Our server may send your IP address to external geolocation services (such as ipapi.co, freeipapi.com or configured alternatives) and cache the resulting approximate region. These services receive only the IP address and return an approximate region; we do not collect precise location. Microphone access is used for voice messages, introductions and live audio. Selected photos and files are accessed for the feature you choose. If a room host plays locally selected music, the original file is not uploaded as a file, but its audio is streamed through ZEGO to listeners in the room. Notification permission enables alerts. You can revoke permissions in device settings; related features may then be unavailable. On Android, we collect Android ID (ANDROID_ID); if it is unavailable, we use a random installation ID generated and stored on your device. This identifier is used for account security and fraud prevention, including counting accounts on the same device and assessing invitation risk. When the registration page opens, the app reads the clipboard only to recognize invitation codes prefixed with KWINV: and fill in the invitation field automatically; other clipboard content is not uploaded. Only when you choose to save an invitation poster does this feature write it to your photo library; it does not read the library. This does not change how photos you select for profile or upload features are accessed. The app uses Google Firebase Crashlytics to collect crash reports and related diagnostics (device model, OS version, app version, stack traces and an installation identifier) to fix stability problems.
04Why information is used
Information is used to provide your account, deliver messages and media, connect conversations and rooms, run and settle games, fulfil purchases and gifts, show your chosen profile, personalize language and matching preferences, prevent fraud, moderate reports and respond to support or privacy requests. Public profiles, room messages and public game or gift activity may be visible to other users according to the feature. Do not share information you do not want those participants to see. For invitation activities, we process invitation relationships and the device and network information recorded when an invitation is bound, including the device identifier and IP address, to settle rewards and prevent fraud. Invitation rewards are in-service virtual assets.
05Message translation and AI
When a recipient enables automatic translation or requests a translation, message text and the necessary language information may be sent to the configured provider, including DeepSeek or Alibaba Cloud Qwen. Turning off automatic translation for your account does not prevent another participant from translating messages you send. Translations can be stored and cached for reuse; the original remains available. Translations may be inaccurate. Separately, if you request voice-message transcription, our server gives Alibaba Cloud DashScope the voice file's HTTPS URL to retrieve and transcribe it; the result may be cached on the server and stored on your device. These features do not delete original messages or recordings when turned off. When live captions are on in a voice call, party room or game room, the speaking participant's microphone audio is streamed in real time to Alibaba Cloud Qwen for speech recognition (transcription) and translation; audio is not stored by us, and the resulting caption text is archived for safety review and to show caption history in the conversation.
06Service providers and sharing
ZEGO supplies messaging and real-time audio; relevant message content, audio streams, user/room identifiers and connection metadata pass through that service. These providers process data on our behalf and only to deliver the features described. Google Firebase Authentication processes phone numbers, authentication credentials and verification results for SMS verification, Google sign-in and Apple sign-in as described above. Firebase Cloud Messaging and Firebase Installations may process push tokens, installation IDs and delivery or app information. Google Play Billing processes purchases in the Play-distributed Android app. Stripe processes purchases only in the Android download version distributed on our website. Swalfa stores order and verification records, including purchase receipts where needed, but not your full payment-card details. Hosting and storage providers, including Alibaba Cloud and Cloudflare where configured, store or deliver service data and media. Translation, transcription and IP geolocation providers process information as described above. We do not sell personal data and do not use it for third-party advertising. We share data only with the service providers listed above, when required by law, or to investigate fraud or safety incidents.
07Storage, retention and security
Our current infrastructure includes systems in China and Singapore. Using the service can involve transferring data outside your country. Data from users in the EEA, the UK or other regions with transfer rules may be transferred to China and Singapore to provide the service. We handle such transfers in accordance with applicable law and can provide details on request. This includes microphone audio sent to Alibaba Cloud for live-caption transcription and voice-message transcription. Our website and first-party API connections use HTTPS; third-party messaging and real-time audio use provider transports whose end-to-end encryption is not established by this statement. Administrative access is restricted. We retain account and service data as needed to provide the service and address disputes, security or legal obligations. Registration-device records are retained until account deletion. De-identified financial records, including transactions and top-ups, refunds and chargebacks, are retained for 5 years. Support tickets and report records are retained for 1 year after closure. Operational logs are retained for 30 days. After a deletion request, you have a 7-day cooling-off period; signing in or selecting Cancel deletion during that period withdraws the request. After the period ends, the account is disabled and personal data is automatically deleted or anonymized within 30 days. Copies held by messaging and real-time audio providers require provider assistance; provider logs and other retained data are handled under the applicable processing arrangements. Server backups are overwritten on a 30-day cycle, not immediately erased. Copies saved on other users’ devices cannot be deleted remotely. No system can guarantee absolute security.
08Your choices and deletion
You can edit your profile, control translation and device permissions, and request access to, correction of or deletion of data through Help & support. To delete your account, open Me → Settings → Account & security → Delete account in the app. During the 7-day cooling-off period, sign in or select Cancel deletion to withdraw the request; after the period ends, deletion or anonymization runs automatically and is completed within 30 days. If you cannot use the app, submit the website’s delete-account support form without installing or signing in to the app. After verifying account ownership, our team initiates the same deletion process through the admin system, including the 7-day cooling-off period. Keep your private tracking code to follow replies; a support reply or closed request is not confirmation that account or provider data has been deleted. Deletion removes or anonymizes your profile and media, social relationships, your own messages and related translations and transcriptions, activity records, registration-device records and other device data, and login identities. Media shared with other owners may remain, with your references removed; other users’ own messages are not deleted. Invitation relationships are de-identified, their device and network information is cleared, unpaid rewards are revoked, and your balances are set to zero. Rewards already credited to other users are not reclaimed. De-identified financial records, including transactions, top-ups, refunds and chargebacks and necessary supporting records, are retained for 5 years. Support tickets and report records are retained for 1 year after closure, and operational logs for 30 days. Copies held by messaging and real-time audio providers require provider assistance; online deletion does not prove that all provider copies have been erased. Server backups are overwritten on a 30-day cycle, not immediately erased. Copies of messages or media saved on other users’ devices cannot be deleted remotely. Uninstalling the app does not delete your account. After deletion is complete, you can register again with your phone number or Google/Apple sign-in; this creates a new account and does not restore the old one. Any separate store subscription must be managed through that store.
09Website storage and children
The website does not use analytics cookies or retain the content you type in the support form on your device. Tracking codes are shown to you and must be saved by you. Request forms send your contact details, account identifier and message to our support system. The service is intended for adults aged 18 or over and is not directed to anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided information, contact support@kyberworld.com or submit a safety or privacy request; we will delete it. Material policy changes will be reflected on this page with an updated effective date.