Effective August 13, 2026

Privacy, without the fog.

Swing is designed to interrupt autopilot, not inspect your digital life. This release is two things — Rotblock, a Screen Time blocker, and Morning Mantra, a morning routine — and your Family Controls selections stay on your device.

This policy explains how Aspire Labs, Inc. handles personal information in the Swing iOS app, its widgets and system extensions, and the swing.so and aspireai.com websites. Aspire Labs, Inc. is the controller of that information. You can reach us at support@swing.so.

Swing is free. The App Store release does not sell subscriptions or in-app purchases, does not show ads, and does not include AI chat, generated feeds, or content recommendations. Beta builds distributed through TestFlight still carry some of those features, and this policy covers those builds as well: every section that describes something the App Store release does not have says so explicitly.

Yes, Swing collects limited user data. The categories are account and sync data, website waitlist and referral data, product interaction data, diagnostics, notification delivery data, and support content you choose to send. The sections below say what each category contains, where it comes from, why we use it, who receives it, and how it can be deleted.

Information we collect

Account and sync information

Swing uses an account, which you create with Sign in with Apple or Sign in with Google. We collect your name, email address, sign-in provider identifier, and a Swing user ID. If you use Sign in with Apple with Hide My Email, we receive only the relay address Apple generates.

Your account also holds the settings the app syncs so they survive a reinstall or a second device: your Rotblock schedules — a schedule name, its start and end times, the days it runs, whether it is active, and how many apps and categories it covers as a count only — and your Morning Mantra profile, which includes the mantra text you write and the type, spacing, animation, and timing choices you make for it.

Website waitlist and referrals

If you request access or join the waitlist on swing.so, we collect the name, email address, and requested platform you enter, where on the site you joined, the referring page, limited campaign fields in the URL, and the page path. Depending on the form, Netlify processes the submission for us or the site sends it directly to our backend. For waitlist entries, we also create and maintain your status, referral code, referral points, position, and admission history. If you join while signed in, we may link that entry to your Swing user ID. We use this information to provide access requests, the waitlist and referral program, deliver the access or platform-availability message you requested, understand which signup sources work, and prevent abuse.

We receive information in four ways: directly from you; automatically from the app, your device, or your browser; from Apple or Google when you choose their sign-in or purchase services; and from service providers acting for us. We do not buy personal information from data brokers.

Purchases and subscriptions

The App Store release of Swing is free. It offers no subscription and no in-app purchase, so we collect no purchase, entitlement, or billing information from it, and we never receive your card number. Where a purchase was made in an earlier or beta build, Apple processed it and we hold only the product, entitlement, transaction, renewal, refund, expiration, and billing-state records needed to honor and reconcile that access; those records are retained as described below and removed with your account. StoreKit transaction identifiers are kept in billing systems and are not used as advertising identifiers. If we introduce paid features later, we will update this policy before they go on sale.

Product analytics and visual session replay

We may collect coarse interaction events such as onboarding completion, permission state, the route used to enter Swing, morning routine step and session completion, block-session start and end, whether an override was attempted and whether it succeeded, helpful or not-for-me feedback, cache status, time zone, app version and build, and a derived redirection outcome. We use this information to operate Swing and measure reliability. The protected app identity is stripped on the device before these events are sent — a blocked-app event carries the placeholder “protected_target,” never the app’s name or bundle identifier.

When Share product analytics is on, Swing may send these product events to PostHog and Mixpanel. PostHog may also receive a visual session replay of eligible screens. A replay is a time-ordered sequence of screenshots of the Swing interface together with screen and session context. It is not a recording of anything outside Swing. Ordinary interface copy and visible interaction states can appear. Replay runs only for a signed-in user while Swing is in the foreground and only after a current control from our server approves the screen. That control can restrict the screens, sampling, session count, maximum duration, and expiration, or shut replay off. Eligibility may include every signed-in session on approved screens; we may also use a lower sample.

We configure replay to mask images and Apple-hosted or sandboxed views, and not to collect SDK logs, network request or response contents, background screenshots, or rage-click touch capture. Swing stops recording on Settings, Family Controls pickers, and web views, and explicitly masks feedback text, Morning Mantra text, and other views marked as user content. We do not globally mask all visible text, so ordinary labels, buttons, and any visible text outside those protected views may appear in a replay. Family Controls tokens and the identities of protected apps and websites are never part of replay.

You can stop optional interaction events and session replay at any time in Settings → Privacy & Personalization by turning off Share product analytics. Swing then stops future capture and removes queued optional analytics and PostHog replay data stored on the device. Turning it off does not retroactively erase data already delivered to PostHog or Mixpanel; that data follows the retention and deletion process below, and you can ask us to delete it by emailing support@swing.so.

Text you write

The only text Swing asks you to write is your Morning Mantra, plus anything you choose to put in a support message. Your mantra text is stored on your device and synced to your account as part of the Morning Mantra profile described above. It is not used to train anything and it is not shown to anyone else.

Feedback you choose to send

If you contact support or submit feedback, we collect the message and any photo, video, audio, or diagnostic attachment you deliberately include. If you include audio, we may send it to Groq or OpenAI to create a transcript for our support team; we store the transcript with the feedback record. We may use Resend to deliver a support notification containing your account label or email, message, diagnostics, and copies of or links to the attachments to our authorized support recipients.

Feedback attachments are stored in private, user-scoped object storage. They are available only through authenticated internal tools or time-limited signed links and are not exposed through a public file listing. Account deletion and verified deletion requests include these stored attachments, subject to the limited exceptions below. Do not include information you do not want us or these support providers to receive.

Diagnostics and notifications

We may collect crash, hang, performance, memory, disk-write, energy, device class, operating-system version, app version, and request reliability information, along with an opaque installation identifier you can reset. Like nearly every online service, our websites and backend also receive network and request information such as IP address, user agent, requested path, request time, and security headers. We use it to deliver the service, rate-limit abuse, investigate failures, and protect accounts. If you enable notifications, we process a push token and delivery state so requested reminders and redirect fallbacks can work.

Optional device context

The App Store release of Swing does not ask for location or motion access. It ships without the Location When In Use and Motion & Fitness usage descriptions and without the WeatherKit entitlement, so iOS cannot grant Swing either permission and neither integration can run. Rotblock and the morning routine never depended on them.

Earlier and beta builds distributed through TestFlight do offer two optional integrations, and this policy covers those builds too. Both stay off until you turn them on and grant the matching iOS permission, and neither is required:

• Weather and daylight. With Location When In Use permission, Swing reads your device coordinates, resolves the locality, region, and country from them, and sends those together with your time zone and the current weather conditions to our backend, so the morning routine can reflect the daylight and conditions you are actually in.
• Motion. With Motion & Fitness permission, Swing reads step counts and coarse activity classification for a recent window and sends a summary to our backend, so it can tell rest apart from movement when timing reminders.

If you are running such a build, you can revoke either permission in iOS Settings at any time and Swing keeps working exactly the same. Context already sent from one of those builds is retained as described below and removed with your account. If we bring either integration to the App Store release, it will stay opt-in and we will update this policy first.

What we do not collect

• Apple Health data. Swing does not read HealthKit.
• Location or motion data in the App Store release, which requests neither permission. In earlier and beta builds this is collected only through the opt-in integrations described above.
• Contacts, calendars, browsing history, raw keystrokes, screens outside Swing, background screenshots, network request or response contents, or system logs through session replay.
• The names or identities of the apps and websites you protect.
• The advertising identifier. Swing does not present the App Tracking Transparency prompt because it has nothing to track you with.

How we use information

• Provide, secure, debug, and improve Swing.
• Run Rotblock schedules and the Morning Mantra routine, and keep them consistent across your devices.
• Operate the website waitlist, referrals, and requested access notifications.
• Deliver the reminders and redirect fallbacks you turn on.
• Measure whether shields, schedules, and the morning routine actually work, so we can fix them when they do not.
• Respond to support, prevent abuse, and comply with law.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other US state privacy laws. We do not use personal information for cross-app advertising or tracking. Swing contains no third-party ads.

If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are:

AI-assisted product features (beta builds only)

The App Store release of Swing has no user-facing AI features. It contains no AI chat, generated feed, generated mantra or redirection copy, or AI content ranking. The optional support-audio transcription described above is a support-processing tool, not a user-facing AI feature.

We do run AI-assisted features in beta builds distributed through TestFlight, and this section covers them for the people testing those builds. There, requests route through our Cloudflare-hosted backend to third-party model providers, which currently include Anthropic, OpenAI, Google, and Groq. We use these providers under their commercial API terms, which do not permit them to use API inputs or outputs to train general-purpose models. We do not train models on your content either.

We log operational metadata about every AI call — job type, provider, model, token counts, cost, latency, and success or failure — so we can monitor spend and reliability. Those logs do not contain the text of your prompt or the model reply. Requests are associated with your user ID, and that reference is cleared if you delete your account.

Model output can be wrong. Swing content is general wellness material and is not medical, psychological, or emergency advice.

Service providers

We use service providers only to run Swing. We require providers that receive personal information to use it only for the service we requested and to protect it to the same or an equivalent level required by this policy and applicable law. Depending on the feature, these providers may include:

• Apple for Family Controls, push delivery, and Sign in with Apple.
• Cloudflare for website and application delivery, backend hosting, security, and private object storage.
• Netlify for hosting website access-request forms and processing their submissions.
• Neon for managed PostgreSQL holding account and application data.
• Google for Sign in with Google, Firebase Crashlytics crash reporting, and Firebase Cloud Messaging notification delivery.
• Upstash for short-lived request and account rate limiting used to prevent abuse.
• PostHog and Mixpanel for optional product analytics, and PostHog for visual session replay, disabled for future collection when you opt out.
• Sentry for app and backend error monitoring.
• Resend for delivering feedback and support notifications to our authorized recipients.
• Groq and OpenAI for automated transcription when you deliberately attach audio to feedback.

Additional providers serve only the beta builds described under AI-assisted product features: Convex for real-time chat and generated-content surfaces, and Anthropic, OpenAI, Google, and Groq for model inference. OpenAI and Groq can also receive support audio for the limited transcription purpose described above.

Two subscription vendors, RevenueCat and Superwall, are still linked into the Swing app, which is why their names appear in the aggregated privacy report Apple builds from the privacy manifests inside an app. In the App Store release neither is switched on: the build carries no key for either service, neither is initialized, no paywall is ever presented, and neither vendor receives anything about you. Where an earlier or beta build enabled them, RevenueCat received your Swing user ID and the Apple-processed entitlement state attached to it so paid access could be observed and restored, and Superwall received your Swing user ID and paywall presentation events; neither was used for advertising or for tracking you across apps, and neither ever handled your card number. If we introduce paid features later, we will update this policy before they go on sale.

We may also disclose information to comply with law or valid legal process, to enforce our terms, to protect rights and safety, and to a successor in a merger, acquisition, financing, or sale of assets, in which case this policy governs until replaced by notice.

Your controls

• Turn off Share product analytics in Settings to stop optional product events and future visual session replay. Essential security and reliability processing continues.
• Delete local history and reset the opaque installation identifier.
• Export your account data or delete your account and its cloud data from Settings.
• Ask us to remove a website access request or waitlist entry, support message, or delivered analytics record by emailing support@swing.so.
• Turn off Rotblock schedules, or remove Family Controls authorization in iOS Settings.
• Control notifications and Apple permissions in Swing or iOS Settings.
• Delete the app to remove on-device data, after first disabling any active protection schedule.

Retention and security

We keep each category only as long as reasonably necessary for the purpose stated above, then delete or de-identify it unless a longer period is required for law, dispute resolution, fraud prevention, security, or backup rotation. In particular:

• Account and sync data remains while your account is active and is removed through account deletion.
• Waitlist and referral data remains while needed to administer access and referrals, or until you ask us to delete it.
• Feedback messages, transcripts, and attachments remain while needed to investigate and document the support issue, or until account deletion or a verified deletion request.
• Session replays and optional product analytics already delivered to PostHog or Mixpanel follow the retention settings for those projects and can be included in a verified deletion request.
• Rate-limit records expire after their short control window. Diagnostic and operational logs use short rolling windows unless a specific security incident requires longer preservation.

Account deletion removes active Swing account data after verification, subject to the limited exceptions above, and backups age out on their normal rotation. We use administrative, technical, and organizational safeguards, including encryption in transit, access controls, private object storage for user uploads, and time-limited links where a provider or authorized recipient needs a file. No service can guarantee perfect security.

Browser privacy signals

Swing does not sell personal information, share it for cross-context behavioral advertising, or track you across unrelated websites. Because those practices are off, browser “Do Not Track” and Global Privacy Control signals do not change how our sites behave: there is no sale, advertising share, or cross-site profile to switch off. Hosting, security, video, and analytics providers may receive ordinary request information when you use the relevant site feature, but we do not authorize them to use it to track you across unrelated services. An embedded YouTube demo is loaded only after you choose to play it, at which point Google receives the request under its own privacy terms.

International transfers

We operate in the United States, and our providers may process information in the United States and other countries. Where required, we rely on the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another approved transfer mechanism.

Children

Swing is not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided information, contact us so we can investigate and delete it.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of personal information, to withdraw consent, to opt out of sale, sharing, or profiling, and to appeal a denial. Use the in-app controls in Settings, or email support@swing.so. We may verify your request before acting, we will not discriminate against you for exercising a right, and an authorized agent may submit a request with proof of authority.

We do not sell or share personal information, so there is nothing to opt out of, and we do not use or disclose sensitive personal information for purposes that would require a limitation right under California law. Residents of the EEA, the UK, and Switzerland may also lodge a complaint with their supervisory authority.

Changes and contact

We may update this policy as Swing changes. We will post the revised date and provide additional notice when required. Questions or privacy requests can be sent to support@swing.so or through Settings → Provide Feedback in Swing.