Privacy Policy

This Privacy Policy explains how Tokenswim (“Tokenswim,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you visit tokenswim.app, create an account, use our APIs and dashboards, complete OAuth flows, participate in referral or partner programs, or otherwise interact with our services (collectively, the “Service”).

This Policy should be read together with our Terms of Service and Cookie Policy. Capitalized terms not defined here have the meanings given in the Terms of Service.

By using the Service, you acknowledge the practices described in this Policy. If you do not agree, do not use the Service. Where consent is required by law for a specific processing activity, we will request it separately when needed.

The information we process depends on how you use the Service. It may include:

Account and profile information

• Identifiers and contact details such as name, email address, and account preferences.
• Authentication and security data such as password hashes (not plaintext passwords), multi-factor authentication setup, session metadata, OAuth grants and client registrations, API key metadata (not full secret values after issuance where we store only hashes/prefixes), IP addresses, user-agent strings, and security event logs.

Service, usage, and billing information

• API request metadata and operational logs needed to route, meter, and troubleshoot requests — for example timestamps, model identifiers, token counts, latency, status codes, key identifiers, and error summaries.
• Content you submit in API requests (“Inputs”) and content returned as model responses (“Outputs”), to the extent needed to fulfill the request, measure usage, prevent abuse, debug failures, and meet legal obligations. We do not use Inputs or Outputs to train our own foundation models unless we clearly disclose a separate opt-in program.
• Billing and wallet records such as credit purchases, balances, usage charges, referral activity, partner earnings, withdrawal requests, payout addresses you provide, and payment processor references. Full payment card details are typically handled by payment processors, not stored by Tokenswim.

Communications and support

• Messages you send us (email, forms, security reports, or support tickets), and related correspondence metadata.

Automatically collected technical data

• Device and browser information, approximate location derived from IP address, referral codes or landing parameters, diagnostic events, and cookies or local storage as described in our Cookie Policy.
• Bot-protection signals from providers such as Cloudflare Turnstile, used to protect sign-up, sign-in, and other sensitive actions.

We may also receive limited information from service providers (for example payment status webhooks) or from partners when you choose to connect or attribute activity through a referral link.

We use personal information to:

• provide, operate, maintain, and improve the Service, including account creation, authentication, API routing, metering, and dashboards;
• process payments, maintain prepaid credits, run referral and partner programs, and handle withdrawals;
• secure the Service, detect fraud and abuse, enforce rate limits, investigate incidents, and protect Tokenswim, our users, and the public;
• send transactional messages (for example email verification, password resets, security alerts, and withdrawal notices);
• respond to support, legal, and security requests, and communicate about material product or policy changes;
• analyze aggregated or de-identified usage to improve reliability, performance, pricing transparency, and product design; and
• comply with legal obligations, resolve disputes, and enforce our agreements.

Where data-protection laws require a “legal basis,” we typically rely on: performance of a contract (providing the Service you request); legitimate interests (securing and improving the Service, preventing fraud, basic analytics) balanced against your rights; consent where required (for example certain non-essential cookies or marketing, if offered); and legal obligation (tax, accounting, lawful requests).

We share personal information only as needed to operate the Service, protect Tokenswim and its users, complete a transaction you request, or comply with law. Categories of recipients may include:

• Infrastructure and operations providers — for example hosting, edge compute, databases, email delivery, logging, error monitoring, and bot protection.
• Payment and payout processors — to process top-ups, refunds where applicable, and partner or referral withdrawals.
• Model Providers — when you (or automatic routing on your behalf) select a Model, we transmit the Inputs required to fulfill that request to the provider. Their independent privacy practices and Model Terms apply to data they receive.
• Professional advisors and authorities — such as lawyers, auditors, or regulators when reasonably necessary, or when required by valid legal process.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality measures.

Tokenswim does not sell personal information for money. We do not share personal information for cross-context behavioral advertising as a core business practice. If that ever changes, we will update this Policy and provide any required opt-out mechanisms.

We may share aggregated or de-identified statistics that cannot reasonably be used to identify you, including with partners for product and network analysis. Recipients are not permitted to re-identify such data where contractually restricted.

When you call a Model through Tokenswim, Inputs are transmitted to the selected Model Provider (or a capacity partner path used to fulfill the request). Different providers have different retention, logging, and training practices. Tokenswim does not control a provider’s downstream use once data is lawfully sent to fulfill your request.

Before sending sensitive personal data, regulated data, or confidential business information through the API, evaluate whether the Model and provider practices are appropriate for that data. Enterprise customers with specific contractual data-processing requirements should contact us before relying on the Service for those workloads.

Request metadata used for billing and reliability (token counts, latency, model IDs, status) is retained as part of your account usage history. Full prompt/response bodies, if retained at all beyond short operational windows, are limited to what is needed for abuse prevention, security investigation, settlement integrity, or legal compliance, and are subject to access controls.

We retain personal information for as long as reasonably necessary to provide the Service, maintain financial and security records, resolve disputes, prevent fraud, enforce agreements, and meet legal, tax, and accounting obligations. Retention periods differ by data type — for example account profile data, transaction history, security logs, and backups may follow different schedules.

When information is no longer needed, we delete, de-identify, or aggregate it in accordance with our operational procedures and applicable law. Residual copies may persist for a limited time in encrypted backups until those backups rotate.

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. These may include transport encryption (TLS), encryption at rest for sensitive stores where appropriate, hashed credentials and API secrets, access controls, audit logging, and infrastructure hardening on modern cloud and edge platforms.

No method of transmission or storage is completely secure. You are responsible for safeguarding account credentials and for configuring your applications (including key scope and rotation) appropriately. If you become aware of a security incident affecting your Tokenswim account, contact us promptly.

Researchers may report vulnerabilities under our Vulnerability Disclosure Policy.

Tokenswim is operated using global cloud and edge infrastructure. Personal information may be processed in countries other than the country where you live, including jurisdictions that may have different data-protection laws.

Where required, we use appropriate safeguards for cross-border transfers, such as contractual protections with service providers (including standard contractual clauses where applicable) and careful vendor selection. By using the Service, you understand that your information may be transferred to and processed in these locations as needed to provide the Service.

Depending on your location and applicable law (for example GDPR, UK GDPR, or certain U.S. state privacy laws), you may have rights to:

• access personal information we hold about you;
• correct inaccurate personal information;
• delete personal information, subject to legal and operational exceptions (for example records we must keep for billing, fraud prevention, or legal claims);
• object to or restrict certain processing;
• receive a portable copy of certain information you provided to us; and
• withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.

You can often update account details directly in the dashboard. To exercise other rights, email contact@tokenswim.app. We may need to verify your identity (and the authority of any agent) before responding. We will respond within the time required by applicable law.

You may also have the right to lodge a complaint with a data-protection authority in your jurisdiction. We encourage you to contact us first so we can try to resolve your concern.

Marketing: if we send optional promotional email in the future, you can unsubscribe using the link in the message. Transactional and security messages are not marketing and may still be sent as needed to operate your account.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact contact@tokenswim.app so we can investigate and delete the information where required.

We may update this Privacy Policy as the Service, our practices, or legal requirements change. The current version and its “Last updated” date will always be posted on this page. For material changes that affect registered users’ rights, we will provide additional notice where appropriate (for example by email or in-product notice).

Your continued use of the Service after an update takes effect means you acknowledge the revised Policy, except where additional consent is required by law.

For privacy questions or requests, contact contact@tokenswim.app.