Last updated: February 2026 — Version 1.0
SwingWatch was built by someone living with bipolar I disorder. Your mental health data is deeply personal. This policy explains exactly how we handle it — plainly, without legal obfuscation.
SwingWatch is a personal mood-tracking application built and operated by an individual developer. We are not a healthcare provider, insurance company, or covered entity under HIPAA. We are, however, committed to HIPAA-level data protection as best practice because we believe your mental health data deserves it.
Sensitive fields — your journal notes, medication names, doses, and prescriber names — are encrypted in the database using AES-256-GCM. The encryption key is never stored in the database; it lives only in a server environment variable. This means that even if someone obtained a database dump, your sensitive health data would be unreadable without the key.
All data is transmitted over HTTPS (TLS 1.2+). We enforce HSTS.
SwingWatch is hosted on a virtual private server in the EU/US. Your data does not leave this server except when you explicitly export it. We do not use any third-party cloud services that process your health data (weather data is fetched from Open-Meteo using only your coordinates, not your identity).
By default, we keep your data indefinitely (as long as your account is active). In Settings → Privacy, you can choose a retention period of 1 or 2 years — check-ins and risk scores older than that window will be automatically deleted by a daily process.
You can request complete account deletion at any time (see below).
If you opt in (Settings → Privacy → Anonymous data sharing), anonymised mood pattern data may contribute to aggregate statistics accessible via the Global Stats page. This data cannot be linked back to you: it contains no name, email, IP address, or any identifier. You can opt out at any time and your previously contributed data will be removed from the aggregate.
You can export all your data at any time from Settings → Export. Available formats: JSON (complete machine-readable export) and PDF (human-readable report). Exports are rate-limited to 3 per day to prevent abuse.
You can delete your account from Settings → Danger Zone. When you do:
Deletion is irreversible. There is no grace period or recovery option.
We run automated monitoring to detect suspicious activity: excessive failed login attempts, login from unusual locations, potential injection attacks. These detections are logged to an audit trail for human review. They do not result in automatic blocking — a human reviews flags before taking any action.
An immutable audit log records who accessed or modified your data, when, and from which IP address. This log is used to investigate potential unauthorised access.
SwingWatch uses browser localStorage to store your authentication tokens (JWT access token and refresh token). No third-party cookies are set. Session data (for CSRF protection on the signup and password reset forms) is stored in a standard PHP session cookie, which expires when your browser closes.
SwingWatch is not intended for use by anyone under 16 years of age. We do not knowingly collect data from minors.
If we make material changes to this privacy policy, we will notify you by email and update the "Last updated" date above. Continued use of SwingWatch after notification constitutes acceptance of the updated policy.
To exercise any of your rights (export, deletion, correction), use the self-service options in Settings. For questions, concerns, or to report a privacy issue, email: ross@swingwatch.app
We aim to respond to privacy requests within 72 hours.