DAWNBLOOM Privacy Policy
Official English version
Version: V6
Updated: October 8, 2026
Effective date: October 8, 2026
Scope: website, account, game, six apps, community, player center and support.
Publication information and privacy summary
Operator and personal information controller: SHANGHAI LUMIREALM CREATIVE MEDIA CO., LTD. Official website: https://dawnbloom.net. Legal contact address: Room 218, Building 3, No. 336 Tianjiao Road, Lin-gang Special Area of the China (Shanghai) Pilot Free Trade Zone, China (中国（上海）自由贸易试验区临港新片区天骄路336号3幢218室). Privacy and legal: [email protected]; general support: [email protected]; security incidents: [email protected].
The online game needs server processing of account, character, social, asset and necessary operational data.
Core private content in Browser, Mail, Download and Archive is handled locally first; mail providers and destinations independently handle the communications you request.
Light Sync is optional and covers only the settings and metadata supported by that product. News does not currently offer Light Sync.
A shared account does not make private content flow automatically between products.
We do not sell personal information or build cross-product advertising profiles. The website uses anonymous aggregate statistics; necessary security logs are handled separately.
Signing in does not automatically upload mail, downloaded files or archives to DAWNBLOOM.
Payment providers handle payment credentials. We retain necessary order, refund and support records, not full card numbers or payment passwords.
You can manage your account, synced and local data and exercise privacy rights under applicable law.
1. Scope
This Policy covers dawnbloom.net, current official service subdomains, DAWNBLOOM Account, the DAWNBLOOM game, DAWNBLOOM Token, Browser, News, Mail, Download and Archive, DAWNBLOOM Community, Support, Dawnbloom Guide, and current official website mini-games and the player center. The brand-protection domains 光与绽森语.com and 光と花咲く森.com only redirect to official services; they do not operate separate accounts or data systems. Similar domain names are not thereby official.
Actual features, platforms and availability follow the official product pages and release notices. This Policy describes provided functions and their data boundaries; a plan is not an available service. Third-party sites, mail providers, news sources, stores and payment platforms are independently operated and their privacy rules also apply.
2. Privacy principles, purposes and boundaries between products
We process information for defined purposes and within the minimum necessary scope. Local first does not mean all DAWNBLOOM services are offline: account, online game, public community, orders, Light Sync and necessary support require servers. This does not extend collection to local files or private content. A shared account does not let the game read mail, Mail read browsing history, News read third-party mailboxes or Download read game chat. A file opening, sharing or product handoff you initiate processes only what that action needs.
Purposes include requested functions, authentication and recovery, light sync, game interaction and asset settlement, order delivery and support, security and abuse prevention, troubleshooting, anonymous service statistics and legal obligations. Depending on the situation, processing is based on service necessity, legal duties, lawful protection of security and legitimate rights, or your consent. Separate consent, special protection and other required procedures are completed where applicable.
Ordinary account and product use generally does not require government identity documents. For our own operations we do not by default collect precise GPS, contacts, health or biometric data, full card numbers, payment passwords, advertising IDs, unnecessary permanent device fingerprints or private file contents. Where genuinely needed for law, a minor refund, dispute or high-risk recovery, we may lawfully request limited proof with restricted purposes and access. Please redact unrelated information.
3. Information categories and primary locations
Account and security: account name, email, password hashes, region and language, verification and consent records, sessions, trusted devices, multifactor status and necessary login or recovery records are mainly handled by account services. Game and community: characters, assets, interactions, public content, moderation and necessary operational state are handled by the relevant online service.
Local private content: browsing and site data, mail caches and provider credentials, downloaded and partial files, archives, extracted content and local paths are mainly handled by the device and your chosen source or provider. Light Sync handles permitted settings and metadata when enabled. Orders and support include order snapshots, refund status, request identifiers, your explanation and necessary proof in restricted support services. Anonymous statistics and security logs have different fields, purposes and retention periods, as explained in Sections 15, 19 and 20.
4. DAWNBLOOM Account and security
Registration normally needs an account name, password and confirmation, email, your selected legal region and required policy choices; a phone number is not currently required. Interface language or an IP-based suggestion does not replace your legal-region choice. Passwords use salted irreversible hashes, not plaintext storage. Security and recovery may process limited historical hashes and bindings, email verification, device and session identifiers, Token binding, multifactor authentication, emergency unbinding, country/region and city-level login locations, anomalous logins and necessary audits. These are not used for advertising profiles; city-level locations are not precise GPS.
Game accounts and related game services require users to be 18 or older. Outside Mainland China, registration uses an active age-range choice, without a full birth date or invented birthday. When Mainland China registration and age eligibility are offered, submitted names and dates of birth are encrypted and processed in China; Tokyo receives only the local record reference, adult-eligibility result and confirmation records, not the original fields. Calculation from submitted information is not government-database identity verification. Regional registration availability follows the account service at that time. Account-free core app functions do not thereby require game age data.
5. Optional Light Sync and product boundaries
Light Sync is light synchronization that you enable for a product. It handles that product’s supported settings and limited metadata, not cloud drive storage, mail, browsing-history, download-file or archive repositories. Core Browser, Mail, Download and Archive functions do not require DAWNBLOOM Account; account, game and account-security functions themselves require authentication. Product data is separated by function. Signing into one product does not authorize others to read private content.
Turning Light Sync off stops future synchronization; it does not automatically erase existing cloud or local data. Mail currently offers a cloud-sync deletion control that deletes its light settings and turns sync off while retaining local mail accounts, messages, settings and credentials. Use a corresponding control in another product only where actually provided; otherwise make a privacy request under Section 22. Signing out differs from deletion: Mail retains third-party connections and local caches, Download and Archive retain local files, and Browser data follows local controls. Final account closure handles associated cloud data under Section 21; it does not delete device files or a third-party provider’s data.
6. Online game and DAWNBLOOM Community
The online DAWNBLOOM game requires server processing of accounts, characters, levels, inventory, equipment, Phantom Beasts, current tasks and events, necessary combat state, work skills, friends, teams, families, marriage, chat, messenger mail, trade, economy, rankings, order links and security records. Character names, public character details, chat and transaction information may be visible to interacting players. Public museum information is distributed through a content delivery network; viewing it does not upload private content from other apps.
Ordinary real-time chat is retained for 7 days by default. Evidence directly needed for security incidents, reports, disputes or legal duties may be retained longer in the minimum necessary scope. Displayed messenger mail and item/currency delivery ledgers may have different periods. Asset flows support investigations of theft, duplication, abnormal transactions, bug exploitation, fraud and abusive refunds, not marketing. Automatic game-chat translation is not formally enabled; before enabling it we will disclose the provider, needed text and international transfers and complete applicable notice and consent.
DAWNBLOOM Community processes posts, replies, public usernames or character information, reports, moderation and community-security records. Others can view, copy or share public content; avoid posting unnecessary private details. Dawnbloom Guide processes your question and necessary context when you ask for help. Account or private details you type may become part of that request. It does not thereby gain access to other apps’ files, mail or browsing histories.
7. DAWNBLOOM Browser
Core browsing needs no account. History, tabs, cookies, passwords, page content, search history, private sessions, local website storage and downloaded files are handled on device by default and excluded from Light Sync. Current optional sync supports bookmarks and limited released-platform settings such as theme, search engine and ad-blocking preferences. Bookmarks may include title, URL, folder, ordering and modification time. Available settings differ by platform and follow the actual version’s sync choices; this is not full browsing-data synchronization.
Opening a page or searching connects your device directly to the chosen site or search provider, which may receive IP, query, cookies and necessary device data. Website permissions you grant are controlled by the OS and browser. Private-session data is excluded from ordinary history and cleared within browser/OS capabilities; it does not guarantee anonymity from sites, network providers or the OS. User-initiated Android translation uses Google ML Kit on device for page text and output, downloading models as needed. Google SDKs may independently handle necessary device, app, model, language, performance and error metadata; this does not mean page text is uploaded for translation.
8. DAWNBLOOM News
News is a unified global public-news reader. We handle titles, summaries, sources, authors, timestamps, image and original URLs, categories and necessary metadata from public third-party sources, distributing lists through content-delivery services. Reading, saved items, preferences, local recommendations and supported Reader extraction mainly occur on device. Full reading histories, article-by-article trails, complete search histories, private article copies and source-account credentials are not uploaded by default. We do not retain full third-party articles as your private cloud copies. Light Sync is not currently available; planned saved-item or preference sync is not current processing.
Opening an original article or source image may let that source process IP, cookies, device details and access records under its policy; this Policy does not replace it. News may locally count launches and openings of reading or search interfaces without content. App-statistics upload switches are off by default in official builds; a reserved service interface does not establish uploaded reading trails. Website, feed, model and software-download requests still create normal network requests and necessary security records.
9. DAWNBLOOM Mail
Mail is a third-party client with live provider connections. Messages mainly travel between your device and chosen provider; opening or returning to the foreground may directly check for new mail. DAWNBLOOM does not poll your mailbox from Tokyo or use its servers as repositories for bodies, attachments, complete messages or indexes, searches, mail passwords or provider authorization credentials. Caches and drafts are encrypted locally. Provider passwords, authorization codes, app-specific passwords and OAuth access/refresh credentials use device secure storage and are excluded from Light Sync. Connection methods depend on the provider and supported released platform.
Optional Light Sync can currently include theme, language, layout, column widths, font and density, swipe gestures, notification preferences, signature, light rules, default sender, pinned folders, masked account hints, display names, colors and ordering. Signatures and rules can contain limited text you enter; this is not message-body sync. A new device restores light settings and account hints and must authorize or connect the provider again. Notifications, attachment selection and local files use only permissions needed for the actual function, not contacts or precise location. Local usage counts contain no messages or search content; official app statistics upload is currently disabled.
10. DAWNBLOOM Download and cross-device tasks
Core downloading needs no account; files travel directly from source to device, without a DAWNBLOOM file relay. Tasks, completed and partial files, pieces and actual save paths remain local. Released versions support optional account and Light Sync for theme, language, layout, logical directory choice, concurrency and notification preferences. A logical directory is not the actual device path. If you separately enable cross-device tasks, sync may include task identifier, protocol, display name, safe public source identifier, size, creation/modification times and status summary. A name or source can reveal what you download; choose task sharing accordingly.
Cross-device tasks do not transfer files: another device downloads again from the original source. Full files, pieces, local contents, cookies, authorization headers, sensitive URL tokens, private tracker credentials and local paths are excluded from Light Sync. Source filtering rejects sensitive or unsafe identifiers; unsupported tasks stay local. FTP, FTPS and SFTP addresses and authentication are used only to connect to your specified server. Passwords or private keys follow device-side credential protection and task needs, not Light Sync; another device may need them entered again.
With BT, Magnet, ED2K or other peer-to-peer networks, your IP address, port and necessary protocol identifiers may be visible to trackers, distributed networks, peers or ED2K nodes. Your selected file server also processes connection information. This is not an anonymous-download guarantee. A third-party VPN follows its own network rules; DAWNBLOOM does not guarantee its anonymity.
11. DAWNBLOOM Archive
Compression and extraction need no account. Files, directory structures, names, content, archive passwords, actual paths and temporary files are processed on device, without upload for cloud extraction, scanning or server file analysis. File pickers or genuinely required file permissions determine access. Current Light Sync supports only language, default archive format and compression preset, not files, paths, filename lists, passwords, extracted contents or temporary files. Signing out or turning sync off does not delete local files.
12. DAWNBLOOM Token and reference content
Token uses the same DAWNBLOOM Account and handles binding status, authentication security data, device information and recovery/unbinding audits. Rotating codes are generated locally; binding, verification and security state still require service processing. We do not retain every plaintext rotating code in ordinary usage logs. Token security data is separated from mail, browsing and downloads and is not used for marketing.
The Token community follows the public-community rules. The museum mainly serves static reference content through a delivery network. Search, favorites and recent views follow the actual version’s functions; local records do not automatically become server profiles. Requests for public references or community content send necessary queries and normal network information, without obtaining other apps’ private content.
13. Orders payments refunds and billing
Website sales and payments follow channels actually open. Orders through Steam, Apple, WeChat Pay, Alipay or other providers follow that channel and applicable law; listing a provider does not mean every channel is open. Providers handle payment credentials; our business database does not store full card numbers, payment passwords or complete payment-account credentials. We may retain order number, item, amount, currency, time, channel, payment/refund status, delivery and necessary exchange-rate snapshots for fulfillment, reconciliation, support, disputes and compliance. Public rates are generally not personal information, but a rate version, currency and amount attached to an order form part of its transaction record.
Billing handles ordinary and minor refunds, unrecognized charges and other requests, including request identifier, account and contact email, order snapshots, currency/amount, your explanation, status and review records. Narratives remain in access-restricted services; notification email contains only necessary summaries and a viewing link, not full private explanations or evidence. Submission and review do not mean automated refund execution. Secure attachment upload is not currently open: do not email identity documents, passwords or full card details. If proof is necessary, first follow an appropriate support channel and the minimum requested scope.
A minor-refund review may, where necessary, involve purchase facts, guardianship and limited identity proof. Refund conclusions, order links, necessary reviews and corresponding permanent game-service restriction status may be retained for support, disputes, audits and account state, not advertising. Minor refunds do not open the game to minors. Full refund and game-restriction rules are in the Sales & Refund Terms; a privacy request does not replace refund review.
14. Support appeals and materials
For inquiries, bugs, asset concerns, recovery appeals, complaints and security reports, we receive messages, necessary account/order information, screenshots or limited attachments through an appropriate channel that you choose to submit. Use is limited to the request, related disputes, security and necessary legal duties, with access restricted to authorized staff and providers. Data is deleted or anonymized when those purposes end and no basis remains. Do not submit unrelated private files, full mailboxes, full card details or passwords.
Official email and social platforms handle messages, email addresses, attachments and necessary technical data under their policies. Spacemail serves official communications; it is not a repository for Mail users’ third-party mailboxes. We do not send promotional email, SMS or marketing private messages. Account verification, security, orders, support cases and major service matters may require notifications.
15. Cookies website and anonymous aggregate statistics
The website and account use necessary cookies and local storage for sign-in, language, request security, abuse prevention and requested functions, as described in the Cookie & Similar Technologies Policy. Third-party cookies and website storage belong to that site and differ from dawnbloom.net first-party cookies. Website and app permissions do not replace each other.
Website statistics count page paths, official file requests, mirror/store outbound visits and mini-game entries. IP and browser user agent are transient inputs to daily rotating deduplication hashes. The statistics database stores no raw IP, raw user agent, permanent visitor ID or replayable personal trail and does not link accounts. Temporary daily hashes are kept at most through the following day, then removed; counts aggregated by date, page, product or mini-game may remain. A file request or outbound click is not a completed download. Network-security services may separately log IP and request data for security.
We do not sell personal information, share it for cross-context behavioral advertising, create cross-product advertising profiles or use targeting cookies or third-party commercial ad tracking. Aggregates and necessary security processing do not amount to reading private content or marketing profiles. Local app counts and disabled upload designs are not described as live online analytics. Material processing changes will be disclosed before implementation with choices required by law.
16. Third-party services
Third parties receive information needed for the actual situation, not all product data. Cloudflare provides security and content delivery and may handle IP, request metadata and security records. Apple, Google, Microsoft, Steam and other platforms handle their stores, OS functions, sign-in or payments under their rules when used. Gmail, Microsoft, QQ, NetEase, iCloud or your chosen mail provider handles direct mail and authentication. Search providers, news sources, FTP and other file sources handle connections you initiate. A listed category does not mean every platform integrates every feature.
Support communications, social platforms or Baidu Netdisk/Google Drive mirrors you open, and necessary functional SDKs have their own rules. Section 7 explains ML Kit on-device translation and technical metadata. Consult providers’ policies for independent processing, retention and rights. A processor acting on our instructions differs from an independently operated service.
17. Sharing processing providers and disclosure
We do not disclose personal information to unrelated parties except for functions you choose, necessary processors, directly related security investigations, applicable law or competent-authority requests, protection of significant legitimate rights, or lawful organizational changes with safeguards. Public character, post, chat or transaction information is shown to other players within that function. We restrict processors’ purposes, scope, confidentiality and security duties and supervise them under applicable law, completing required consent or separate procedures first.
18. Data locations and international processing
Core account data, optional Light Sync and necessary content/support services are mainly processed by infrastructure in Tokyo, Japan. Cloudflare security and delivery may process requests in regions where it provides service. Local browsing, mail caches, downloads and extraction remain mainly on your device; mail communications are with your provider, original articles with their source and payment credentials with the payment platform. These network services may process information in their locations; this does not mean all local content is uploaded internationally.
Entering the game may send necessary character, asset and operational data to Mainland China game infrastructure. The game receives short-lived access credentials and minimal operational identity/language data, not full email, real name, birth date or complete account-security history. When Mainland China registration is offered, names/birth dates remain encrypted in China; account name, email, authentication and necessary security state may be transferred to Tokyo for unified services. Before required transfers we disclose destination, purpose, categories and rights and obtain separate consent as applicable. Overseas users entering the game may send necessary game data to China. Applicable assessments, contracts, consent or other mechanisms follow the actual situation; this Policy does not claim automatic satisfaction of every transfer requirement.
19. Security and incident response
We use reasonable technical and organizational measures proportionate to risk, including encrypted transport, password hashes, appropriate local encryption and secure storage, least privilege, access controls, necessary logs, restricted backups, multifactor authentication and audits. For theft, fraud, item duplication, anomalous assets, attacks, abusive refunds or account disputes, we may examine directly related login, transaction, asset, retained chat and support evidence with restricted purposes and access.
No system guarantees absolute security. For actual or suspected disclosure, alteration, loss or security incidents, we investigate, limit impact, remediate and notify affected users or authorities and cooperate as law requires. Security records are not repurposed for marketing; necessary held evidence follows Section 20.
20. Retention by category
Account and Light Sync: during account existence and the chosen function’s needs; delete or anonymize following applicable cloud deletion requests or final closure, subject to legal, dispute and security exceptions. Turning sync off or signing out does not erase existing cloud settings. Shared download-task metadata expires 72 hours after its last update; this does not delete files on your devices.
Game, social and asset ledgers: for account/function needs; ordinary chat defaults to 7 days. Necessary transactions, reports or evidence may be retained for investigations, disputes and legal duties. Public content also follows community deletion, moderation and shared-record rules.
Local Browser, Mail, Download and Archive data: controlled by your actions, product settings and OS rules until cleared or removed. Private sessions follow session limits and technical capabilities. Mail credentials remain locally until connection removal or authorization revocation; provider data follows provider retention. Uninstalling may not remove all files under OS rules, and downloads or user files can remain.
Orders, refunds and finance: retain for fulfillment, reconciliation, tax, finance, consumer protection and disputes. Support requests and attachments: retain only for handling, support, complaints, security and law; delete or anonymize when no longer needed. Age alone does not establish that a case is closed.
Security and fault records: the shortest reasonable period for service protection, investigations and law; where Chinese network-log duties apply, at least six months as required. Necessary evidence may be extended to a limited scope and removed/anonymized when its purpose ends. Website daily hashes last at most through the next day; aggregates may remain long term. Local app counts follow device-clearing rules.
We do not retain personal information indefinitely merely because it might be useful later. Where no fixed period can be given, purpose, law and disputes determine it. Records that cannot yet be lawfully deleted are restricted to storage, compliance and necessary protection, not daily-product use or marketing. Backup deletion follows safe rotation and recovery-protection procedures; backups do not justify continued use of deleted data.
21. Account closure cooling period and deletion
An account-closure request has a 15-day cooling period. Website/game access is suspended, the username and email remain reserved, and characters/assets remain intact but cannot be transferred, gifted or traded. Ordinary sign-in does not cancel the request; an explicit cancellation with credential verification is required to restore access. Closure does not evade penalties, negative balances or unresolved disputes.
After the period, without cancellation and after necessary deletion steps, credentials, sessions and tokens cease to work and game characters/assets become permanently unavailable, without transfer or restoration through re-registration. The username/email can be reused after final closure, but the new account has a new identity unrelated to old assets, forum identity or history. Ordinary account and associated cloud data is deleted or irreversibly anonymized. Shared forum, family, trade and ranking records may remain after identity links are removed, without deleting other people’s information. If a China-resident layer holds the associated identity record, its deletion/anonymization must be confirmed.
Minimum records for payments, refunds, fraud prevention, law, incidents and unresolved disputes may be lawfully retained. Closure does not automatically erase local files, mail caches, browser content or third-party mail accounts; manage those on device or with the provider. Cloud-sync or account deletion requests use actual account functions or Section 22. We do not promise unavailable one-click export or all-data deletion functions.
22. Your rights and request process
Under applicable law you may ask about processing, access/copy/correct/supplement data, request deletion, restriction or objection, withdraw withdrawable consent, turn Light Sync off, request closure and, where legal conditions are met, request portability or transfer, complain or seek explanations. Withdrawal does not affect prior lawful processing; withdrawing indispensable processing may prevent the corresponding service.
Start through Support’s privacy, account-management or contact links, or [email protected]. Identify the product, request type, associated account and necessary facts without passwords or unrelated proof. We may reasonably verify identity for high-risk requests and respond within applicable periods. If law permits restricting or refusing repetitive, fraudulent, excessive or rights-harming requests, we explain why. Device-only data we do not hold must be managed locally; third-party data requires requests to that party. There is no universal one-click archive export for all data.
23. Minors
Game accounts, gameplay, participation in DAWNBLOOM Community and related game-store services currently require 18+. Public-page viewing does not share that threshold. General-purpose core apps such as Browser do not gain a universal 18+ or birth-date requirement from this Policy; local laws, stores and destination-service age rules still apply. Minor refunds address actual or disputed spending without relaxing game eligibility. Minor/guardian proof is limited to review, support and law with appropriate protections, not child advertising profiles. Required guardian consent or special procedures precede relevant processing.
24. Mainland China
Where Chinese law applies, we follow lawful, fair, necessary and good-faith processing and disclose controller, purpose, method, categories, retention and rights channels. Mainland China registration availability follows the current account service. Where age eligibility is offered, Sections 4 and 18 govern domestic name/birth-date processing without sending the original fields to Tokyo. Required transfer notice, separate consent and safeguards precede transfers. Interface language does not determine legal region.
You may exercise applicable rights to know, decide, limit or refuse processing, access, copy, correct, supplement, delete, transfer where conditions are met and close an account through [email protected] or Support. We explain effects of withdrawing indispensable processing. Transfer compliance follows actual scale and legal conditions; internal counts do not replace legal procedures.
25. United States
Where state or federal privacy laws apply, we provide rights subject to their conditions, including access/knowledge, correction, deletion, portability, opting out of sale or sharing and appeals, without unlawful discrimination. Applicable California CCPA/CPRA rights can also include limiting certain sensitive-information uses. We do not sell personal information or share it for cross-context behavioral advertising; sale/sharing follow applicable legal definitions, not an assumption that necessary processors are advertising sales. We do not claim every state law applies unconditionally or that children’s privacy law is categorically inapplicable. Use Section 22; authorized agents or regulatory complaints may be available under applicable law.
26. Japan
For users in Japan, we specify purposes and generally use personal information within them, with necessary security controls and processor supervision. Where Japan’s APPI applies, we handle requests for disclosure, correction, suspension of use, erasure and suspension of third-party provision of retained personal data under its conditions. Core Japanese account data is mainly in Tokyo; entering the game may involve necessary game processing in China, without transferring all local private content.
For third-party provision or overseas processing subject to Japanese rules, we describe actual recipient categories, purposes, data and rights and provide required information, obtain necessary confirmations or apply other lawful safeguards. Legal requirements depend on the situation; a consent button alone does not satisfy every requirement. Japanese game-account age-range selection handles necessary adult eligibility without invented birthdays.
27. Policy updates
Changes to features, providers, data categories, law or security may require an updated Policy with version, revision and effective dates. Material changes are announced through the site, product notices or reasonable means. New sensitive processing, unnecessary tracking or material transfer changes receive additional notice and consent where law requires. The three languages align in data boundaries and legal meaning. The consumer privacy center is a readable explanation, not a replacement for this full Policy.
28. Contact us
Privacy and legal requests: [email protected]. Product, account and general support: [email protected]. Billing/refunds: the website Billing Center or [email protected]. Incidents and vulnerabilities: [email protected]. Support lets you choose the issue type; account settings manage access, devices, multifactor authentication and closure. We respond according to the request and applicable law. You do not need to publish personal details to make a request.
Privacy Policy →
