Privacy Policy _ Win Words

Privacy Policy — Win Words

Effective Date: August 8, 2026

This Privacy Policy explains what data Win Words (“we”, “us”, “the app”) collects, how we use it, who we share it with, and the choices you have. By using Win Words you agree to this policy.

1. Data We Collect

• Account information: email address, username, display name, and a securely hashed password. You can sign up with your email, or with Google or Facebook — in which case we receive your name, email and profile picture from that provider to create your account.
• Optional profile details: profile photo, cover image, bio, tagline, date of birth (used only for age verification; the exact date can be hidden), country, city, pronouns, occupation, education, relationship status, languages, website, social handles, and — for creator/business profiles — a category, a public business email (only if you verify it) and the services you list.
• User-generated content: posts, images, polls, videos, Stories, comments, reactions, messages and voice notes you create.
• Interaction metrics: likes, follows, views, XP, coins, badges and referral codes.
• Purchase records: for coin purchases we store the Google Play order ID only — we never store card or payment details.
• Device & technical data: app version, operating system, device model, language, timezone, and crash diagnostics (via Firebase Crashlytics).

We do not collect your GPS location, your contacts, or your activity in other apps.

Approximate Location (Country / Region). Win Words automatically detects your country from your IP address and/or mobile network in order to set your profile region, personalize content, and meet regional requirements. This is country-level information only — it does not reveal your street, address, or precise (GPS) position. You can change your country at any time in your profile settings.

2. How We Use Your Data

• Authentication and account security.
• Sending sign-in verification codes and account emails.
• Delivering your feed and push notifications.
• Service announcements.
• Processing and operating purchases.
• Safety and moderation (content filtering, on-device image checks, and reviewing reports).
• Advertising (see Section 4).
• Anonymous analytics to improve the app.
• Legal compliance.

We do not build advertising profiles about you and we do not sell your data.

3. Third-Party Services

We rely on the following third-party services. Each processes only the data needed for its function and under its own privacy policy:

• Google Firebase — Authentication, Firestore database, Cloud Storage, Cloud Messaging (push notifications), Crashlytics (crash reports) and Analytics.
• Google Sign-In (optional) — if you sign in with Google, we receive your name, email and profile picture only.
• Facebook Login (optional) — if you sign in with Facebook, we receive your name, email and profile picture from Meta to create your account. Your use of Facebook Login is also governed by Meta’s Privacy Policy (facebook.com/about/privacy).
• Email delivery providers (Brevo, Mailjet, MailerSend, SendGrid, Resend) — used to send sign-in verification codes, account notifications and optional newsletters. They process your email address solely to deliver these messages.
• Google AdMob — advertising (see Section 4).
• Meta (Facebook) App Events / Audience Network — we use Meta’s SDKs to measure app installs, the effectiveness of our advertising, and to serve ads. They may collect device identifiers, your advertising ID and app-usage events and share them with Meta Platforms, Inc. See Meta’s Privacy Policy: facebook.com/about/privacy.
• Cloudinary — hosting and delivery of images and videos.
• Backblaze B2 (delivered via Cloudflare CDN) — hosting and delivery of short-video content (WinClips) and some media, served over a secure CDN.
• ImgBB — hosting of some profile pictures.
• YouTube (Google) — our watch-party “Rooms” embed the YouTube player to play videos chosen by users. Use of the embedded player is subject to the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy). YouTube may collect data and set cookies when a video is played.
• Google Play Billing — processes coin purchases; we receive an order ID only, never your card or payment details.
• GIPHY — GIF search (your search terms are sent to GIPHY).
• Pixabay — royalty-free background music tracks.
• AcoustID — audio fingerprinting to detect copyrighted music in uploads.

4. Advertising

We show ads through Google AdMob and Meta Audience Network (banner, interstitial, rewarded and native formats). To serve and measure ads, these advertising networks and our measurement partner Meta App Events may access your device’s advertising ID and limited device/usage data.

• Users under 18 are served non-personalized ads only.
• Meta Audience Network’s advertising data practices are described in Meta’s Privacy Policy.
• Users in the EEA, the UK and certain US states are shown a consent choice (via Google’s User Messaging Platform) before any personalized ads are served.
• We do not sell your personal data to advertisers or data brokers, and we do not build cross-app advertising profiles about you.
• To learn how Google uses data from apps that use its services, see policies.google.com/technologies/partner-sites.

Data Sharing. We share data only as described in this policy: with the service providers listed in Section 3 (to run the app), for advertising and measurement as described in Section 4, and where required by law. We do not sell your personal data.

5. Public Profiles & Search Visibility

Win Words lets you create an optional public profile (for example a creator or business profile) at winwords.online/profile/<your-username>. If you create one, the information you choose to add — your username, display name, profile photo, cover image, bio, tagline, category, country, the services you list, your website and social links, and a business email only if you verify it — is publicly visible and may be indexed by search engines such as Google and Bing so that people can find your profile.

Your private sign-in email (the email you log in with) is never made public. Only a separate business email that you explicitly add and verify can appear on your public profile.

Any blog articles you choose to publish on winwords.online are also public and may be indexed by search engines. You can edit or remove your public profile information at any time from your profile settings. Making your in-app account private is a separate setting from your public web profile.

6. Data Retention

• Direct messages & Stories: auto-delete after 24 hours.
• Polls: 6 hours.
• Image posts: 30 days.
• WinClip videos: 45 days.
• Pic Battle entries: for the duration set by the user.
• Text posts & engagement: kept until you delete them.
• Purchase records: retained for fraud prevention, accounting and legal compliance.
• Account data: deleted within 30 days of a deletion request.

7. Children’s Privacy

Win Words is not directed to children under 13 (16 in the EEA). We do not knowingly collect data from children under 13. If a child has registered, contact us and the account will be deleted within 7 days. Please also see our separate Child Safety Standards page.

8. Your Rights & Choices

You can access, edit, export and delete your data; make your account private; post anonymously; block or mute other users; and report content. You can delete your account from the in-app menu (Settings → Account Management → Delete Account) or by email. We respond within 7 days.

9. Security

Data is encrypted in transit (HTTPS/TLS) and at rest (by Google and Cloudinary), passwords are hashed, and we require re-authentication for sensitive actions. In the event of a data breach we will notify affected users within 72 hours.

10. International Transfers

Your data may be processed on servers in the United States and Europe via Google Cloud, Cloudinary, ImgBB and Backblaze B2 (Cloudflare CDN). By using the app you consent to these transfers.

11. Changes to This Policy

We will announce updates in-app at least 7 days before they take effect.

12. Contact

Email: iftikhar.digitalmarketer@gmail.com (we respond within 7 days).