Privacy Policy — Win Words

Effective Date: July 5, 2026

This Privacy Policy explains what data Win Words (“we”, “us”, “the app”) collects, how we use it, who we share it with, and the choices you have. By using Win Words you agree to this policy.

1. Data We Collect

• Account information: email address, username, display name, and a securely hashed password.
• Optional profile details: profile photo, bio, date of birth (used only for age verification; the exact date can be hidden), country, city, pronouns, occupation, education, relationship status, languages, website, and social handles.
• User-generated content: posts, images, polls, videos, Stories, comments, reactions, messages and voice notes you create.
• Interaction metrics: likes, follows, views, XP, coins, badges and referral codes.
• Purchase records: for coin purchases we store the Google Play order ID only — we never store card or payment details.
• Device & technical data: app version, operating system, device model, language, timezone, and crash diagnostics (via Firebase Crashlytics).

We do not collect your GPS location, your contacts, or your activity in other apps.

Approximate Location (Country / Region)

Win Words automatically detects your country from your IP address and/or mobile network in order to set your profile region, personalize content, and meet regional requirements. This is country-level information only — it does not reveal your street, address, or precise (GPS) position. You can change your country at any time in your profile settings.

2. How We Use Your Data

• Authentication and account security.
• Delivering your feed and push notifications.
• Service announcements.
• Processing and operating purchases.
• Safety and moderation (content filtering, on-device image checks, and reviewing reports).
• Advertising (see Section 4).
• Anonymous analytics to improve the app.
• Legal compliance.

We do not build advertising profiles about you and we do not sell your data.

3. Third-Party Services

We rely on the following third-party services. Each processes only the data needed for its function and under its own privacy policy:

• Google Firebase — Authentication, Firestore database, Cloud Storage, Cloud Messaging (push notifications), Crashlytics (crash reports) and Analytics.
• Google Sign-In (optional) — if you sign in with Google, we receive your name, email and profile picture only.
• Google AdMob — advertising (see Section 4).
• Meta (Facebook) App Events — we use Meta’s App Events SDK to measure app installs and the effectiveness of our advertising. It may collect device identifiers, your advertising ID and app-usage events and share them with Meta Platforms, Inc. See Meta’s Privacy Policy: facebook.com/about/privacy.
• Cloudinary — hosting and delivery of images and videos.
• Backblaze B2 (delivered via Cloudflare CDN) — hosting and delivery of short-video content (WinClips) and some media, served over a secure CDN.
• ImgBB — hosting of some profile pictures.
• YouTube (Google) — our watch-party “Rooms” embed the YouTube player to play videos chosen by users. Use of the embedded player is subject to the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy). YouTube may collect data and set cookies when a video is played.
• Google Play Billing — processes coin purchases; we receive an order ID only, never your card or payment details.
• GIPHY — GIF search (your search terms are sent to GIPHY).
• Pixabay — royalty-free background music tracks.
• AcoustID — audio fingerprinting to detect copyrighted music in uploads.

4. Advertising

We show ads through Google AdMob and Meta Audience Network (banner, interstitial, rewarded and native formats). To serve and measure ads, these advertising networks and our measurement partner Meta App Events may access your device’s advertising ID and limited device/usage data.

• Users under 18 are served non-personalized ads only.
• Meta Audience Network’s advertising data practices are described in Meta’s Privacy Policy.
• Users in the EEA, the UK and certain US states are shown a consent choice (via Google’s User Messaging Platform) before any personalized ads are served.
• We do not sell your personal data to advertisers or data brokers, and we do not build cross-app advertising profiles about you.
• To learn how Google uses data from apps that use its services, see policies.google.com/technologies/partner-sites.

Data Sharing

We share data only as described in this policy: with the service providers listed in Section 3 (to run the app), for advertising and measurement as described in Section 4, and where required by law. We do not sell your personal data.

5. Data Retention

• Direct messages & Stories: auto-delete after 24 hours.
• Polls: 6 hours.
• Image posts: 30 days.
• WinClip videos: 45 days.
• Pic Battle entries: for the duration set by the user.
• Text posts & engagement: kept until you delete them.
• Purchase records: retained for fraud prevention, accounting and legal compliance.
• Account data: deleted within 30 days of a deletion request.

6. Children’s Privacy

Win Words is not directed to children under 13 (16 in the EEA). We do not knowingly collect data from children under 13. If a child has registered, contact us and the account will be deleted within 7 days. Please also see our separate Child Safety Standards page.

7. Your Rights & Choices

You can access, edit, export and delete your data; make your account private; post anonymously; block or mute other users; and report content. You can delete your account from the in-app menu (Settings → Account Management → Delete Account) or by email. We respond within 7 days.

8. Security

Data is encrypted in transit (HTTPS/TLS) and at rest (by Google and Cloudinary), passwords are hashed, and we require re-authentication for sensitive actions. In the event of a data breach we will notify affected users within 72 hours.

9. International Transfers

Your data may be processed on servers in the United States and Europe via Google Cloud, Cloudinary, ImgBB and Backblaze B2 (Cloudflare CDN). By using the app you consent to these transfers.

10. Changes to This Policy

We will announce updates in-app at least 7 days before they take effect.

11. Contact

Email: iftikhar.digitalmarketer@gmail.com (we respond within 7 days).