Privacy Policy

Winklr ("we", "us", or "our") operates the Winklr mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our App. By using the App, you agree to the practices described in this policy.

We are committed to protecting your privacy. Winklr is built on a privacy-first philosophy — we do not sell your personal data, we do not serve targeted advertisements based on your behaviour, and we minimise data collection to only what is necessary to operate the service.

1. Information We Collect

1.1 Information You Provide

• Account information — your first name, last name, email address, date of birth, and password when you register for an account.
• Profile information — your display name, bio, profile photos, videos, persona details, interest tags, and social media links that you choose to add.
• Messages — the content of messages you send and receive through the in-app chat, including text, photos, videos, and other attachments.
• Albums — photos and videos you upload to your profile albums.
• Support requests — any information you provide when contacting us for help or submitting feedback.

1.2 Information Collected Automatically

• Location data — with your permission, we collect your device's GPS coordinates to power the Discovery feature. Your exact location is never shared with other users; it is anonymised and used only to determine approximate proximity.
• Device information — device identifiers, device model, operating system version, and app version. Device identifiers are used for device-level blocking to protect you from harassment.
• Usage data — information about how you interact with the App, such as features used, time spent, and actions taken (e.g. profile views via Glances).
• Log data — server logs that may include your IP address, access times, and error reports for the purpose of maintaining and improving the service.

1.3 Information from Third-Party Services

• Age verification (Yoti) — during registration, Yoti processes a face scan to estimate your age. Yoti does not share your facial image with us. We receive only a confirmation of whether you meet the minimum age requirement (18+). Yoti discards the face scan immediately after verification. See Yoti's Age Verification Privacy Policy for details.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the service — to create and maintain your account, display your profile to other users, enable messaging, and power location-based discovery.
• Safety and security — to verify your age, enforce device-level blocks, moderate uploaded content for inappropriate material, prevent fraud, and protect the community.
• Communications — to send you verification codes, account notifications, and service-related emails (e.g. password resets, data export confirmations).
• Push notifications — to deliver real-time notifications about new messages and other activity, if you have enabled them.
• Improvement and analytics — to understand how the App is used so we can fix bugs, improve performance, and develop new features.
• Legal compliance — to comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We do not sell your personal data to third parties. We share your information only in the following limited circumstances:

3.1 With Other Users

When you use Winklr, certain profile information is visible to other users by design, including your display name, age (if enabled), profile photos, bio, persona details, and online status. Your email address, date of birth, and real name (if different from your display name) are never shown to other users.

3.2 With Service Providers

We use trusted third-party service providers to operate the App. These providers process data on our behalf and are contractually obligated to protect it:

• Amazon Web Services (AWS) — cloud hosting, data storage, and content moderation (AWS Rekognition is used to automatically review uploaded photos for inappropriate content).
• Yoti — age verification during registration.
• Firebase (Google) — push notification delivery.
• SendGrid (Twilio) — transactional email delivery (verification codes, data export emails).

3.3 For Legal Reasons

We may disclose your information if required to do so by law, or if we believe in good faith that such action is necessary to:

• Comply with a legal obligation or valid legal process.
• Protect and defend our rights or property.
• Prevent or investigate possible wrongdoing in connection with the service.
• Protect the personal safety of users or the public.

4. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Account data — retained for as long as your account is active. When you deactivate your account, your profile is removed from discovery and your account data is permanently deleted.
• Messages — retained while your account is active. View-once media is automatically deleted from the recipient's device after it has been viewed.
• Location data — used transiently for proximity calculations and cached briefly. We do not maintain a history of your locations.
• Server logs — retained for up to 14 days for operational and debugging purposes, then automatically deleted.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission using TLS/SSL for all connections.
• JWT-based authentication with two-factor verification (email OTP) on every login.
• Secure password storage using industry-standard hashing algorithms.
• Device-level blocking that prevents circumvention via new account creation.
• Automated content moderation to detect and remove inappropriate material.
• Access controls that limit internal access to personal data on a need-to-know basis.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to taking all reasonable steps to protect your information.

6. Your Rights and Choices

6.1 Access and Data Portability

You can request a copy of your personal data at any time from within the App. Go to Settings > Download Data and tap Request Data. Your data will be compiled and sent to your registered email address. This complies with GDPR data portability requirements.

6.2 Rectification

You can update your account and profile information at any time through the App's profile editing and settings screens.

6.3 Deletion

You can deactivate (delete) your account at any time by going to Settings > Account Details > Deactivate your account. Account deactivation is permanent — your profile is removed from discovery, your data is deleted, and you will be logged out immediately.

6.4 Location

You can revoke location permissions at any time through your device settings. You can also disable Discovery mode from within the App, which stops all location-based features and hides your profile.

6.5 Push Notifications

You can manage or disable push notifications through your device settings or the App's notification preferences.

6.6 Profile Visibility

You control what is visible on your profile. You can hide your age, disable Glances (profile view tracking), or turn off Discovery mode entirely to become invisible to other users.

7. Children's Privacy

Winklr is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. All users must complete age verification (powered by Yoti) during registration. If we become aware that a user is under 18, their account will be terminated immediately and their data deleted.

8. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence, including in the European Union, the United Kingdom, and the United States. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection laws, including GDPR.

9. Cookies and Tracking Technologies

The Winklr mobile app does not use cookies. We do not use third-party tracking or analytics SDKs for advertising purposes. We do not serve ads in the App and do not build advertising profiles based on your activity.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email. The "Effective date" at the top of this page indicates when the policy was last revised. Your continued use of the App after any changes constitutes acceptance of the updated policy.

11. Contact Us

Winklr Ltd is registered in England and Wales. Company number: 17294535. Registered office: 31 Cattle Market Street, Norwich, NR1 3DY.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• Email: privacy@winklr.app

If you are located in the European Economic Area and believe your data protection rights have not been addressed, you have the right to lodge a complaint with your local data protection supervisory authority.