Draft for review. This text has not been checked by a lawyer and must be reviewed and completed (items in [brackets]) before Winnerly is launched.

Privacy Policy

Last updated: [date]. This policy explains what Winnerly, operated by [legal entity name and address], does with your data.

1. Data we collect

Account: your email address and your password, which is stored hashed by our authentication provider.
Plan: your plan, subscription status and the identifiers Stripe gives us for your customer record and subscription.
Your activity: the winners you unlock, the favorites you save and the private notes you write. Notes are visible only to you.
Technical data: a session cookie that keeps you signed in, and basic server logs.

We do not store your card details. Payments are processed by Stripe.

2. Why we use it

To provide the service, apply your plan's limits and keep your account secure.
To handle billing and subscriptions.
To contact you about your account, for example to confirm your email.

3. Cookies

We use only the cookies needed to keep you signed in. At this time we do not use advertising or analytics cookies. [Update this section if that changes.]

4. Who we share it with

We use service providers to run Winnerly: Supabase (database and authentication), Stripe (payments) and [hosting provider]. They process data on our behalf. We do not sell your data.

5. How long we keep it

[Retention periods to be defined.] You can ask us to delete your account and its data.

6. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to some uses. To exercise these rights, contact [contact email].

7. Changes

If we make a material change to this policy, we will tell you by email or in the app.