Privacy Policy

1. Overview & Commitment to Couples' Privacy

Winkora ("we", "us", or "our") provides an intimate digital space designed exclusively for two connected partners. This Privacy Policy explains transparently what data we collect, how it is stored and utilized, and the extensive controls you retain over your information when using our iOS application, web-based companion features (such as Color Together), and associated online services (collectively, the "Service").

By creating an account, accessing, or interacting with Winkora, you consent to the practices described in this policy.

2. Information We Collect

We strictly limit our data collection to what is technically necessary to deliver a fluid, delightful, and private couple experience:

A. Account & Profile Credentials

• Authentication: Email address and salted cryptographic password hashes, or Apple Sign-In identifiers (including Apple Private Relay emails).
• Couple Profile: Display nickname, avatar image (optional), birth date, and partner connection status.
• Pairing Tokens: Ephemeral 6-character invitation codes generated to establish mutual partner connections.

B. Shared Couples Content

• Nest Data: Mood selections (e.g., "In Love", "Cuddly"), customized couple notes, anniversary dates, and pinned milestones.
• Messages & Whispers: Encrypted text messages, photo memories exchanged in the private chat, and ephemeral rendezvous location coordinates explicitly shared by you via Apple MapKit.
• Moments & Duets: Couple daily photos uploaded for the Daily Duet feature, shared moments, comments, and reaction emojis.
• Color Together Canvas: SVG vector fill coordinates and canvas color states saved in your collaborative studio.

C. Technical & Diagnostic Information

• Device model, iOS operating system version, hardware identifier, IP address, and application crash diagnostics required to maintain service availability and network resilience.

3. How We Process Your Data

We process your data exclusively for the following operational purposes:

• Facilitating instant synchronization between your device and your verified partner's device.
• Ensuring only verified couple members can decrypt and access your shared Nest, Chat, and Moments.
• Delivering push notifications (via Apple Push Notification service and Firebase) when your partner sends a message, completes a Daily Duet, or proposes a date.
• Diagnosing technical faults, preventing abuse, and safeguarding our infrastructure against unauthorized intrusion.

4. Security & Apple Keychain Protection

Your privacy is fortified by state-of-the-art iOS platform security and robust backend design:

• Hardware Keychain Isolation: Session tokens and authentication keys are stored within the native Apple Secure Enclave / iOS Keychain. Even if a device backup is restored elsewhere, keys remain non-exportable.
• TLS/HTTPS Transport Encryption: All client-to-server traffic is conducted exclusively over TLS 1.3 encryption with strict content-type verification.
• Zero Public Directory: Winkora does not maintain a searchable user catalog, follower directory, or public web view of any user content.

5. Third-Party SDK Disclosures

To ensure reliable push delivery, application stability, and accurate install attribution, Winkora integrates select third-party SDK adapters. These providers are bound by strict confidentiality and data protection obligations:

• Firebase (Google LLC): Utilized for application crash analytics and background push notifications (FCM / APNs).
• Adjust (Adjust GmbH): Utilized for privacy-safe marketing attribution and campaign measurement, adhering strictly to Apple's App Tracking Transparency (ATT) framework.
• Facebook SDK (Meta Platforms, Inc.): Configured strictly for core measurement events with restricted data use enabled.

We do not supply your private messages, shared photos, or couple notes to any third-party ad networks or marketing brokers.

6. Cookies and Local Storage Technologies

Our official website and web features (such as Color Together) do NOT use third-party advertising or cross-site tracking cookies. We utilize only essential browser local storage (localStorage / sessionStorage) strictly necessary to preserve your selected canvas template, temporary color palette state, and authentication tokens.

7. Data Retention & Erasure Policy

We retain your personal data and shared memories only for as long as your couple space remains active and registered. If an account is inactive for more than 180 consecutive days, or upon explicit disconnection, temporary cache files and pending sync queues are purged.

8. Account Deletion & Permanent Data Erasure (Apple Guideline 5.1.1(v))

To permanently delete your account:

1. Open the Winkora app on your iOS device.
2. Navigate to the Us (Settings) tab.
3. Tap Account Security & Privacy → Delete Account.
4. Confirm your intent.

What Happens Upon Deletion:

• Your couple space is immediately terminated, uncoupling your partner.
• All private messages, shared photos, Daily Duet submissions, and Nest notes authored by your account are permanently erased from our production databases.
• Your authentication tokens are invalidated across all active devices within seconds.

⚠️ Note: Deleting your Winkora account does not automatically cancel auto-renewing subscriptions managed through your Apple ID. You must cancel active subscriptions in iOS Settings → Apple ID → Subscriptions.

9. GDPR Data Subject Rights (European Users)

If you are located in the European Economic Area (EEA) or UK, you enjoy the following statutory rights under the GDPR:

• Right of Access & Portability: Obtain confirmation of processing and receive a machine-readable export of your personal data.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to Be Forgotten"): Request immediate destruction of personal records.
• Right to Restrict or Object: Restrict processing or object to legitimate interest processing.
• Right to Lodge a Complaint: Lodge a grievance with your local Data Protection Supervisory Authority.

10. California Privacy Rights (CCPA / CPRA Notice)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures:

• No Sale or Sharing of Personal Data: Winkora does NOT sell your personal information to third parties, and does NOT share your personal data for cross-context behavioral advertising.
• Shine the Light Law: We do not disclose personal information to third parties for their direct marketing purposes.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service for exercising your California privacy rights.

11. Security Breach Protocol

We employ multi-layered cryptographic safeguards to protect your personal data. In the unlikely event of a security incident that compromises the confidentiality of your personal information, Winkora will notify affected users and competent regulatory authorities within 72 hours of confirmation, in compliance with applicable international law.

12. Children's Privacy

Winkora is strictly intended for individuals aged 17 and older. We do not knowingly collect or solicit personal information from children under 17. If we discover that personal data of a minor has been collected, it is expunged immediately.

13. Contact Our Data Protection Team

For inquiries regarding this Privacy Policy, data subject requests, or security disclosures, please contact our dedicated Data Protection Officer:

Email: privacy@winkora.app
Response Time: Within 48 business hours.
Data Protection Officer: Winkora Privacy & Compliance Office