Privacy Policy

This policy explains how Winna handles information in the app and on this website. Your saved content is stored on your device and can sync through your private iCloud database. Some optional features also send information to the services below.

Your Saved Content and iCloud

Your vision, values, identities, goals, habits, tasks, routines, reflections, selected images and workout history are stored in the app on your device. With iCloud enabled, saved app content can sync between devices through your Apple Account's private iCloud database. Winna does not provide a public profile or share this database with other Winna users. Preferences and unfinished onboarding answers may remain local to a device.

You can edit or delete saved items in the app and manage iCloud access through your device's Settings. Deleting a synced item can also remove it from your other devices. Deleting the app does not automatically delete iCloud copies or information held by the services below.

Apple Text Generation

When you ask Winna to generate a vision, refine it or suggest an onboarding starter pack, the relevant answers, saved text and request are processed using Apple's models. Winna attempts Apple Private Cloud Compute when available, which processes the request off your device, and can fall back to Apple's on-device Foundation Models. Availability depends on your device, system version, language and Apple Intelligence settings. You can use manual editing instead. This text generation is separate from the personal narration service below.

Siri, Shortcuts, Search and Widgets

Winna makes the titles and identifiers of your habits, goals, tasks and today's chosen action available to Apple system features such as Shortcuts, Siri and Spotlight. Asking what matters today can also return whether that action is complete. The search index contains this limited display information, not your saved vision, descriptions, notes, reasons or recordings. Widgets use a local snapshot of the content they display.

Enabling Winna's App Lock suppresses these search donations and requests removal of its indexed titles. Deleted or changed items are reconciled when the app refreshes its index. You can also manage Siri and search access in Apple Settings. These changes do not erase information already saved in a shortcut or Siri conversation. Apple controls Siri processing, which can use on-device models or Private Cloud Compute; it is not always on-device. See Apple's privacy information. These system features do not send your saved vision to Winna's narration service.

Personal Narration

When you choose to create personal audio, Winna sends the selected text and voice choice through its Supabase-hosted audio service to ElevenLabs. Depending on what you choose to hear, this can include your saved vision, selected identities, task or daily commitment. The app explains this before you authorize generation. Narration uses a synthetic voice; this feature does not upload a recording of your own voice.

Winna keeps generated recordings in private server storage and may download them to your device for replay. With iCloud available, Winna also stores a copy in your Apple Account's private iCloud database. Your other devices can reuse the same saved text and voice recording without generating it again or spending more narration allowance. This library uses recording fingerprints and source identifiers to find matching audio; it is not shared through your purchase identity. New recordings wait for an iCloud check when that check is temporarily unavailable, to avoid duplicates. Its service also stores request identifiers, text fingerprints, character counts, generation metadata, purchase verification and usage records to provide access, enforce allowances and recover failed requests. The narration job ledger does not store the raw text; the text is handled while servicing the request. The recording itself contains your personal content.

ElevenLabs may retain submitted text and generated audio under its applicable terms and account settings. Winna's current integration does not use ElevenLabs Zero Retention Mode. See ElevenLabs' privacy policy and retention documentation. Clearing recordings in Winna does not automatically erase ElevenLabs' history or backups. Contact us about requests concerning those copies.

Fixed voice previews and workout guidance are prerecorded. Some are bundled with the app; optional voice packs are downloaded from Winna's public audio storage. Playing these fixed clips does not send your personal text for synthesis.

Service Identity and Purchases

Winna creates a private service identity with Supabase without asking you to register an email address. RevenueCat uses a separate anonymous purchase identifier to connect your subscription or one-time purchase to paid features and restore access across devices. For personal narration, Winna verifies Apple-signed purchase information alongside your private service identity; server recordings remain private to that service identity. Synced audio copies remain in your Apple Account's private iCloud library. Supabase and RevenueCat process service identifiers, purchase, subscription and lifetime entitlement status, transaction information and technical request information. Apple processes App Store payments; Winna does not receive your full payment card details.

For personal audio, Winna verifies purchase access and uses Apple App Attest, which provides app and device integrity proof. Our service retains verification keys, counters and related identifiers to protect recordings and prevent abuse. These pseudonymous records can be associated with your service identity even though no email sign-up is required.

Optional Usage Analytics

Share Usage Analytics is on by default unless you have already turned it off. You can turn it off or back on in Settings → Privacy; your choice is saved. When enabled, PostHog receives selected interaction events, such as completing onboarding or starting a workout, together with technical information such as app and system version, timing and an automatically generated analytics identifier. These events help us understand feature use and improve Winna. PostHog also derives and records approximate location, such as city or country, from your IP address for these analytics.

Winna does not attach your vision, interview answers or other saved prose to these events. We disable automatic screen and interaction capture, session replay and named person profiles. A generated identifier can still connect events from an app installation; this is not a promise of complete anonymity. Turning analytics off stops future app analytics collection; it does not itself delete events already received.

Crash and Performance Diagnostics

The production app uses Sentry to diagnose crashes, errors and performance problems. Reports can include stack traces, error categories, app and operating-system versions, device information and performance timings. Winna disables default personal information collection and removes user and request fields from error reports. We do not intentionally include your saved prose in diagnostic events. Service providers also receive network information needed to handle requests, such as an IP address.

Photos, Videos and Links You Choose

Searching for a photo sends your search words through Winna's Supabase service to Unsplash. Loading a result connects to the image provider, and selecting a photo reports a download to Unsplash. Adding a YouTube link requests its metadata and thumbnail from YouTube. Tapping play opens the video outside Winna in YouTube or your browser, where that service's privacy practices apply. Winna does not embed a video player. Link previews and links you open can contact the relevant website. These providers receive the requested search, URL or content identifier and technical network information, and their own privacy terms apply. You can add your own text and local images without using photo search or online video.

This Website and Messages to Us

If you joined the prelaunch waitlist, Supabase stores your email address, signup time and source IP address. We use the email to send the requested launch or product updates and the IP address to limit abuse. If you contact us, we receive your contact details and whatever you include in your message. Please avoid sending personal vision text or other sensitive content unless it is needed for your request. Website hosting providers also process technical requests needed to deliver the site.

Retention and Deletion

• Saved app content: Local and iCloud content remains until you delete it or manage its storage. Device and iCloud backups are managed separately through Apple.
• Personal audio: In Settings, use Personal audio → Clear to remove this device's downloads, your synced iCloud recordings, and request removal of this device's recordings from Winna's service. Your text stays. Deleting a saved source also queues removal of its associated recordings. Offline requests remain pending until the app can send them; the app provides a retry status. Other devices stop using removed iCloud copies after reconnecting and checking the deletion. iCloud copies remain until you clear them, delete their saved source or manage the app's iCloud storage; the server's retention period below does not delete your iCloud library.
• Server audio cleanup: Winna's cleanup process schedules recordings for removal after 30 days without access through its audio service. Replaying a downloaded file offline does not refresh that server period. Accepted deletion requests remove access and queue physical deletion; storage removal may take longer if a service is unavailable.
• Service records: Removing audio does not erase subscription, usage-accounting or abuse-prevention records, or cancel an Apple subscription. Those records have a separate purpose from the recording and may remain after it is removed.
• Waitlist, analytics and support: Contact us to request removal of information we can associate with you. Provider retention and backup arrangements also apply; deleting the app does not erase all server copies.

Deleting Your Service Account

Open Settings → Service Account → Delete Service Account to delete the private account Winna creates for personal narration. No email or support request is needed. After confirmation, services pause and Winna saves a retryable request on your device. Keep Winna installed until the request is accepted; after acceptance, server cleanup continues even if the app is closed. You can check the same screen for confirmation when deletion finishes.

This removes the private service identity and associated removable service data, including Winna's private recordings. The app also clears your synced iCloud audio before completing account deletion; keep it installed and connected while this cleanup is pending. The deletion worker also requests removal of associated ElevenLabs text/audio history using the provider receipts captured by Winna. Deletion stays pending while those requests or other required cleanup cannot be confirmed. Limited purchase-usage totals, pseudonymous purchase bindings, deletion receipts and security barriers remain to prevent fraud, repeated allowance claims and late uploads from restoring deleted recordings. Recording cleanup metadata is retained for at least seven days after removal to handle late uploads; it is then eligible for pruning. Provider backups and independently retained records remain subject to the provider arrangements described above.

Anonymous purchase records remain separately with Apple and RevenueCat so eligible purchases can be recovered on this or another device. Winna removes an isolated legacy RevenueCat service profile when it can verify that the profile is not shared with another purchase identity. For a separate request to erase purchase records, contact privacy@winna.app. Erasing shared purchase records can affect purchase recovery on all linked devices.

Your goals, habits, tasks and saved text on your devices and in your private iCloud storage are separate from this service account and stay available. Deletion does not cancel an Apple subscription. Use the subscription-management link on the deletion screen to cancel renewal if wanted. Winna does not reconnect services automatically after deletion. If you explicitly reconnect later, a new private account is created; Restore Purchases can recover eligible Apple purchases, but deleted recordings do not return and used narration allowance does not reset.

Security and Service Providers

Winna uses device storage protections, encrypted network connections for hosted services and access controls for private recordings. You can enable the app's PIN or biometric lock. Face ID and Touch ID verification is handled by Apple; Winna does not receive your biometric template. Personal narration is not end-to-end encrypted: Winna's service and the providers involved in hosting and synthesis can process accessible content to operate the service. No storage or transmission method is guaranteed to be completely secure.

Our providers include Apple, Supabase, RevenueCat, ElevenLabs, PostHog and Sentry. Optional media features also use Unsplash and Google/YouTube. Providers may process information outside your country. Their policies describe their processing locations and applicable transfer arrangements.

Your Choices and Requests

You can use manual editing, decline personal narration, turn off optional analytics, clear personal audio, and manage iCloud, notifications and subscriptions in the app or Apple Settings. Depending on applicable law, you may also have rights to access, correct, delete or obtain a copy of personal information, object to or restrict processing, withdraw consent and complain to your local data protection authority. Contact us using the address below. We may need limited information to locate the relevant records and verify your request.

Children's Privacy

Winna is not directed at children under 13. If you believe a child has provided personal information to Winna, contact us so we can review and address it.

Changes to This Policy

We may update this policy. The date above identifies the latest version.

Contact

For privacy questions or requests, contact privacy@winna.app.