Privacy Policy

This privacy policy applies to the WinBloom app (hereby referred to as "Application") for mobile devices, created by Ali Hassan Amin (hereby referred to as "Service Provider") as a free service. This service is intended for use "AS IS".

Effective date: 2026-03-25

Information We Collect

We collect the following categories of personal information:

Identity data: your display name and nickname (optional, provided by you).
Contact data: your email address (optional, provided by you or via Sign In with Apple or Google).
Authentication identifier: the unique user ID assigned by Apple or Google during sign-in, and the corresponding Supabase UUID.
App content: win entries you create, including title, note text, category, and timestamp.
Technical data: your IP address (collected automatically by Supabase, our infrastructure provider, for security purposes).

We do not collect precise geolocation, device identifiers, advertising identifiers (IDFA), or health data.

How We Use Your Information

Name / Nickname: to personalise the in-app display and the profile screen.
Email address: to identify your account. We do not send marketing emails.
Authentication identifier: to link your account to your data in our database.
Win entries: to store, display, and organise your personal wins within the app.
IP address: logged by our infrastructure provider (Supabase) for security and abuse prevention only.

No Tracking, No Advertising

WinBloom does not use advertising identifiers (IDFA), cross-app tracking SDKs, behavioural analytics tools, or any third-party advertising networks. We do not share your data with data brokers. Your usage of the app is not analysed to serve you targeted advertisements.

Sign In with Apple

The Application uses Sign In with Apple to authenticate users. When you sign in with Apple, Apple may provide us with your name and email address (or an Apple-generated private relay email address) at your discretion. We receive a unique Apple user identifier that persists across sign-ins. We do not receive your Apple ID password. Apple's privacy policy applies to the data Apple itself collects: https://www.apple.com/legal/privacy/.

Sign In with Google

The Application also supports Sign In with Google via OAuth. When you sign in with Google, Google may provide us with your name and email address. We receive a unique Google user identifier. We do not receive your Google password. Google's privacy policy applies to the data Google itself collects: https://policies.google.com/privacy.

Third-Party Data Processors

We use the following third-party service to operate the Application:

Supabase (Supabase Inc.)
Role: Backend database, authentication infrastructure, and file storage.
Data received: your authentication identifier, profile information, and win entries.
Supabase Privacy Policy — Supabase Terms of Service

We do not use Google Analytics, Firebase, advertising SDKs, or any third-party analytics.

Legal Basis for Processing (EEA / UK Users)

We process your personal data on the following legal bases:

Contract performance (Art. 6(1)(b) GDPR): processing your authentication data and win entries to deliver the service you requested.
Legitimate interests (Art. 6(1)(f) GDPR): retaining IP logs for security and fraud prevention.
Consent (Art. 6(1)(a) GDPR): processing optional profile fields (name, nickname, email) that you voluntarily provide.

You may withdraw consent for optional data at any time by editing or deleting your profile.

Data Retention

Win entries: retained until you delete them individually in the app, or until your account is deleted.
Profile information (name, nickname, email): retained until you edit or delete them, or delete your account.
Authentication identifier: retained until account deletion.
IP logs: retained by Supabase for up to 30 days for security purposes.
Upon account deletion: all personal data is permanently removed from our systems within 30 days.

Your Rights

Right to Delete Your Data
You can delete your account and all associated data directly within the app:
Profile tab → scroll to bottom → "Delete Account"
Upon deletion, all win entries, profile information, and your authentication record are permanently and automatically removed from our systems within 30 days. This deletion flow also removes your authentication user record through a secure backend deletion function.

Right to Access Your Data
You may request a copy of all personal information we hold about you by emailing ali.dev.hassan@gmail.com with the subject "Data Access Request." We will respond within 30 days.

Right to Correct Your Data
You can update your display name and nickname at any time in the app: Profile tab → "Edit Profile." To correct your email address, contact us at ali.dev.hassan@gmail.com.

Right to Data Portability (EEA / UK)
You may request an export of your personal data in a machine-readable format by emailing ali.dev.hassan@gmail.com with the subject "Data Portability Request." We will provide a JSON or CSV file of your win entries and profile data within 30 days.

Opt-Out
You can stop all collection of information by uninstalling the Application using the standard uninstall processes available on your mobile device or via the App Store.

Age Requirements

WinBloom is not directed at children. You must be at least 16 years of age to use this Application (or the minimum age required in your country, if higher). If you are under 16, do not use this app or provide any personal information. If we discover that a user is under the required minimum age, we will promptly delete their account and data.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains. However, no method of transmission over the internet or electronic storage is 100% secure.

Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of Canada, including the Personal Information Protection and Electronic Documents Act (PIPEDA). If you reside in the European Economic Area, the General Data Protection Regulation (GDPR) also applies to your personal data. If you reside in California, the California Consumer Privacy Act (CCPA) applies.

The data controller is: Ali Hassan Amin, Toronto, Ontario, Canada. Contact: ali.dev.hassan@gmail.com.

Changes to This Policy

This Privacy Policy may be updated from time to time. We will notify you of material changes via an in-app notification at least 30 days before the changes take effect. Continued use of the Application after the effective date of any changes constitutes your acceptance of the updated policy.

Your Consent

By using the Application, you are consenting to the processing of your information as set forth in this Privacy Policy now and as amended by us.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at ali.dev.hassan@gmail.com.

How can we help?

Get in Touch

Terms of Service

Privacy Policy