Privacy Policy

TL;DR

We collect only what’s needed to run Winkle and improve it. We never sell your data. Winkle is designed for adult caregivers. Any child-related information is entered by a parent or caregiver, not collected directly from a child.

1. Who We Are

Winkle is operated by Winkle Sleep, LLC, based in New York, USA.

Under the GDPR, Winkle Sleep, LLC is the data controller for your personal data.

Questions? Contact us.

2. Information We Collect

Data about you, the account holder: Winkle is intended for use by adults, including parents, guardians, and other caregivers. We collect your email address for account creation, login, account security, and communication related to the app.

Data about your child: Winkle allows adult caregivers to enter information about a child, such as the child’s first name, date of birth, sleep events, and meal events. This information is used to provide age-based guidance, reminders, and tracking features. We do not collect information directly from children or knowingly allow children to create accounts.

• Account details: Your email address for login and account management via Firebase Authentication.
• Child details: First name and date of birth, entered by the parent or caregiver, to provide age-based insights.
• Event data: Sleep and meal events you track in the app.
• Analytics data: Usage analytics via Firebase Analytics / Google Analytics for Firebase to help us improve performance. We analyze this in an anonymized or aggregated way where possible.
• Crash and diagnostic data: Crash reports and technical diagnostics via Firebase Crashlytics to help us identify and fix app issues.
• Subscription data: Subscription status and purchase-related information processed through RevenueCat so we can provide access to paid features.

3. How We Use Your Information

• Provide insights about your child’s sleep and meals.
• Track sleep and meal activity that you choose to enter.
• Keep your account secure and the app functional.
• Manage subscriptions and access to paid features.
• Diagnose crashes, fix bugs, and improve app reliability.
• Improve Winkle by analyzing anonymized or aggregated trends where possible.

Legal bases (GDPR): performance of a contract (running the app and providing subscription features); your consent where required, such as for analytics; and our legitimate interest in improving performance, reliability, and security.

4. Sharing of Information

We do not sell or trade your personal data.

We use trusted third-party processors to operate the app:

• Firebase Authentication for account creation, login, and authentication.
• Cloud Firestore for Firebase for app data storage, including account-related data, child profiles, sleep events, and meal events. Firestore data is stored in the “nam5” United States multi-region.
• Firebase Crashlytics for crash reporting and technical diagnostics.
• Firebase Analytics / Google Analytics for Firebase for usage analytics in anonymized or aggregated form where possible.
• RevenueCat for subscription management, purchase status, and access to paid features.

These providers may process data in the United States. For transfers from the EEA/UK, Google makes use of Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard international data transfers. RevenueCat may also process data in accordance with its own data processing terms and applicable transfer safeguards.

5. Data Security

We use industry-standard security measures. Firebase Authentication and Firestore apply encryption and security controls to help protect your data from unauthorized access, alteration, disclosure, or destruction.

6. Data Retention and Deletion

We keep your account and app data for as long as your account remains active, or as needed to provide Winkle’s features. We may retain anonymized or aggregated data to help improve the app.

You can delete your account in the app by going to Main Menu → Settings → Account.

By default, deleting your account deletes your Firebase Authentication record only. This means your login account is removed, but child profiles and sleep or meal data that you created may remain in Firestore. This is intentional so that, if you create a new account later, your original child and activity data may still be available.

When deleting your account, Winkle provides an optional checkbox labeled “Optional: delete all children, including sleep and meal data?” If you select this option, Winkle will delete the child profiles directly owned by your account, including their associated sleep and meal data.

This optional deletion does not delete child profiles that were shared with you by another caregiver, because those child profiles are owned by another account.

If you delete your account without selecting the optional data-deletion checkbox, your child and activity data may remain in Firestore after your Firebase Authentication record is deleted. You may lose access to that data unless you create a new account that can be reconnected to the retained data.

You may also request deletion of your data. See delete your data for more information.

7. Your Rights

Under GDPR, you can:

• Access the data we hold about you.
• Request correction or deletion of your data.
• Restrict or object to certain processing.
• Request a copy of your data (data portability).
• Withdraw consent at any time where processing is based on consent, such as analytics where applicable.
• Lodge a complaint with your local data protection authority.

To exercise these rights, delete your account in the app by going to Main Menu → Settings → Account, or contact us. If you wish to withdraw consent for analytics, contact us and we’ll assist.

8. Children’s Data

Winkle is intended for use by adult parents, guardians, and caregivers. Children may not create accounts or use Winkle directly.

We collect a child’s first name, date of birth, and sleep or meal activity only when that information is entered by an adult caregiver. We do not knowingly collect personal information directly from children.

9. Consent & Account Deletion

By using Winkle, you agree to this Privacy Policy. You can withdraw consent where applicable, request deletion, and/or delete your account at any time from Main Menu → Settings → Account. Account deletion and deletion of child/activity data are separate choices, as described above. For help, please contact us.

10. Changes to This Policy

We may update this policy from time to time. We’ll post changes here and update the “Last updated” date above. If changes are significant, we’ll notify you in the app where appropriate.

Contact Us

If you have any questions about our privacy policy, please contact us.