This Privacy Notice explains how Win Your Day ("we", "us", "our") collects, uses, and shares personal data when you use Win Your Day (the "Service"). We are the data controller for the personal data described here.
1. Data We Collect
- Account data — email address and (if you use Google sign-in) your Google account identifier and profile email.
- Task data — the tasks you create, dates, completion status, and AI verification results.
- Photos — images you upload as proof of task completion.
- Usage & device data — basic technical information such as IP address, browser type, and timestamps, collected via server logs.
- Billing data — collected and stored by our payment provider Paddle, not by us. We receive limited information such as your subscription status and plan.
2. How We Use Your Data
- To create your account and provide the Service (legal basis: performance of a contract).
- To run AI verification on the photos you submit (legal basis: performance of a contract).
- To operate, secure, and improve the Service and prevent fraud (legitimate interests).
- To respond to your requests and provide support (performance of a contract, legitimate interests).
- To comply with legal obligations (legal obligation).
3. Sharing & Subprocessors
We share personal data with the following categories of recipients:
- Hosting & backend — Lovable Cloud (which uses Supabase for database, authentication, and file storage) hosts and processes account, task, and photo data.
- AI verification — photos and task titles are sent to the Lovable AI Gateway, which routes them to a large-language-model provider (currently Google Gemini) to produce a verdict. Photos are not used to train models by us.
- Merchant of Record — Paddle handles all payments, subscription management, tax compliance, invoicing, and refund processing. Paddle is an independent data controller for payment data; see Paddle's Privacy Policy.
- Authentication — if you sign in with Google, Google receives limited sign-in data as described in Google's privacy policy.
- Professional advisers and authorities — where required by law.
4. Data Retention
We keep account and task data for as long as your account is active. Photos are kept while associated with a task. When you delete your account, associated data is deleted or anonymised within a reasonable period, except where we are required to retain it (e.g. financial records held by Paddle).
5. Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. You may withdraw consent where processing is based on consent. To exercise any of these rights, contact us at help@winyourday.life.
If you are in the UK or EEA, you can also lodge a complaint with your local data protection authority. We aim to respond to requests within one month.
6. International Transfers
Our subprocessors may process data in countries outside your own, including the United States. Where transfers leave the UK/EEA, we and our subprocessors rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
7. Security
We use appropriate technical and organisational measures — including encryption in transit, access controls, and row-level security on the database — to protect your data. No system is perfectly secure; we cannot guarantee absolute security.
8. Cookies
We use essential cookies and local storage to keep you signed in and to remember your preferences. We do not use marketing cookies. Paddle may set cookies during checkout to support payment processing.
9. Children
The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children.
10. Changes to This Notice
We may update this Privacy Notice from time to time. Material changes will be surfaced in the app or by email.
11. Contact
For privacy questions, contact us at help@winyourday.life.