Privacy Policy

Account information. The owner's sign-in email and a hashed password. Nothing else is required to use Winn.

Connected platform accounts. When an account is connected through the platform's own authorization screen (OAuth), Winn receives and stores the access token and refresh token, the account's ID, name and profile picture, and token expiry time. Winn never sees or stores your platform passwords.

Content you create. Videos and images you upload, captions, hashtags, chosen channels and scheduled times, and the result of each publish (post ID, link, or error message).

Technical data. A session cookie to keep the owner signed in, and basic server logs from our hosting provider used for security and debugging. Winn uses no advertising or tracking cookies.

If you connect Pinterest, Winn requests only these permissions:

• user_accounts:read — to show which Pinterest account is connected.
• boards:read — to list your boards so you can pick where a Pin goes.
• pins:write — to create the Pins you schedule, on the board you chose.
• pins:read — to confirm a Pin was published and link to it.

Winn only creates Pins that you composed and scheduled yourself. It does not read your followers, messages, or other users' data, and it does not use Pinterest data for advertising, profiling, or any purpose other than publishing your own content. Use of Pinterest data follows the Pinterest Developer Guidelines.

• To publish your content to the accounts you selected, at the time you selected.
• To show your posts on the calendar and report whether each one was sent or failed.
• To refresh tokens so scheduled posts keep working without asking you to sign in again.
• To keep the service secure and fix problems.

Winn does not sell, rent or trade personal information. Content is sent only to the platform you chose to post to. Winn relies on these service providers to run:

• Vercel — hosts the web app.
• Supabase — stores the database.
• Cloudflare R2 — stores uploaded videos so platforms can fetch them.
• Zernio — publishes to TikTok and YouTube on our behalf, for those networks only.

We may disclose information if required by law.

Access and refresh tokens are encrypted at rest and only decrypted on the server when publishing. The database is never reachable from the browser. All traffic uses HTTPS.

• Uploaded videos are deleted from storage once every post using them has been sent, unless you keep them in your Library to post again. Removing them from the Library deletes them.
• Disconnecting a channel in Winn deletes its stored tokens immediately and cancels its scheduled posts.
• You can also revoke Winn's access at any time from the platform itself (for Pinterest: Settings → Security and logins → Apps).
• To have all of your data deleted, email vowpixel@gmail.com. We delete it within 30 days.

You can ask to access, correct or delete your information, or ask what we hold about you, by emailing us. Winn is operated from Malaysia and handles personal data in line with the Personal Data Protection Act 2010.

Winn is not intended for anyone under 18 and does not knowingly collect information from children.

If this policy changes, the new version will be posted on this page with a new “Last updated” date.

Vow Pixel, Malaysia · vowpixel@gmail.com · vowpixel.com