Privacy Policy

Effective date: 23 July 2026  ·  Last updated: 23 July 2026

1.Who we are

Winnabit is operated by Winnabit Ltd, a company registered in England and Wales (company number 16979558), with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Winnabit Ltd is the data controller of the personal data described in this policy, which means we decide how and why it is processed.

For anything related to your personal data, contact us at support@winnabit.co.uk.

This policy applies to the Winnabit mobile app (iOS and Android), our website, and our pre-launch waitlist.

2.What we collect

• Account data — your name, email address, username, date of birth (used for age verification), and profile photo.
• Health and fitness data — steps, workouts, and activity data from Apple HealthKit (iOS) or Google Health Connect (Android), read only with your explicit permission and used solely to verify challenge completion.
• Location data — collected only during an active location-based challenge session that you manually start (see section 7).
• Contacts — if you choose to enable contact sync, we access your phone contacts to help you find friends on Winnabit and send group invites.
• Photos and camera — if you choose to grant access, for setting a profile picture and submitting photo-based challenge proof.
• Usage and device data — your challenge activity, token balances and transfers, group membership, device identifiers, and crash and diagnostic data.
• Advertising data — the app shows rewarded ads through Google AdMob; the AdMob SDK collects advertising identifiers (see section 8).

Health, location, contacts, and photo access are all controlled by device-level permissions that you can grant or revoke at any time in your device settings. The app works without them, though features that depend on them (such as certain challenge types) will be unavailable.

3.How we use your data

• Running your account and groups — creating your profile, letting you join friend groups, and showing your username and profile photo to other group members.
• Verifying challenges — checking steps, workouts, activity, venue presence, or photo proof against the rules of a challenge you have joined, and settling token stakes based on the outcome.
• Managing tokens — recording token balances, stakes, forfeits, transfers between group members, and redemptions for brand rewards. Tokens are a virtual currency with no real-money value.
• Finding friends — matching your synced contacts against registered users so you can invite them to groups.
• Notifications — sending push notifications about your challenges, groups, and account via Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM).
• Showing rewarded ads — displaying ads that grant you tokens when watched.
• Keeping the app working and safe — diagnosing crashes, preventing cheating and abuse, and securing accounts.
• Age verification — using your date of birth to confirm you are at least 13.

Other members of your groups can see your username, profile photo, challenge participation and results, and related token stakes and transfers within that group. That visibility is the point of the app — accountability to your friends — so only join groups with people you are happy to share that with.

4.Lawful bases for processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for every use of your personal data:

Where we rely on legitimate interests, we have balanced those interests against your rights and only proceed where your rights do not override them. You can object at any time (see section 10).

5.Who we share your data with

We do not sell your personal data. We share it only with:

• MongoDB — our backend and database provider (MongoDB Atlas), which hosts account, challenge, token, and group data on our behalf.
• Google AdMob — our advertising provider, which receives advertising identifiers and ad-interaction data to serve rewarded ads (never health or precise location data — see sections 6 and 7).
• Apple (APNs) and Google (FCM) — to deliver push notifications; they receive a device push token.
• Get Waitlist — which processes email addresses for our pre-launch waitlist.
• Other members of your groups — who can see your profile, challenge participation and results, and related token activity within the group.
• Professional advisers and authorities — where required by law, to enforce our terms, or to protect the rights, safety, or property of Winnabit or others.

Apple HealthKit and Google Health Connect are sources of data, not recipients: the app reads from them with your permission and never writes your Winnabit data back to them or shares their data onward except as described in section 6.

Our service providers act as processors under contracts that meet UK GDPR requirements and may only use your data on our instructions.

6.Health and fitness data

With your explicit permission, Winnabit reads steps, workouts, and activity data from Apple HealthKit (on iOS) or Google Health Connect (on Android). We use this data for exactly one purpose: verifying that you have completed a challenge — for example, confirming you hit your step target or logged a workout.

Group members see the outcome of your challenge (for example, "goal met" and the relevant progress metric, such as your step count toward the target) — that is how accountability works in Winnabit. They never get access to your underlying health records.

You can revoke Winnabit's access to HealthKit or Health Connect at any time in your device settings. Doing so withdraws your consent; challenges that need that data can no longer be verified.

7.Location data

Winnabit collects your location only during an active location-based challenge session — for example, a gym challenge where the app verifies you are at the gym. Specifically:

• You start it. Location tracking begins only when you manually start a challenge session in the app.
• It is time-limited. A session lasts a maximum of 2 hours and tracking stops automatically when the session ends or the limit is reached.
• Background tracking is session-only. While a session is running, the app tracks your location — including when the app is in the background — solely to verify you remain at the venue. This is why the app requests background location permission.
• Never otherwise. Outside an active session, the app does not collect your location. Ever.

You can revoke the location permission at any time in your device settings; location-based challenges will then be unavailable.

8.Advertising

Winnabit shows rewarded ads through Google AdMob: you watch an ad and earn tokens. To serve and measure ads, the AdMob SDK collects your device's advertising identifier (Apple IDFA or Google Advertising ID), IP address, and ad-interaction data. Depending on your consent choices, ads may be personalised or non-personalised.

You can limit this at any time:

• iOS — decline the App Tracking Transparency prompt, or turn off tracking in Settings → Privacy & Security → Tracking.
• Android — delete or reset your Advertising ID in Settings → Privacy → Ads.

Google's use of this data is described in Google's privacy policy. Health, fitness, and precise location data are never shared with AdMob or any other advertising service (see sections 6 and 7). Users we know to be under 18 are served non-personalised ads only.

9.Children's privacy

Winnabit is for users aged 13 and over. We ask for your date of birth at sign-up to verify this, and we do not knowingly allow anyone under 13 to create an account. If we learn that a child under 13 has an account, we will delete it and the associated data. If you believe a child under 13 is using Winnabit, contact support@winnabit.co.uk.

We design Winnabit in line with the ICO's Age Appropriate Design Code (Children's Code). For users under 18:

• High-privacy defaults — profiles and activity are visible only to members of groups they choose to join; nothing is public.
• No exploitation — we do not use children's data for personalised advertising, profiling, or nudge techniques that work against their interests. Under-18s receive non-personalised ads only.
• Data minimisation — we collect only what the feature they are using needs, and optional permissions (health, location, contacts, photos) are off until they choose to grant them.
• Tokens are not money — tokens are a virtual currency with no real-money value and cannot be purchased or cashed out.

10.Your rights

Under the UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted ("right to be forgotten").
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive the data you gave us in a machine-readable format, or have it transmitted to another controller.
• Objection — object to processing based on legitimate interests, and to any direct marketing.
• Withdraw consent — where processing is based on consent (health data, location, contacts, photos, personalised ads), withdraw it at any time without affecting the lawfulness of processing before withdrawal. Most consents can be withdrawn directly in your device settings.

To exercise any of these rights, email support@winnabit.co.uk. We will respond within one month. Exercising your rights is free, and we may need to verify your identity first. You can also delete your account and its data directly in the app.

If you are unhappy with how we handle your data, you have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113. We would appreciate the chance to resolve your concern first, so please consider contacting us before the ICO.

11.Data retention

We keep personal data only as long as we need it:

When you close your account, we delete your personal data within the periods above, except where we must keep specific records longer to comply with a legal obligation or to establish, exercise, or defend legal claims. Data in encrypted backups is purged on the backup rotation cycle of up to 35 days.

12.Security

We protect your data with industry-standard measures: encryption in transit (TLS) and at rest, row-level access controls in our database, least-privilege access for our systems and staff, and secure authentication. No system is perfectly secure, but if a breach affects your personal data and poses a risk to you, we will notify you and the ICO as required by law.

13.International transfers

Our backend and database are hosted by MongoDB (MongoDB Atlas). Your account, challenge, token, and group data may be stored and processed on MongoDB Atlas servers located outside the United Kingdom.

Some of our service providers (MongoDB, Google AdMob, Apple, Google/Firebase, Get Waitlist) process data in the United States and other countries outside the UK. Where personal data leaves the UK, we rely on safeguards recognised by UK GDPR: the UK's adequacy regulations (including the UK–US Data Bridge, the UK Extension to the EU–US Data Privacy Framework) or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, plus additional technical protections where appropriate. You can ask us for details of the safeguard applying to a specific transfer via support@winnabit.co.uk.

14.Changes to this policy

We may update this policy as Winnabit evolves or the law changes. The "last updated" date at the top always shows the current version. For significant changes — especially anything affecting health, location, or children's data — we will notify you in the app or by email before the change takes effect, and where the law requires it we will ask for your consent again.

15.Contact us

Questions, requests, or complaints about your personal data:

Winnabit Ltd
Registered in England and Wales (company number 16979558)
71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: support@winnabit.co.uk