Privacy Policy – Winart
WINART Download App

Legal

Privacy Policy

Application privacy draft, reproduced from the source file.

The text below is the extracted application source. It is shown without rewriting. Displaying it here is not a lawyer’s approval and it is not a certification.

Privacy Policy

Policy title: Privacy Policy

Version: 1.2

Effective date: 31 October 2026

Last updated: 31 October 2026

Owner: Winart Limited

Status: Draft for in-app display. This is not a formal legal opinion and has not been approved by a lawyer.

Scope

This policy describes personal data that the Winart Flutter application and its Firebase backend actually collect, store, or send to service providers, based on an audit of the application source. It applies to people who create an account, sign in, use chat, voice rooms, live streaming, gifts, diamonds, Creator Coin, agencies, or VIP features, or who contact Winart about the app.

The published privacy page is https://winart.win/privacy-policy/. This in-app text is the application copy. It describes chat, voice, live video, gifts, Diamonds, and VIP. It does not describe match-play features or chain-based payments.

Where a fact could not be verified from the source, this policy says so. It does not claim that Winart collects nothing.

Definitions

Information Winart collects

Account and authentication

The app supports email and password, phone one-time codes, Google sign-in, and Facebook sign-in. Firebase Authentication processes the corresponding identifier, credential, and session. Email registration stores the display name on the account and attempts to store the email in a private user record. Phone sign-in uses the number you enter and a verification code. Google and Facebook sign-in pass a provider credential to Firebase. Winart does not receive your Google or Facebook password.

A password-reset email can be requested for email accounts. There is no separate in-app password editor.

Profile

Profile records can include name, photo, cover image, biography, username, country, gender, an optional age figure, VIP and level display fields, online presence, and the Winart ID. Country on email registration defaults to India until you change it. That default is not GPS location. This audit did not find a location SDK.

User content and communications

The app stores chat messages, conversation settings, posts, comments or channel content where those features are used, voice-room membership and chat, live-room viewer and comment activity, reports, blocks, and feedback you submit. Photos and files you pick are uploaded through Firebase Storage when the feature saves them.

Voice and live sessions use Agora RTC for real-time audio and, where the product uses it, video. Microphone and camera access are requested by the device operating system when a session needs them. Winart does not claim a separate recording archive of every voice or live session. Room recording controls that are marked unavailable in the app do not create a recording.

Device and technical data

The signed-in app registers an installation under your user record: a randomly generated device id stored on the device, the operating-system name, the app version, last-seen time, and notification preferences. Firebase Cloud Messaging stores a push token so the app can deliver notifications you have not turned off. Removing a device from Manage Devices deletes that registry entry. It does not, by itself, sign that installation out of Firebase Authentication.

This audit did not find a Crashlytics, analytics, Mixpanel, Amplitude, or Sentry SDK in the application dependencies. Firebase products that are included can still process technical data needed to run Authentication, Firestore, Storage, Cloud Functions, and Cloud Messaging. Whether Google Play services add further diagnostics on a device is not determined by this source audit.

Wallet, payments, Creator Coin, and verification

Diamond balances, gift records, recharge orders, and manual payment submissions are processed so the server can keep a ledger. Manual payment records can include an amount, a transaction reference, and a screenshot you upload. This release does not collect a chain address or a chain transaction as a customer payment method. If an older disabled path left a network or transaction-hash record on the server, that record is retained with the ledger and is not offered as a current payment. Diamond credit is a server decision. A success message on the device is not a credit.

Creator Coin balances and withdrawal records are kept so eligible withdrawals can be reserved, paid, and deducted by the server. This policy does not publish a cash rate or guaranteed earnings.

Where a verification flow is used, Winart stores a selfie image URL and a document image URL with a pending status in its own verification records. This audit did not find a named third-party KYC company integrated in the app.

VIP, agency, and gift entitlements are stored as account and catalogue records. VIP privileges are not implemented by treating a payment-gateway message as an entitlement.

Safety and legal records

Block records, user reports, feedback, grievance submissions, policy-acceptance records, age declarations, and account-deletion requests are stored so Winart can enforce its rules and show you the status of your own submission. Other users cannot read your reports or grievances through the app rules.

Why the information is used

Winart uses this information to create and secure accounts, show profiles, deliver messages and realtime sessions, operate gifts and the virtual economy, prevent fraud and duplicate credits, moderate abuse, send notifications you have enabled, remember policy acceptance, and process deletion or complaint requests. Marketing consent is not bundled into account creation.

Where it is stored and who processes it

Winart’s production Firebase project is the primary store for account, profile, content, economy, and safety records. Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, and Cloud Messaging process that data for Winart.

These providers process data because the feature cannot work without them:

Biometric material used by the device authenticator is not uploaded as a Winart profile field in the code reviewed for this policy.

Payment screenshots and manual payment references are stored for Winart’s own review and server verification. This audit did not find Stripe, Razorpay, PayPal, Cashfree, PhonePe, or Google Play Billing SDKs in the app.

A YouTube player is included for video playback inside voice-room features that open it. Playback is handled by that player when you use the feature.

Required and optional data

Account identifiers and session security data are required to use the app. A profile photo, biography, and optional profile fields are not required to create an email account. Microphone or camera access is required only for the session that needs it. Push notifications can be declined at the operating-system prompt. Facebook or Google sign-in is optional if another method is available. The age declaration, Terms acceptance, and Privacy acknowledgement are separate required records for this version. There is no optional marketing tick bundled with them.

Sharing

Winart does not sell personal information. Information is shared with the processors named above so they can perform the feature you use, and with other users to the extent the product shows a profile, message, room, gift, or live session. Reports and grievances are not shown to the reported person through the client. Financial ledger entries are not deleted when that would break the ledger, as described in the Account & Data Deletion Policy.

Winart may disclose information if a lawful order requires it. No staffed law-enforcement desk is claimed by this draft.

Retention

Account and profile data are kept while the account exists, unless a deletion flow removes them. Transaction, withdrawal, manual payment, gift, and conversation records are retained by the current deletion function even after account deletion, for ledger integrity, fraud prevention, and dispute handling. Push tokens and device registry entries are removed with the user record during that function’s device cleanup. Policy-acceptance records are append-only audit records. Exact backup erasure times are not instantaneous and are not claimed to be. See the Data Retention Matrix.

Deletion and user rights

You can request deletion of the signed-in account from More Options. The server deletes only the authenticated account, and only after a recent sign-in. It does not accept a user id chosen on the device. Completion is shown only after the server function finishes. Some records are kept, as the deletion screen states.

Access, correction, and complaint routes inside the app are the Legal Centre, profile editing, grievance submission, and report history. The published account-deletion page is https://winart.win/data-deletion/. That page asks you to email a deletion request. It is not an automatic erasure of every record. See Contact.

Rights that depend on the Digital Personal Data Protection Act, 2023 should be read against the commencement dates in the Google Play Compliance Matrix. Several core duties were not yet in force on 31 October 2026. This policy prepares the product. It does not declare that every statutory right is already enforceable.

Security

Access to records is limited by Firebase Authentication and Firestore rules. Economy balances that the rules protect cannot be edited from the client as ordinary profile fields. Reports cannot be updated or deleted by clients. Acceptance records are written by a Cloud Function using the signed-in user, not by a direct client write. Secrets such as an Agora certificate are not placed in the app policy or the client.

No method of transmission or storage is perfectly secure.

Children

Winart asks the person to declare that they are at least 18 by submitting an explicit yes. The server does not assign an age. The stored field identityVerified is false because this flow does not verify identity or date of birth. A separate verification flow may store a selfie and a document for a feature that requires it. The Child Safety Policy explains reporting of sexual exploitation. The app does not offer a children’s mode.

Changes

Material changes to this policy increase the version and require a new acknowledgement. Older acceptance records are kept. They are not overwritten.

Your responsibilities

Provide accurate account information. Do not create an account for a child. Do not upload another person’s identity document except where you are the person entitled to submit it for your own verification. Protect your sign-in method.

Winart’s responsibilities

Winart is responsible for describing the processing this product actually performs, for keeping server-side economy and deletion rules in place, and for not presenting unverified contact details as if they were published. Winart is not, in this draft, representing that a Data Protection Officer has been appointed.

Reporting and complaints

Use the in-app grievance form in the Legal Centre. You will receive a reference id if the write succeeds. You can read your own grievance. You cannot read someone else’s. No response-time promise is made, because a staffed response team is not verified in this implementation.

Contact

Winart Limited

The following identity and contact lines are taken from the pages published at https://winart.win/privacy-policy/ and https://winart.win/data-deletion/ on 31 October 2026. This audit did not independently match them to a government register.