Information Security Policy – Winart
WINART Download App

Legal

Information Security Policy

Information security source text.

The text below is the extracted application source. It is shown without rewriting. Displaying it here is not a lawyer’s approval and it is not a certification.

Information Security Policy

Policy title: Information Security Policy

Version: 1.1

Effective date: 31 October 2026

Last updated: 31 October 2026

Owner: Winart Limited

Status: Draft for in-app display. This is not a formal legal opinion and has not been approved by a lawyer. It is a product description, not a certification such as ISO 27001.

Scope

This policy describes the security controls present in the Winart application and Firebase backend, and the controls that are intentionally not shown because they are not enforced. App traffic to Firebase and the realtime session provider uses their encrypted transport. This policy does not claim that every network path is free of risk.

Authentication

Sign-in uses Firebase Authentication with email and password, phone codes, Google, or Facebook. Password reset for email accounts sends a reset email. There is no in-app screen that changes a password directly. Sessions are the provider session. Deletion of an account requires a recent sign-in, which is checked on the server from the authentication time, not from a flag the device can set.

Devices

Manage Devices lists installations registered by the app and can delete a registry document. That deletion does not revoke the Firebase session on the other phone. The product does not show a control that claims remote sign-out, because that control is not implemented. A local chat lock may use the device biometric or device credential. That check stays on the device.

Authorization

Firestore rules require the signed-in user for user-owned records. Protected balance and entitlement fields are not client-writable. Reports, grievances, and legal-acceptance records cannot be edited by another user. Admin review of a report or grievance is a Cloud Function that checks the existing admin authorization. A client role label is not enough.

Economy

Diamond credits, gift settlement, and Creator Coin withdrawal completion run on the server with idempotency for a completed withdrawal and rejection of a reused payment reference. The client cannot mint a balance by writing a success message.

Tokens and secrets

Agora tokens are minted on the server. The certificate is not shipped in the legal documents or intended for the client. Service-account keys are not part of the app binary’s legal copy.

Logging

Policy acceptance, account-deletion status, and moderation reviews write server audit records. Clients cannot delete those records under the rules in this version. Logs must not be used to display a Firebase UID as a public identity.

Rate and abuse limits

Acceptance writes are idempotent for the same user, policy, version, and kind, so a repeated tap does not create a second history row for the same version. Report and grievance text is length-limited by the rules. This policy does not claim a network firewall or a dedicated abuse-operations team.

What you will not see

The app does not show a security toggle that has no server effect. If a control cannot be enforced, it is omitted or marked unavailable.

User responsibilities

Use a unique password for email sign-in, do not share one-time codes, and sign out on a device you no longer control. Remote revocation of that device is not available beyond deleting the local registry entry and changing the password or provider access yourself.

Winart responsibilities

Keep privileged writes on the server, avoid weakening existing rules, and avoid publishing secrets in the client.

Reporting

Report unauthorized access through a grievance or a user report. Include what happened. Do not send your password.

Contact

Winart Limited

The following identity and contact lines are taken from the pages published at https://winart.win/privacy-policy/ on 31 October 2026. This audit did not independently match them to a government register.