WingIt Privacy Policy

WingIt (“the app”, “we”, “us”) is a to-do list in which finishing your own tasks helps carry a shared, animated migratory flock. We respect your privacy and want to be plain about what the app handles. This policy covers the WingIt app for Android and this website. It is written to be read; if anything here is unclear, write to us and we will answer in the same plain language.

The short version

• Your tasks are private. No other user can ever see a task's text, its notes, its times, or whether you finished it. Fellow travellers only ever see your wind: anonymous, aggregate signals.
• You can use WingIt without an account. Then everything stays on your phone.
• We run no ads, collect no advertising identifiers, and sell no data.
• Purchases go through Google Play. WingIt never sees your card or bank details, and a gift to the sky stays anonymous to everyone else.
• Deleting your account erases your data from our servers immediately. The only thing that stays is a purchase record with no name on it, so the same purchase can never be claimed twice.

1. Information we collect

On your device only

• Your app settings (sounds, appearance, reduce motion, snooze length).
• Whether you have seen the introduction.
• If you use WingIt without an account: everything. Your tasks, reminders and postcards live only on your device and never reach a server.

In your account (if you sign in)

Stored with our hosting provider, Supabase (PostgreSQL, with row-level security so only your authenticated session can read your rows):

• Your tasks (title, notes, list, dates and times, reminder time, repeat rule, completion state), synced so your day survives a new phone.
• Your postcards (the app's weekly keepsakes: place names and shared distances, no personal content).
• Your wind releases: the distance and the number of tasks behind each release, never the tasks themselves.
• Your account identity: the email address (and display name, if provided by Google sign-in) from the sign-in method you chose. Google sign-in shares only your basic profile (name, email); WingIt requests no other Google scopes.
• A record that we sent you the welcome email, so you only ever get it once.
• If you buy something in WingIt: Google's record of that purchase — the order id, a one-way fingerprint of Google's purchase token (never the token itself), what was bought, when, and for anything that renews whether it is still active — kept so we can confirm the purchase with Google, grant it exactly once, and keep what you paid for available to you. See section 5.

Shared with everyone (always anonymous)

The flock is communal. What crosses between users is only the shape of effort, never its content:

• Distance released to the flock (a number added to a shared total).
• A “chirp” (an anonymous one-note signal; it carries nothing but the fact that it happened).
• A sky sponsorship window (a shared timestamp; attribution in the app is always anonymous).

None of these can be traced back to you by other users. Task content is never part of any shared signal.

Usage analytics and error reports

To understand how the app is used and to find what breaks, we may collect anonymous product analytics and reports of errors inside the app (what went wrong in the code, with a technical trace) through PostHog, processed in the United States. Everything is tied to a random anonymous id, never to your name, your email or your account, and PostHog builds no profile of you.

Your task content is never part of analytics. No titles, no notes, no reminders, no list names — not in an event, not in an error report.

A small sample of sessions, roughly the first three after a new install, and none after that, may be recorded as a session replay so we can see where the app confuses people. Replays are masked: every piece of text and every image is hidden before anything leaves your phone, so a replay shows layout and taps, never words. Analytics are never used for advertising, and we sell nothing to anyone.

2. How we use your information

• To keep your tasks in sync across a new phone or reinstall (only if you sign in).
• To carry the shared flock: your released distance joins everyone's, anonymously.
• To send you sign-in links and one welcome email.
• To confirm a purchase with Google Play, grant what you bought exactly once, and keep it available to you for as long as it lasts.
• To understand how the app is used and to fix bugs.

We do not use your information for advertising, profiling, or tracking you across other apps or websites.

3. How we share your information

We never sell, rent, or share personal data with third parties for their own purposes. The service providers below process data on our behalf, only to run WingIt:

• Supabase hosts the database and authentication.
• Google provides optional sign-in; its use of data is governed by Google's own policy.
• Google Play sells and processes every purchase, and holds the payment details we never see.
• Mailjet delivers sign-in links and the welcome email, and receives your email address for that.
• PostHog, Inc. (United States) processes the anonymous usage analytics and error reports.

4. Permissions

If you set a task reminder, WingIt asks for Android's notification permission (and, where available, exact-alarm access so reminders land on time). Reminders are scheduled and shown locally on your phone. A reminder's time is part of its task, so it syncs with the task only if you sign in. WingIt does not read your contacts, location, photos, or files.

5. Purchases

WingIt may offer optional purchases — for example a touch of beauty shared with everyone flying, or access to further journeys — as one-time items or as subscriptions. They are sold and processed by Google Play, under Google's own terms and privacy policy. Google takes the payment; WingIt never receives or sees your card, bank, or billing details.

What reaches us is Google's record of the purchase — the order id, a one-way fingerprint of Google's purchase token (never the token itself), what was bought, when, and for a subscription whether it is still active. We store it with your account so we can check the purchase with Google, grant it exactly once, keep what you paid for available to you, and help you if something goes astray.

A gift to the flock stays anonymous. Everyone else sees only that a traveller gave it; your name, your email, and the fact that the traveller was you all stay with us.

Purchases never buy progress or standing in any journey, and never touch your tasks.

Refunds and cancellations

Refunds are handled by Google Play, under Google's refund policy — ask through your Google Play order history, or write to us and we will gladly help you do it. Whatever a purchase has already shared with other travellers stays with them, so a refund returns your money and leaves their sky as it is. A subscription is cancelled in Google Play at any time; it then runs to the end of the period already paid for and is not charged again.

6. Your choices and controls

• Use WingIt without an account. Everything then stays on your phone.
• Delete account (in Settings, while signed in): permanently erases your tasks, postcards, wind releases and account rows from our servers and your device, immediately. Distance already given to the flock stays in the shared total, because it contains nothing personal, and any purchase record is unlinked from you and kept with no name on it, so the same purchase can never be claimed twice.
• Delete data on this device (while signed out): wipes local data only.
• Sign out: clears this device; your account data remains and returns when you sign in.

Step-by-step instructions live on the delete your account page. To ask what we hold about you, or to have it corrected or deleted, email us and we will do it.

7. Children

WingIt is not directed at children under 13 and knowingly collects no data from them. If you believe a child has given us personal data, write to us and we will delete it.

8. Data security

Data in transit is encrypted, and your account rows are protected by row-level security so only your own session can read them.

9. Data retention

Account data is kept for as long as you have an account and deleted immediately when you delete it. Local data lives on your phone until you delete it or uninstall the app. Anonymous shared signals contain nothing personal and stay with the flock. Purchase records are kept, unlinked from your account once it is deleted, so that a purchase can only ever be granted once.

10. Where your data is processed

Our database is hosted by Supabase. Email delivery and usage analytics are processed by the providers named above, which may include processing in the United States. Each is bound by its own privacy commitments and processes data only to provide its service.

11. Contact us

Questions, requests, or anything unclear: hello@wingittodo.com. We read every one.