← WINNR

Privacy notice

This notice explains what personal data WINNR collects — both on this website (the intake questionnaire and waitlist) and inside the app — why we collect it, who else touches it, and the rights you have. A lot of what you tell us is sensitive: it concerns your sexual behaviour and your wellbeing. The law treats that as "special category" data and so do we, with extra care.

1. Who is responsible for your data

The data controller is Nicolaas Jozef van Disseldorp, trading as SelfAligned (KvK no. 89852184), Weena 29B, 3013 CC Rotterdam, Netherlands. For any privacy question or request, contact us at winnr.now@gmail.com. We have not appointed a Data Protection Officer, as we are not required to at our current scale.

2. What we collect

Account & identifiers

• Your email address (from sign-in) and, if you use Google sign-in, your Google account ID.
• A display handle you choose (a pseudonym).
• Your subscription status and, once you subscribe, a Stripe customer reference. Your card details are handled entirely by Stripe and are never seen or stored by us.

Special-category data (your sexual behaviour and wellbeing)

• Your questionnaire answers: responses about porn use and masturbation, when porn first became regular for you, your triggers, what you have tried, your self-reported frequency, and the score and "band" we calculate from them.
• Your goals, including a free-text "why I'm doing this" note (often personal, e.g. about a relationship).
• Your urge events (when you use the panic button and which tool you used), and your streaks and relapses, with any note you add.
• Your journal entries and any coping cards you save for yourself.
• Community posts, comments and votes you make under your handle.
• If you opt into accountability partners, the fact that you were matched with another user and the private messages you exchange with your buddy.
• If you use the optional AI coach, the messages you type to it, the coach's replies, and short insights it keeps so it can remember your context between chats.

App usage

• Your progress and rewards data: XP, lesson progress, streak settings, and any cosmetic you have unlocked or equipped.
• Any bug report you send us, including whatever description you write.

We do not use advertising or analytics trackers, and we do not sell your data. The only thing stored in your browser is your light/dark theme preference.

3. This is "special category" data

Your questionnaire answers, logs, journal, community posts, buddy messages and coach messages concern your sex life and your wellbeing. Under the EU GDPR this is "special category" data (Art. 9), which gets the strongest protection. We may only process it with your explicit consent, which is why we ask you to tick clear, separate boxes before we store this data or send anything to the AI coach.

4. Why we use it, and our lawful basis

• To run the service you signed up for — build your plan, show your progress, run the tools and community — under your explicit consent for the sensitive data (Art. 9(2)(a)) together with performance of our contract with you (Art. 6(1)(b)).
• To provide the optional AI coach, under a separate explicit consent that specifically covers sending your messages to an AI provider to generate a reply.
• To take your subscription payment and give you access (Art. 6(1)(b)).
• If — and only if — you tick the optional box, to use your answers in anonymised, aggregated form to improve the science behind WINNR.

You can withdraw any consent at any time (see section 9). Withdrawing stops future processing; it does not affect what we lawfully did before.

5. The AI coach and data leaving the EU

Almost everything we hold stays inside the European Union. The one exception is the optional AI coach. When you use it, the text of your message is sent to OpenRouter, a routing provider in the United States, which passes it to a DeepSeek language model to generate a reply. We send this under a zero-retention arrangement, meaning the providers are contractually barred from storing your messages or using them to train models, and the transfer relies on the European Commission's standard contractual clauses. This only happens if you have given the separate coach consent, and we send only the message text needed to answer you. The coach is a guided self-reflection tool, not therapy or a medical service, and a notice in the app says so.

6. Who else handles your data (our processors)

We do not sell your personal data and we do not share your individual answers with advertisers. We rely on a small number of providers who handle data strictly on our instructions and under a data-processing agreement:

• Supabase (database & sign-in), hosted on AWS in Stockholm, EU — stores your account and app data.
• Hetzner Online GmbH (Germany, EU) — hosts our website and the app.
• OpenRouter (United States) and the DeepSeek model it routes to — the AI coach, if you opt in, under a zero-retention arrangement (see section 5).
• Stripe (US / Ireland) — processes your subscription payment.
• Brevo (Sendinblue SAS, France, EU) — sends service and login emails.
• Google (United States) — only if you choose Google sign-in, for the sign-in handshake.

If you opt in to research, any data shared with research partners is anonymised and aggregated so it can no longer identify you.

7. How long we keep it

We keep your data for as long as your account is open. If an account goes unused for 12 months we delete it, and everything tied to it, automatically. You can also delete your account and all of its data whenever you want, from the app (Settings, then delete my data) or by emailing us, and we act on it right away. Payment records are kept for as long as tax and accounting law requires, which is seven years in the Netherlands.

8. How we protect it

Your data is stored on servers in the European Union and encrypted in transit and at rest. Access controls mean each account can only reach its own data, and sensitive operations (like your subscription status) can only be changed by our server, not by other users. Sign-in is passwordless. Access by the team is limited to what is needed to run the service.

9. Your rights

You can ask us to, or do yourself in the app where noted: see the data we hold about you; correct it; delete it (Settings → delete my data removes your account and everything tied to it); export a copy in a portable format (Settings, for your coach data); restrict or object to its use; and withdraw consent at any time. To exercise anything not available in the app, email winnr.now@gmail.com and we will respond within one month.

10. Automated processing

We calculate a "band" from your questionnaire answers and suggest a goal. This is a guide to help you, not a decision that has a legal or similarly significant effect on you, and nothing about your access is decided automatically. If you want to understand or discuss your result, contact us.

11. Complaints

If you are unhappy with how we handle your data, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to your local EU data protection authority.

12. Age

WINNR is for adults only. You must be 18 or older, and we ask you to confirm this before any questions are shown.

13. Changes

We may update this notice as WINNR develops. The "last updated" date above shows the current version.

← Back to WINNR