Privacy Policy

• Your account: your email address and, if you add them, your name, birthday, sex, and time zone; your member number; and who invited you.
• Invites you send: each link’s label and status, and the email address someone typed on it. The link itself is stored only as a one-way hash.
• If you request an invite on winlife.ai: your name and email, kept only to reply to you, until you’re invited or you ask us to delete it. We don’t add you to any mailing list. To limit spam, we also keep a one-way hash of your IP address (not the address itself) for no more than a day.
• What you add: the finances you log (expenses, income, balances, investments), goals, journal entries, to-dos, workouts, food you log, calendar events, memories, and letters (to yourself or to a friend), including links and photos you upload, and the voice memos you record: the recording itself and its written text.
• Oura or WHOOP, only if you connect them: each day’s summary numbers: sleep score and time asleep, the night’s minutes in each sleep stage, readiness or recovery, resting heart rate, HRV, steps and active calories, strain, and how many workouts. From WHOOP, also a summary of each workout: the sport, when, how long, the distance, active calories, average and top heart rate, strain, time in each heart rate zone and the climb. Nothing finer (no heart-rate readings through the day, no minute-by-minute sleep). When you connect, WinLife brings in this year’s days back to January 1. Used only to show them to you: today’s on Health → Wearables and Home, and month by month under Past months. WHOOP’s workouts also show on Health → Exercise. If you turn on Count my WHOOP workouts in Together, people in your challenges that count workouts see each one’s day, distance and time. Otherwise only you can see all of this: never shared with other members, never sent to the AI assistant, not kept in the activity log. WinLife keeps the access key the provider gives it, encrypted where no signed-in session can read it. Disconnecting asks the provider to forget WinLife and deletes the key and every day of numbers.
• Workout notes, scores and photos, if you add them: a note, a score, your own name for a workout, and the sports you add or the names and emoji you change on Health → Exercise. Your note is only yours unless you put it on a picture you share. A score is also shown to anyone you tag. You can tag who you worked out with: a connected friend you tag sees that workout’s sport, day and score on their Exercise tab, and its photo if you turn on Share photo, and can remove it, but never your note, numbers, route or heart rate. A photo stays on the workout unless you turn on Show in Memories. Never sent to the AI assistant.
• Apple Health workouts, only if you connect it in the WinLife iPhone app: each workout Apple Health has from January 1 of the year you connect (runs, rides, walks, swims and the like, from your Apple Watch or apps such as Strava, Garmin or Peloton): what kind of workout and which sport it was, when, how long, the distance, active calories, average and top heart rate, about 100 heart rate readings across the workout, its top speed, walking and running distance for that time, the climb, which app or device recorded it and whether it was typed in by hand, and its route. Strength workouts show on Exercise and never count in challenges. WinLife only reads Apple Health and never writes to it. Before a route leaves your phone its first and last 200 meters are cut off, so it never shows where you start or finish, and it’s simplified to a few hundred points. Used to show your workouts to you on Health → Exercise, to make a share picture when you ask for one, and to count in Together challenges you’re in that count Apple Health workouts (see Friends and family). The route is only ever shown to you, or on a picture you choose to share. Never sent to the AI assistant, never used for advertising, not kept in the activity log, and not stored in iCloud.
• Period days, only if you log them: the days and how heavy, plus the usual cycle and period length you set. Used only to show you your own cycle and predictions. Only you can see them: they’re never shared with other members, never sent to the AI assistant, and not kept in WinLife’s activity log.
• Bank data, only if you connect a bank through Plaid: the institution’s name; each account’s name, type, and last four digits; balances; transactions (date, amount, merchant, and category); and investment account balances.
• We never receive or store your bank username or password, or your full account and routing numbers.
• If you use the assistant: a daily count of your requests and what they cost, to enforce a daily limit, and, if you set up Siri, each Siri key’s name and when it was last used (the key itself is stored only as a one-way hash).
• Google Calendar, only if you connect it: the names and colors of your calendars, which ones you chose to show, and your Google account’s email address. Your events are read from Google when you look at them and are not stored.
• Goodreads, only if you link it or upload its file: the books on your read, currently reading, and want to read shelves (title, author, your rating, the date you finished, and your review; private notes too when they come from the file), and the number in your Goodreads profile link. WinLife reads your public shelves once a day while it’s linked and never sends anything to Goodreads. Unlinking stops the reading; the books stay until you delete them.
• Phone notifications, only if you turn them on: a push address for each device you turn them on for (issued by Apple, Google, or Mozilla) and the device’s name, plus the nudge settings on your goals and a short history of the nudges sent.
• How you use WinLife: how many minutes a day you spend in each section (Money, Calendar, Goals and so on), counted only while WinLife is on your screen and you’re using it, plus a count of things you do, like logging an expense or starting a group. It’s kept in WinLife’s own database, never sent to an analytics company, never shared or sold, and only the WinLife team sees it, to learn what’s working. Other members never see it. It’s deleted with your account.
• Basic technical logs kept by our hosting providers (such as IP address and browser type) to run and secure the service.

Only to run WinLife for you: showing your dashboard, filling in your net worth snapshots with your bank balances (and, only if you turn it on, saving one for you once a month), listing new bank transactions for you to review and log, showing your Google Calendar, finding free time for the goals you asked to be nudged about, and, when you ask the assistant, doing what you asked.

We do not sell your data or use it for advertising, and other members can't see it, except a memory you choose to share, a letter you write to a friend, and your birthday’s month and day for friends you’re connected with (below). Access to the database is limited to the operator, for maintenance and support.

• WinLife is invite-only. The person who invites you is recorded (so the network of who invited whom can be shown), and you get a member number. Other members see only your first name, member number, and join date, and only if they invited you or you invited them.
• Friends you’re connected with see your birthday on their calendar: the month and day, never the year. You can turn this off under Settings → Account, next to your birthday.
• The admin (the operator) can see each member's name, email, member number, join date, who invited them, how much of the assistant's daily limit they used, and how many banks they connected, and can turn the assistant or bank connections on or off for a member. The admin page never shows your money, goals, journal, or other entries.
• Sharing memories: you can link someone in your People to their WinLife account (they accept). Tagging them on a memory then asks them to add it to their Memories; if they accept, they see it read-only: its title, dates, places, story, highlights, videos, links, and cover. Never your feelings, lessons, or rating, and nothing else in your account. Untag them or unlink them and it leaves their account, unless they had put something of their own into it (notes, a rating, or a link): then they keep their own copy with its title, dates, places and links, plus their notes (never your story). If you delete a memory or close your account, everyone who accepted it keeps their own copy the same way. Comments on a shared memory are seen by its owner and everyone who accepted it; they stay with the memory, and you can delete your own (the owner can delete any on theirs).
• Collections: you can put memories in a collection and share it with WinLife friends (they accept), or with a link that works like a memory's: whoever taps it joins and is connected with you. Everyone in a collection sees each memory in it read-only: its title, dates, places, cover, who was there, photos, videos and links. Never what you wrote about it or your rating. Anyone in it can add their own memories and take any memory out; the memory itself doesn't change. Leaving a collection, or being taken off it, takes your memories out of it.
• Letters to friends: you can write a letter to a friend you’re connected with, to open right away, on a day you pick, or on their birthday if they share it with you. Until it opens they see only that it’s from you and the day it opens: its title, words, photo and link are held back by the database, not just hidden on screen. When they open it, they can read all of it. Until then you can change it or take it back; after that it stays in their Letters until they remove it, and you keep a copy under Sent. Its photo is stored in WinLife’s private storage, which only you can read, and the friend too once they’ve opened it. Their phone is told a letter arrived and who it’s from, never what it says. If you close your account, a letter a friend has already opened stays with them as their own copy, with its photo and link; the rest go with your account.
• Together challenges: everyone in a challenge sees everyone’s logs in it, and any skips (a day or week someone marked as sick or away). In a challenge that counts Apple Health workouts, once you’ve said you’re in (or if you started or joined it yourself), a workout you connected logs itself there: the people in it see its day, distance and time, and whether it was recorded or typed in, never the route or anything else about it.

WinLife uses Plaid Inc. to connect to your bank. On Plaid’s screen you choose which bank and which accounts to share, and Plaid’s End User Privacy Policy applies to how Plaid handles your information. WinLife can only read balances and transactions; it cannot move money.

Connecting a bank requires two-factor sign-in. You can disconnect a bank at any time from Money → Accounts.

Connecting Google Calendar is optional and read-only: WinLife asks Google for three narrow, read-only permissions: to see your list of calendars (calendar.calendarlist.readonly), to view their events (calendar.events.readonly), and to see when you’re busy (calendar.events.freebusy). It can never add, change, or delete anything in your calendars. You choose which calendars WinLife shows, and they appear on their own tab, separate from the rest of WinLife.

WinLife also asks for drive.file for memories’ photos: to let you choose a folder from your Google Drive instead of pasting its link, and to upload photos you pick from WinLife straight into your Drive, into a folder WinLife makes for that memory and shares “Anyone with the link” so the people on the memory can see them. It reaches only the folders and files WinLife made or you picked in Google’s own dialog, nothing else in your Drive. The photos stay in your Drive: WinLife keeps only the folder’s link and name on the memory, and shows a folder’s photos only when the folder is shared “Anyone with the link”.

WinLife keeps only an access key from Google, encrypted with a key that exists only on the server and stored where no signed-in session can read it. Events are fetched from Google when you open the calendar and held in the server’s memory for about two minutes, never written to the database. For goal nudges, WinLife asks Google only when you’re busy (start and end times, not what the events are). If you ask the assistant a question about your calendar (“what’s on tomorrow?”), the matching events’ titles, times, and places are sent to Anthropic to answer it (see below).

WinLife’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show you your calendar, answer your questions about it in the assistant, find free time, and attach Drive folders you pick or upload to your memories; it is never sold, used for advertising, or used to train AI models, and no person reads it unless you ask us to for support, it’s needed for security, or the law requires it.

Disconnect any time from Settings → Connections or the Google tab: WinLife revokes its access at Google and deletes the stored key and calendar list immediately. You can also remove access from your Google Account’s security settings.

If you turn on notifications for a device (for example WinLife on your iPhone’s home screen), WinLife stores that device’s push address and sends at most one goal nudge a day, like “Found 30 min Thursday 6 pm for ‘Call Mom’”. The notification’s text passes through your device maker’s push service (Apple, Google, or Mozilla) to reach you. Remove a device in Settings → Notifications and its push address is deleted.

The morning reminder is off unless you turn it on (on the Calendar). On a day your calendar has something on, it sends that day’s event titles and times to your phone, your email, or both. Emails go out through Resend; the notification through your device maker’s push service, as above. Turn it off the same place and nothing more is sent.

On this day: on a morning when one of your memories (or one shared with you) happened on that date in an earlier year, WinLife sends its title to your devices. In Settings → Notifications you choose which kinds you get, this one included; the choice holds on every device.

“Ask WinLife” (typed, dictated, through Siri, or from a screenshot) is powered by Claude, a model run by Anthropic PBC. When you use it, WinLife sends Anthropic your message and the parts of your WinLife data it needs to act on it: for example your category and people names, this week’s to-dos, your active goals, today’s workout, the spending totals you ask about, or the screenshot you upload. Bank access tokens, passwords, and account numbers are never sent.

Nothing goes to Anthropic until you say OK: the first time you use the assistant, Siri, a photo or receipt read, a goal plan, or a Reports recap, WinLife tells you it uses Claude and asks. If you choose Not now, nothing is sent. To stop later, use Stop in Settings; the next time you tap one of these, it asks again.

Reports also opens with a few sentences written by Claude: once for each month, and for the year and all time as of each month end, the first time you open that report after its charges are all filed. For it, WinLife sends Anthropic that report’s numbers: what came in, what you spent and kept, your top categories, your three biggest charges as your ledger describes them, your budget, and how your net worth moved. Nothing else, and no names of people or accounts. The sentences are kept with your report.

When you talk to the orb, your browser turns your voice into text using its own speech service (Apple’s in Safari, Google’s in Chrome), under that company’s privacy terms. WinLife never receives or keeps the audio, only the words, and the microphone is on only after you tap the orb and until you stop talking.

Anthropic processes this under its commercial terms, which don’t allow it to train its models on your data, and keeps it only for a limited time (see Anthropic’s privacy center). WinLife doesn’t store your conversations: the panel forgets them when you close it. What the assistant saves appears in your data and your activity log, marked “via assistant” or “via Siri”, and you can edit or delete it like anything else. Screenshots are read once and not kept; only the transactions go to your Expenses inbox for you to review. The same goes for a photo or screenshot of a workout plan: it’s read once and becomes a draft program you review. A photo of a meal or a nutrition label, or a description of what you ate, is read once to estimate calories and macros, which you check before anything is saved; the photo isn’t kept. A receipt photo on a shared expense is read the same way when you tap to read it, so you can check and split its lines; the photo itself stays with the expense, where the people in that group can see it. When you scan a barcode, only the barcode number is looked up in Open Food Facts and the USDA’s food database, with nothing about you attached.

Spreadsheets and CSV files you bring (bank exports, gym plans) are read by WinLife itself, not by the assistant, and the file isn’t kept: only the transactions or the plan you choose to save.

Siri keys can only add things, never read or change your data, and you can revoke one at any time in Settings.

A voice memo is recorded only while the recorder is open, from the moment you tap Record until you tap Stop and save. The recording is kept in WinLife’s private storage, where only you can play it: never shared with other members, never sent to the AI assistant. Until it has finished uploading, a copy waits in your browser on that device, so a lost connection doesn’t lose it; it’s removed from there as soon as WinLife has it.

To write it out as text, WinLife sends the recording to Cloudflare (Cloudflare, Inc., its Workers AI service), which turns it into text and sends the words back. Cloudflare doesn’t keep the recording or the text once it has answered, and doesn’t use them to train its models (see Cloudflare’s Workers AI data usage). The text is saved with the memo, and you can change it. Deleting a memo deletes the recording and its text.

• Supabase: database and sign-in, including the emails with your sign-in codes (United States).
• Vercel: hosting.
• Oura and WHOOP: only if you connect them, to read your daily summaries, and WHOOP’s workouts.
• Resend: sends WinLife’s own emails: invites, and the morning reminder if you turn it on (United States).
• Plaid: bank connections.
• Google: when you add a YouTube video or a Google Drive folder to a memory, WinLife fetches its title and thumbnails; and, if you connect it, Google Calendar (read-only, see above).
• Apple, Google, and Mozilla push services: deliver phone notifications, only if you turn them on.
• Anthropic: the AI assistant (see above), only when you use it, and the few sentences on top of Reports.
• Cloudflare: turns your voice memos into text (see above), only when you record one.
• Tiingo: market prices. No personal data is sent.

They handle data only to provide their services to WinLife.

• Accounts are invite-only. Two-factor sign-in is optional for members, required for the admin, and required to connect a bank.
• Each member can reach only their own data, enforced by the database itself.
• Data is encrypted in transit (HTTPS) and at rest. Bank and Google Calendar access tokens are encrypted a second time with keys that exist only on the server.

• We keep your data while your account is open.
• Disconnecting a bank immediately revokes WinLife’s access at Plaid and deletes the stored access token, the bank’s account records, and any transactions you haven’t logged. Expenses you already logged stay in your ledger until you delete them.
• Disconnecting Google Calendar immediately revokes WinLife’s access at Google and deletes the stored key and your calendar list. Removing a device from notifications deletes its push address.
• Oura or WHOOP numbers are kept while the device is connected, so Past months can show them. Disconnecting asks the provider to forget WinLife and immediately deletes the stored key, every day of numbers, and WHOOP’s workouts.
• Apple Health workouts are kept until you delete them: one at a time on its page, or all of them when you Disconnect Apple Health on Health → Wearables, which also takes them out of every challenge. Disconnecting and keeping them only stops new ones; to stop WinLife reading Apple Health at all, turn it off in the Health app under Sharing → Apps → WinLife. A workout you delete in Apple Health is deleted here the next time the app opens. If you remove a workout from WinLife, its ID is kept so it doesn’t come back from the app that recorded it, until you close your account.
• You can delete individual entries at any time.
• You can delete your account and everything in it yourself, in Settings → Close your account. It happens immediately: any bank is disconnected at Plaid, your files are deleted from storage, and every row you own is deleted. Nothing is archived. You can also email toby@winlife.ai and we’ll do it within 30 days and confirm. Copies in routine backups are removed as those backups expire, within 30 days.

If you report something, we keep your report, what you reported and who posted it so we can review it. The person you reported isn’t told it was you. If you block someone, we keep that record so the block stays in place, and they aren’t told.

You can ask for a copy of your data, or ask us to correct or delete it, by emailing us; we respond within 30 days. Depending on where you live (for example, California), you may have additional rights, and we honor these requests for every member. We do not sell or share personal information.

Do Not Track: WinLife doesn’t track you across other websites or show ads, so a browser’s Do Not Track signal changes nothing about how it works.

WinLife is invite-only and not intended for children under 13.

We review this policy at least once a year. If we make a material change, we’ll update the date above and let members know in the app or by email.

WinLife LLC · toby@winlife.ai