Privacy policy

The data we process depends on the Service you use. The Winnow section below describes that app specifically; references elsewhere to accounts, advertising, cookies or subscriptions apply only to Services that offer those features.

01Winnow

Winnow helps you review and organize the photo library on your iPhone. Winnow does not require an account or ask for your name or email address.

Photos and library data. With the access you grant in iOS, Winnow reads photos and videos to display them, organize your selections and find similar shots, blurry photographs, screenshots and paper. Analysis runs on the device. Winnow does not transmit photographs, videos, thumbnails, album names, photo identifiers, file sizes, similarity fingerprints or recognition labels to us or our analytics and purchase providers. You can change photo access in iOS Settings. Apple may separately sync your library according to your iCloud settings.

Your choices and deletion. Review choices and analysis caches are stored on the device. If you separately enable Improve sorting, the limited diagnostic feedback described below is also sent to our server. A swipe only records a choice. Deletion requires your confirmation in the iOS Photos dialog; large selections may require several batch confirmations. Deleted items can remain recoverable in Photos > Recently Deleted for up to 30 days. Winnow does not empty that album. Filing adds a photograph to a Photos album; with limited access, the upward gesture uses Favorite instead. Device storage figures and removal receipts remain local.

Purchases. Apple processes payment. RevenueCat validates purchase receipts and keeps the lifetime entitlement available for purchase restoration under its generated customer identifier. Winnow does not receive your payment-card details. Purchase processing continues if you disable optional analytics, so access and restoration still work.

Optional product analytics. Winnow sends a limited set of app-action and purchase-flow events to PostHog's EU service. They include a randomly generated installation identifier, event time, app version and build, test/production environment, whether analytics first encountered a new or existing installation, and a fixed entry-point label such as Sweeps or Purchases. This is event-level information associated with an installation, not anonymous totals calculated before transmission. We use it to understand where people start sorting, open the offer, cancel or complete a purchase, and use the paid workflow. We do not link the PostHog identifier to RevenueCat's customer identifier or to an identity from another app.

Your control. Optional analytics is enabled by default. In Profile, turn off Help improve Winnow to stop it. This cancels pending delivery and removes unsent events from the local queue. It does not remove events already delivered to the service. Unsent events use a bounded local queue to tolerate lost connectivity. For questions or data requests, email help@luminaforgeapps.com. The retention and rights sections below apply to this processing.

Optional sorting diagnostics. Starting with Winnow build 36, a separate Profile switch, Improve sorting, is off by default. If you enable it, Winnow sends numeric focus and image-quality measurements, active thresholds, analysis-pipeline revision, app version/build and test/production environment, together with the Sweep category and your feedback (such as Not blurry) or Keep / Let go choice, to our own server. For bulk selections, at most ten randomly selected measurements are sent with the selection and sample sizes. A choice to keep a photo is not treated as proof that the classifier was wrong. These records help us evaluate and improve suggestions; they do not automatically change the algorithm on your phone.

Diagnostic privacy and control. Sorting diagnostics contain no photographs, thumbnails, photo identifiers, capture dates, dimensions, location, album names, camera information, recognition labels, similarity fingerprints, account IDs or installation IDs. Each record has a random event ID used only to prevent duplicate delivery; it is not an identifier for you or your device. The receiver sees an IP address during transport and temporarily uses it for rate limiting, but the diagnostic dataset contains no IP address. Records are kept for up to 180 days, with the same retention applied to local server backups. No public read or export endpoint is provided. Disable Improve sorting to cancel pending delivery and erase unsent records. This does not erase records already delivered; without a user or device identifier, we cannot locate a particular person's records. Previously saved local feedback is not uploaded when you enable the switch. This optional processing is based on your consent and is separate from PostHog analytics.

Writing to us from inside the app. Profile > Write to us opens a conversation with the person who makes Winnow. Nothing is sent unless you write. What you send is the text you type; the first message of a conversation also carries your app version and build, your iOS version, your iPhone model (for example iPhone16,1) and your interface language, so that we do not have to ask you for them. Please do not include passwords, payment-card details or other secrets — this is a support conversation, not a secure channel.

How that conversation is addressed. There is still no account. The first time you write, your iPhone generates a random 256-bit token and keeps it in the iOS keychain; that token is what identifies the conversation. Our server stores only its SHA-256 hash, never the token itself, so our records cannot be turned into a way of reading anyone’s messages without their device. Because the token lives in the keychain it survives reinstalling Winnow on the same iPhone, and it is not synchronised to your other devices. The conversation is stored on our own KS VPS and kept for 180 days after its last message, after which the conversation and its messages are deleted together; local server backups follow the same retention. The server keeps no request log and stores no IP address, although the receiving service necessarily sees one during transport and uses it in memory for rate limiting. Our answers appear in the app the next time you open it; Winnow sends no push notifications. If you want a conversation removed sooner, write to help@luminaforgeapps.com from inside it, or email us and mention the app.

No advertising or cross-app tracking. Winnow contains no ads, uses no advertising identifier and does not join your activity with other apps for advertising. It does not record your screen or automatically capture screen text. PostHog location enrichment is disabled. Network connections necessarily expose an IP address to the receiving service during transport; Winnow does not use it to enrich analytics with location.

Providers. Apple and RevenueCat process purchases. PostHog EU processes optional product analytics. Our own KS VPS hosts the separate optional sorting diagnostics and the in-app support conversation described above. Website advertising/cookie providers mentioned elsewhere in the studio policy are not embedded in Winnow.

02Information we collect

Personal data

• Contact data. Email address, used for account, support and communications.
• Device data. Device ID, operating system, model, language, IP address and analytics events, used to maintain and improve the Services.

We do not knowingly collect data from children under 13. Parents may contact us to request removal of such data.

03How we collect data

• Directly from you, when you sign up or contact support.
• Automatically, via analytics tools and third-party integrations.

04How we use your information

• To provide the Services and the account and support that go with them.
• To send communications you have asked for, where you have consented.
• To understand how the Services are used, and to improve them.
• To process payments for one-time purchases and subscriptions, where offered.

05Legal bases for processing

06Sharing and disclosure

We share data only with trusted service providers under data processing agreements. We do not sell your data, and we do not share it for advertising. Depending on the Service, third-party processors include Google Analytics, Mailchimp, Google Ads and Payoneer. Winnow uses Apple and RevenueCat for purchases and PostHog EU for optional product analytics, as described above. Each is contractually bound to protect your data to UK GDPR, GDPR and CCPA standards.

07Cookies and tracking

Services that offer website analytics or advertising may use cookies, beacons and similar technologies for those functions. Winnow does not embed website advertising providers; its optional analytics is described above. We do not currently respond to automatic Do Not Track signals. You can manage your preferences through your browser settings.

08International data transfers

Your data may be processed in countries outside the UK and EEA, including the United States, under standard contractual clauses or equivalent legal safeguards.

09Retention

We retain data only as long as necessary for the purposes described above, after which it is securely deleted or anonymised. Marketing data is retained until consent is withdrawn.

10Your rights and choices

United Kingdom and European Union

You may request access, correction, deletion, restriction or portability of your data, or object to processing. Where processing is based on consent, you can withdraw that consent at any time.

California — CCPA and CPRA

As a California resident you have the right to access, delete and correct your personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights.

California — “Shine the Light”

You may request a list of the third parties with whom we have shared personal data for direct marketing purposes in the past year.

To exercise any of these rights, write tohelp@luminaforgeapps.com.

11Data security

We use industry-standard security measures to protect your personal data from unauthorised access, disclosure, alteration and destruction. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page always reflects the current version, and material changes will be notified through the Services.

13Contact

LuminaForge Apps LLP, Stoney Works, 8 Stoney Lane, London SE19 3BD, United Kingdom.help@luminaforgeapps.com