1. Overview
This Privacy Policy explains what information WinSpree ("WinSpree," "we," "us") collects through the WinSpree mobile application (the "App"), how we use and share it, and the choices you have. It applies to everyone who uses the App, including participants in the WinSpree Weekly Sweepstakes. By using the App, you agree to the collection and use of information as described here. This Policy should be read together with our Terms & Conditions, which govern the Sweepstakes itself.
2. Information We Collect
Account information: your mobile phone number (used to sign in via SMS verification), email address, date of birth, your country of residence (and, if you reside in the United States or Canada, your state or province), your chosen username, and an optional profile photo. Your phone number, date of birth, and place of residence are used specifically to verify you meet the minimum age requirement in our Terms and to operate your account; your email is used to deliver Sweepstakes prizes and account notices.
Gameplay information: scores, personal bests, global leaderboard rankings, in-App game session data, and the tickets you earn toward the Sweepstakes and how you earned them (check-ins, game performance, referrals); and the experience points (XP) and level you earn, your daily quest progress, the medals you earn in each game, and your weekly league group, tier and place. If you play without an account, we record each game you finish (which game, and when), tied only to the same random identifier the App creates and keeps on your device rather than to an account or to you, so we can count how the App is played. If you play without an account and allow reminders, the App schedules them on your phone itself, from your scores on your phone; nothing about them is sent to us.
Social information: your friends list, incoming and outgoing friend requests, multiplayer match invitations and results, referral relationships (who referred you and who you have referred), and the direct messages you send to and receive from friends. Messages are stored on our servers so they can be delivered and shown in the App, and are automatically screened for prohibited content as described in our Terms. We do not use the content of your messages for advertising, and we do not sell it.
Presence information: while the App is open, your device records that you are using it and, if you have a game open, which game. It is stored on our servers as a single record that is overwritten roughly every ninety seconds while the App is in the foreground, rather than as a history of the sessions you have played, and it is marked offline as soon as you leave the App. While presence is on, your device also records which screen of the App you have open, such as the Games tab or a game’s lobby, in a second single record that is overwritten each time you move to another screen. That record is readable only by WinSpree, is never shown to your friends or to other players, and is used only to understand how the App is used. You choose who can see your presence, and switching it off deletes both records outright; see Sections 4 and 7.
Proof-of-Payment Share information: if you choose to take part in the optional Proof-of-Payment Share described in Section 4(d) of our Terms, the social media handle you enter, the link to the post you submit, the screenshot of that post you upload to show how long it has been up, and the outcome of our review of it. We use these only to check that the post meets the requirements in Section 4(d) and to award the Tickets for it, and we do not use them for advertising and do not sell them. The screenshot you upload is stored on our servers, is readable only by WinSpree, and is deleted when you delete your account. Anything you choose to put in the post itself is published by you, on a platform operated by Instagram or TikTok under its own privacy policy, and is outside our control; we ask you not to include your email address, your full legal name, or any account number or balance.
Safety and moderation information: reports you file about another player (including any message you choose to quote into the report), blocks you place, and records of any message or username that our content filter rejected. These are retained so that we can review reports and act on abusive behaviour.
Device and technical information: push-notification tokens (so we can notify you about friend requests, match invites, Sweepstakes wins, your daily check-in and a check-in streak that is about to reset, the Last-Minute Sprint, the weekly drawing and its results, when another player passes your score on a leaderboard, and when another player passes you in your weekly league); your device’s current offset from UTC, stored so that the daily check-in reminders arrive at midday and in the evening where you actually are rather than in the middle of your night, and so that league alerts are never sent during your night; device-integrity signals collected by Google Firebase App Check to help confirm requests to our servers come from a genuine copy of the App; and, only while actively playing the Tilt Balance game, real-time motion/orientation sensor readings used solely to control gameplay in the moment. These readings are not transmitted to our servers or stored.
Usage and performance information: the App uses Google Analytics for Firebase to record how it is used and how well it works: for example, when you sign up, finish a game, or check in, and how long the App takes to open and show your ticket status, including whether that request succeeded and how many tries it took. Google Analytics ties this to an identifier it creates for the App on your device, and adds your device model, operating system, and an approximate location, such as your country, derived from your connection. We do not send it your name, username, phone number, or email address. We use it to find and fix problems in the App, to understand which features are used, and to measure how well our own advertising brings new players to the App (see Section 5).
Crash and error reports: when the App crashes or hits an error, Google Firebase Crashlytics sends us a report of what went wrong, with your device model, operating system and app version and an identifier Crashlytics creates for the App on your device. Reports are not linked to your account, username or phone number. We use them only to find and fix problems in the App.
Feature tests: we may show different groups of players slightly different versions of a feature, such as the order of the games on the Games tab, to learn which works better. Google Firebase Remote Config decides which version your device sees, using an identifier it creates for the App on your device, and Google Analytics for Firebase measures the result as described above.
Advertising information: the App shows ads between games, and you can choose to watch a rewarded video ad in exchange for an in-game item, such as a hint or an extra life. While you are signed in, we record each ad you are shown: whether it was a between-games ad or a rewarded video, where it appeared (such as when you left a game, or which in-game item a rewarded video was for), whether you watched a rewarded video to the end, the game you were playing, and when. When an ad the App asked for could not be shown, we also record why, as reported by the ad software (for example, that no ad was available or that the ad server could not be reached), which kind of ad it was, and whether your device could look up the address of the ad server, which tells us whether ads are being blocked on your device. The App also makes this check each time it opens or comes back on screen; while ads are blocked it shows only a notice asking you to allow them, and we record that it did. If an ad does not close when you try to close it, or is still on screen after three minutes, the App closes it for you, and we record that it did and which kind of ad it was. We record this so we can measure how ads are used in the App and find out why ads do not appear, or do not close, for some players. If you play without an account, we record the same information about each ad shown and each ad that could not be shown, tied only to a random identifier the App creates and keeps on your device rather than to an account or to you. Google AdMob independently collects information needed to serve and verify ads, under its own privacy policy (see Section 5).
3. How We Use Information
We use the information above to: create and secure your account; verify your eligibility to use the App and participate in the Sweepstakes; operate gameplay, leaderboards, friends, and multiplayer features; award, track, and display your Sweepstakes tickets; conduct the weekly drawing and notify and verify winners; deliver prizes; send push notifications you would reasonably expect (friend requests, match invites, prize claims and reminders before a prize claim closes, a daily reminder to collect your check-in tickets, an evening reminder when a check-in streak is about to reset, a weekly notice when the Last-Minute Sprint opens, notices before the weekly drawing and when its results are in, and a message when another player takes a top-three leaderboard place from you or a friend beats one of your high scores, and a message when another player passes you in your weekly league, each of which you can switch off in Settings); prevent fraud, cheating, and abuse; and comply with legal and tax obligations related to prize awards.
4. Information Shared With Other Users
Some information you provide is visible to other players by design: your username and optional profile photo appear on leaderboards, in Winner History (once you have confirmed a prize per the Terms), and to your friends and multiplayer opponents. The medals you earn in a game appear beside your score on that game’s leaderboard and to your friends. In any week in which you earn XP, your username, profile photo and the XP you earned that week are shown to the other players in your weekly league group, which has up to thirty (30) players. Direct messages you send are visible to the friend you send them to. If you have left presence switched on, your friends can also see when you are using the App, whether you are in a game and which one, and, when you are not in the App, roughly how long ago you were last seen. Presence is limited to your friends by default; the "Everyone" setting is reserved for features that do not exist yet and today shows your presence to no one beyond your friends. Your phone number, email address, date of birth, and state/province are never shown to other users.
5. How We Share Information With Others
Service providers: we use Google Firebase and Google Cloud Platform (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check, and Cloud Storage) to run the App's backend. These providers process data on our behalf and are contractually restricted from using it for their own purposes.
Google AdMob: when the App shows you an ad, Google AdMob acts as an independent controller of the advertising data it collects, governed by Google's own privacy policy (policies.google.com/privacy), not this one.
Google Analytics for Firebase and Google Ads: the usage and performance information described in Section 2 is processed by Google Analytics for Firebase, and the events that show whether our advertising brought someone to the App, such as signing up or finishing a game, are shared with Google Ads so we can measure and improve that advertising. Google’s use of this information is described in its privacy policy (policies.google.com/privacy).
Google Firebase Crashlytics and Remote Config: the crash and error reports and feature tests described in Section 2 are processed by Google on our behalf, under Google’s privacy policy (policies.google.com/privacy).
Prizes: if you win a prize, it is sent as a digital gift card to the email address on your account. Where WinSpree issues that card through a third-party fulfillment service, we share the minimum information necessary (your email address and prize amount) with that service so it can send the card and let you choose a retailer; anything further it asks you for, such as tax information where the amount requires it, you give to that service directly and WinSpree never receives it. Its use of your information is governed by its own privacy policy.
Legal and safety: we may disclose information if required by law, subpoena, or legal process, or when we believe in good faith it is necessary to protect the rights, property, or safety of WinSpree, our users, or the public.
We do not sell your personal information, and we do not share it with third parties for their own independent marketing purposes.
6. Data Retention
We retain your account information for as long as your account is active. If you delete your account through the App (Settings → Delete Account), we delete your profile, username reservation, friends and friend-request records, your conversations and the messages in them, your presence records, game scores, and leaderboard entries. Conversations are also deleted for both sides when either player blocks the other or removes the friendship. Reports and content-filter records are kept for as long as needed to investigate and act on abuse, and to show a pattern of repeat behaviour. Records in the Sweepstakes ticket ledger, past weekly drawing results, and prize-claim records are retained in their existing de-identified form (tied only to an internal account identifier that, once your account is deleted, can no longer be traced back to you) as required to preserve the integrity and auditability of past and ongoing Sweepstakes drawings, and to meet tax and recordkeeping obligations related to prizes already awarded. Records of the ads you were shown are kept only in de-identified form, and so are records of ads that could not be shown: we remove your account identifier from them, so they still count toward overall ad totals but can no longer be linked to you. Ad and game records from play without an account were never linked to an account and are kept in that same form.
7. Your Rights and Choices
You can review and update your username and profile photo at any time in Settings. You can delete your account and associated data at any time via Settings → Delete Account, as described in Section 6. You can control push notification permissions through your device's operating system settings, and can turn the daily check-in reminder, the Last-Minute Sprint notice, the leaderboard alert and the league alert off individually via Settings → Notifications. You can choose who sees when you are in the App (nobody, your friends, or everyone) at any time in Settings; choosing Nobody deletes your presence records and stops new ones being written. Depending on where you live, you may also have additional rights described in Sections 9 through 13 below. To exercise any of these rights, you can also contact us as described in Section 16.
8. Children's Privacy
The App is not directed to children and is not intended for use by anyone under the minimum age of majority described in our Terms & Conditions. We do not knowingly collect personal information from children under 13 (or the applicable minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us and we will take steps to delete it.
9. International Users and Data Transfers
WinSpree's infrastructure runs on Google Firebase and Google Cloud Platform, which may process and store information in the United States and other countries where Google operates data centers. If you access the App from outside the United States, your information will be transferred to and processed in the United States, which may not have the same data protection laws as your home jurisdiction. Where information is transferred out of the United Kingdom, the European Economic Area or Switzerland, that transfer is made under the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum and the Swiss addendum where applicable), which our infrastructure provider incorporates into its terms, together with the supplementary measures described in Section 14.
10. Additional Rights for California Residents
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we have collected about you, to request deletion of that information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. WinSpree does not sell personal information and does not share it for cross-context behavioral advertising outside of the App's own rewarded-ad feature described in Section 2. You can exercise these rights by contacting us as described in Section 16 or by using the in-App deletion tool described in Section 7.
11. Additional Rights for Canadian Residents
If you are a Canadian resident, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws give you the right to access the personal information we hold about you, to request correction of inaccurate information, and to withdraw consent to our collection and use of your information (which may limit or end your ability to use the App). You can exercise these rights by contacting us as described in Section 16.
12. Additional Rights for Users in the United Kingdom, the European Economic Area, and Switzerland
WinSpree does not offer accounts in the European Economic Area or the United Kingdom. If you are nonetheless in either and we hold personal data about you, the EU General Data Protection Regulation or the UK GDPR applies to our processing of it, and WinSpree is the controller of that data. If you are in Switzerland, the Swiss Federal Act on Data Protection gives you materially the same rights, and the rest of this section applies to you as written.
We rely on the following legal bases: performance of a contract with you, to create and operate your account and to administer the Sweepstakes you choose to enter; our legitimate interests, to keep the Service secure, prevent fraud and abuse of the Sweepstakes, moderate user-generated content, and understand how the App is used; your consent, for personalised advertising (which you give or refuse through the consent form shown when you first open the App, and can change at any time in Settings) and for push notifications; and compliance with legal obligations, including record-keeping for prize administration.
You have the right to request access to your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to our processing of it, to receive it in a portable form, and to withdraw any consent you have given at any time without affecting processing carried out before you withdrew it. Deleting your account through Settings exercises the right to erasure directly and immediately; the other rights can be exercised by contacting us as described in Section 16. We will not charge you for exercising these rights and will respond within one month.
You also have the right to lodge a complaint with your local supervisory authority (the Federal Data Protection and Information Commissioner in Switzerland, the Information Commissioner's Office in the United Kingdom, or the supervisory authority for your country in the EEA), and we would ask that you contact us first so we have the chance to resolve the matter.
13. Additional Rights for Users in Australia and New Zealand
If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles give you the right to access the personal information we hold about you and to request that we correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading, and to complain to us and then to the Office of the Australian Information Commissioner. If you are in New Zealand, the Privacy Act 2020 and the Information Privacy Principles give you equivalent rights of access and correction, and the right to complain to the Office of the Privacy Commissioner. You can exercise these rights by contacting us as described in Section 16, or delete your account and its data outright through Settings as described in Section 6.
14. Security
We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including relying on Google Firebase's security infrastructure and access-control rules that restrict who and what can read or write your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the version date at the top of this Policy in the App, and, where required by law, we will provide additional notice or seek your renewed consent. Continued use of the App after a change constitutes acceptance of the revised Policy.
16. Contact
Questions about this Privacy Policy, or requests to access, correct, or delete your information, can be directed to WinSpree at support@winspree.app, or through the contact option provided in the App's Settings screen.