Last updated: August 23, 2026
WinkBack is built on the principle of a minimal data footprint. We prioritize your privacy through architectural integrity and collecting only what is needed to run the messaging service. WinkBack is operated by KKY Tech, the data controller responsible for your personal information — you can reach us any time at kkytech.apps@gmail.com.
To provide messaging, WinkBack collects and stores the following:
| Data | Why | Where it is stored |
|---|---|---|
| Phone number | Account sign-in and your unique identifier | Firebase Authentication |
| Display name | So contacts and other users recognize you | Firebase Firestore |
| Date of birth | Profile / birthday features and to verify you meet the minimum age | Firebase Firestore |
| Gender | Profile and people-discovery (Wink); you may choose "Prefer not to say" | Firebase Firestore |
| Country | Derived from the country you pick at sign-up or your phone's dialling code — not precise location | Firebase Firestore |
| Profile photo (optional) | Avatar; auto-deleted after the expiry you choose (7 / 15 / 30 days) | ImgBB |
| Consent record | Date and version of the Terms & Privacy Policy you accept at sign-up | Firebase Firestore |
| Messages (text) | Core messaging | Firebase Firestore |
| Chat images & GIFs | In-chat media; auto-deleted when the message expires | ImgBB |
| Chat videos | In-chat media; deleted when the message expires | Supabase Storage |
| Notification token | To deliver push notifications | Firebase Cloud Messaging |
| Recovery email (optional) | Only if you enable two-step verification — used to email a code to reset your PIN | Firebase Firestore |
Device contacts are read only on your device to identify which of your contacts already use WinkBack. Your contacts are never uploaded to our servers or shared with anyone. WinkBack asks for contacts permission only after showing you an in-app explanation, and the app works fully if you decline.
Wink (people discovery): if you use the Wink feature, your display name, profile photo, country, age, and gender are visible to other WinkBack users so they can find and connect with you. Wink is available only to users aged 18 and older.
Profile photo screening: photos you upload are automatically checked for policy compliance (for example, to detect inappropriate content) before they are shown to others — see Section 5 below for how this works.
WinkBack does not collect, store, or share your location. On Android 12 and below, the operating system requires location permission in order to discover nearby devices for offline Bluetooth / Wi-Fi message relay. This permission is used solely for that device-discovery function — no location data is ever read, retained, or transmitted.
All data is transmitted over encrypted connections (HTTPS / TLS). Text messages are stored on Firebase Firestore, protected by server-side access rules that restrict each conversation to its participants. Profile photos, chat images, and GIFs are hosted on ImgBB and automatically deleted at the expiry period you select. Chat videos are hosted on Supabase Storage and deleted when the message expires.
When you send a message without an internet connection, WinkBack may relay it through nearby WinkBack users' devices over Bluetooth or Wi-Fi to reach the recipient. Relayed messages are held only briefly on those devices and are removed once delivered.
Note: WinkBack does not provide end-to-end encryption. Messages are stored on our servers so they can be delivered across your devices and transports.
You are in control of your data:
Depending on where you live, you may also have the right to access, correct, or erase your data, to object to or restrict certain processing, to data portability, to withdraw consent (by deleting your account), and to lodge a complaint with your local data-protection authority. To exercise any of these, use the in-app controls or email us at kkytech.apps@gmail.com.
We use the following providers to operate WinkBack. They act as data processors and are not permitted to use your data for their own purposes:
In-chat translation runs entirely on your device using Google ML Kit — translated text is never sent to any server. We do not sell, rent, or trade your personal information, and we do not use third-party advertising or analytics trackers.
International transfers: because these providers operate globally, your information may be stored and processed on servers located outside your country, including in the United States. Wherever it is processed, it remains protected under this policy and the providers' own safeguards.
WinkBack is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children under that age. Our Wink people-discovery feature is further restricted to users aged 18 and older.
We may update this Privacy Policy from time to time. Material changes will be reflected here with an updated "Last updated" date.
Questions about this policy or your data? Email us at kkytech.apps@gmail.com.