Privacy Policy

Last updated: May 15, 2026

1. Who we are

Winnow is operated by Floodgates Studio LLC, a Minnesota limited liability company ("we," "our," or "us"). This Privacy Policy describes how we collect, use, and protect information when you use the Winnow mobile apps, web app, browser extension, and related services (collectively, the "Service").

If you have questions, contact us at hello@winnow.site.

2. What we collect

We collect only what is needed to run the Service. We do not use any third-party analytics or advertising SDKs.

Category	What it includes	Source
Account	Email address, account-level settings (timezone, plan), and the dates your account was created and last updated.	You provide this when you sign up.
Saved content	The URL, title, and visible text of articles you save; tags or notes you add; and the idea cards we generate from those articles.	You save it through the browser extension, mobile share sheet, or web app.
Push tokens	The Expo push token assigned to each device you sign in on, plus a device-type label (iOS/Android).	Generated by the OS and registered with us when you opt in to notifications.
Notification delivery records	Which idea card was sent, when, and whether it was delivered, opened, or acknowledged.	Created by our system when notifications run.
Embeddings	Numeric vectors derived from article titles and idea card summaries, used for "related ideas" and search.	Generated by us from your saved content.
Operational logs	Server logs of API requests (timestamps, route, response status). Used for debugging and abuse prevention. Logs are retained for up to 30 days.	Created automatically.
Session cookies	An encrypted Rails session cookie used to keep you signed in on the web app. No tracking or advertising cookies.	Set by us when you sign in.

We do not collect passwords (we use email magic links instead), names, addresses, phone numbers, payment card numbers, location, contacts, calendars, photos, microphone, camera, or biometric data.

3. How we use it

• To provide the Service: store your saved articles, generate idea cards, deliver notifications, and let you sign in.
• To improve the Service: investigate bugs, monitor reliability, and tune the AI prompts that produce idea cards.
• To communicate with you: send sign-in magic links, account-related email (e.g., a confirmation when you delete your account), and security notices.
• To enforce our Terms and protect users: detect abuse and respond to legal requests where required.

We do not sell your information, and we do not use your saved content to advertise to you or to anyone else.

4. Third parties we share data with

We share information only with the service providers we need to run Winnow. Each is bound by a contract requiring them to protect your data:

• OpenAI — processes the text of your saved articles to generate idea cards and embeddings. OpenAI does not use this content to train its models (per their API data policy). Only article text and prompts are sent; your email and account ID are not.
• Jina AI Reader — for a small set of paywalled news sources (currently The New York Times, The Wall Street Journal, and the Financial Times), we may send the article URL — and only the URL — to Jina's reader service to fetch the publicly available preview when our own extraction is blocked. Your email, account ID, and the article body are never sent.
• Render — hosts our application servers and database in the United States.
• Expo Push Service — delivers push notifications to your device. Only the push token, the notification title and body, and a card reference ID are sent.
• Email service provider (SMTP) — delivers transactional email (magic links and account notices). The provider sees the recipient address and the email body.
• Umami — a cookieless analytics service used only on our marketing landing page at winnow.site to measure visits. It does not run inside the Winnow apps, the web app, or the browser extension, and no information about your saved articles, idea cards, or account flows to Umami.

We may also disclose information when required by law, to enforce our Terms, or to protect the rights, property, or safety of Winnow, our users, or others. If Floodgates Studio LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred, but it will remain subject to a privacy policy at least as protective as this one.

5. Content capture policy

Winnow only saves content that you explicitly choose to save. We do not:

• Automatically scrape or download websites in the background.
• Bypass paywalls, login walls, or other access controls.
• Re-fetch URLs to refresh or expand content.

When you click "Save" in the browser extension or share to Winnow, we capture the content visible to you at that moment. If a page is paywalled, the extension only captures what your browser already has access to.

6. AI processing

We send the text of your saved articles to OpenAI to generate the idea cards and embeddings that power the Service. OpenAI's API terms prohibit using customer data to train their models. We do not enable OpenAI's optional retention features beyond what is required to run the Service.

Generated idea cards are summaries and interpretations, not exact reproductions. The accuracy of any idea card depends on the source material and the AI; treat it as a prompt for thought, not a citation.

7. Where your data lives and how long we keep it

Your data is stored on servers in the United States operated by Render. If you access Winnow from outside the U.S., your information will be transferred to and processed in the U.S.

We keep your data while your account is active. You can delete your account at any time:

• Open Winnow → Settings → Delete Account, or email hello@winnow.site.
• When you delete, we permanently remove your articles, idea cards, embeddings, push tokens, notification history, and account record from our active systems within 30 days.
• We retain a small anonymized audit row (a hashed user ID, a hashed email, the date, and a reason code) so we can prove the deletion happened. It contains no personal information that can identify you.
• Backups containing your data roll off within 30 days of deletion.

8. Your rights

You have the right to:

• Access: view your saved articles, idea cards, and account settings inside the app at any time.
• Export: request a copy of your data by emailing hello@winnow.site. We'll send a JSON export within 30 days.
• Correct: update your email or settings in the app, or email us for help.
• Delete: delete individual articles or your entire account from inside the app.
• Opt out: turn notifications off per device or per idea card from inside the app.

California residents have additional rights under the CCPA/CPRA, including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined under California law.

Residents of the EU, UK, and similar jurisdictions have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, portability, and objection. Our legal basis for processing is performance of the contract you enter when you create an account and our legitimate interest in keeping the Service secure and reliable. You can lodge a complaint with your local supervisory authority.

To exercise any of these rights, email hello@winnow.site. We'll respond within 30 days.

9. Security

We use TLS for all traffic between your devices and our servers, encrypt our database at rest, store secrets in a managed secrets store, and follow least-privilege access for our team. No method of transmission or storage is 100% secure, but we work to keep your data safe and notify you promptly if we ever learn of a breach affecting your account.

10. Children

Winnow is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact hello@winnow.site and we will delete the account.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Continued use of the Service after a change means you accept the updated policy.

12. Contact

Floodgates Studio LLC
Email: hello@winnow.site
Web: floodgates.studio

← Back to Winnow