Privacy Policy

Last Updated: October 2026 • GDPR & UK DPA Compliant

Terms of Service

Location Fuzzing

Coordinates are automatically blurred by 1–2km. Your precise street address is never shared.

Private Albums

Private media is locked. Only members you personally approve can view your private photos.

No Data Selling

We never sell your personal data or browsing behavior to third-party ad brokers. Ever.

1Information We Collect

When you register and interact with Winkalo, we collect:

  • Account Details: Email address, name, birthdate (age verification), gender, sexual orientation, bio, and intention tags.
  • Media: Public profile photos, verification gesture selfies (processed solely to verify account authenticity and not published publicly), and private album media.
  • Location Data: Approximate coordinates from your mobile browser or device when permission is granted.
  • Usage & Communication: Messages, winks, favorites, and profile visits to facilitate real-time connections.

2How We Use Your Information

Your data is utilized strictly to provide our service, including:

  • Populating your card on the local and global discovery grids.
  • Enabling real-time chat, voice notes, and media sharing between mutual connections.
  • Processing VIP subscription billing securely via Stripe.
  • Detecting fraudulent accounts, spammers, bot activity, and preventing underage sign-ups.

3Deterministic Location Fuzzing Explained

To ensure safety without sacrificing the ability to meet nearby locals, our backend coordinates engine applies an algorithmic 1.0km – 2.0km fuzzing offset to all latitude and longitude data before sending it to client devices.

Additionally, members can activate Incognito Browsing (in Settings → Privacy & Visibility) or Ghost Mode to browse profiles without broadcasting presence on the public grid.

4Third-Party Processors & Security

We partner with trusted, SOC2/PCI-DSS compliant infrastructure providers:

  • Stripe Inc: Handles payment processing and credit card storage. Winkalo never stores your raw credit card numbers.
  • OpenStreetMap / Nominatim: Used strictly for city search and location autocomplete.
  • Encrypted Cloud Storage: All profile media is delivered through encrypted HTTPS connections with access tokens.

5Your Rights & Deleting Your Data

Under the UK GDPR, European GDPR, and California Consumer Privacy Act (CCPA), you retain the right to:

  • Request an electronic copy of all data held on your profile.
  • Export your chat logs and photos.
  • Delete your entire account and associated personal data at any time via Settings → Privacy & Data → Delete Account.

When an account is deleted, all profile data, photos, chats, and private media are permanently erased from our active production database.

6. Contact Our Data Protection Team

If you have privacy questions or wish to exercise your data subject rights, please email our Data Protection Officer at privacy@winkalo.com.