Privacy Policy
Wynko — Learn Together. Win Together. · wynko.in
Last updated: 17 September 2026 Effective date: 17 September 2026
1. Who we are
Wynko ("Wynko", "we", "us", "our") is a collaborative learning platform for students, available at https://wynko.in and through our apps (together, the "Platform"). Wynko helps students focus, study solo, join study chat and voice rooms, set goals, and learn together.
Wynko is currently operated as an unregistered venture by its founding team. The person responsible for your personal data is:
- Operator: Mahipat Singh Sengar, operating as Wynko
- Address: 154 Sevagram Colony, Khajuraho, Madhya Pradesh, India
- Contact email: founder@wynko.in
- Grievance Officer (India — required under the DPDP Act, 2023 and the IT Rules, 2021): Mahipat Singh Sengar, founder@wynko.in
If Wynko is later incorporated as a company, this Policy will be updated to name that company as the data fiduciary and your data will transfer to it.
2. Scope
This Policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to everyone who uses the Platform, including people who only sign up to the waitlist. It does not apply to third-party websites we link to.
3. What data we collect
3.1 Data you give us
| Category | Examples | Why we need it |
|---|---|---|
| Account data | Name, email address, profile photo, username, age or date of birth | To create and secure your account |
| Google Sign-In data | Your name, email address, and profile picture as supplied by Google. We never receive your Google password. | To let you sign in without a separate password |
| Profile and study data | Class or year, exams or subjects you're preparing for, goals, study preferences, timetable | To personalise your study experience |
| Content you create | Notes, tasks, goals, files you upload, and messages you send in chat rooms | To deliver the core features |
| Voice data | Live audio you speak in a voice study room, plus your microphone permission and mute state | To let you talk to other students in real time |
| Social activity | Study rooms and groups you join, friends, leaderboard participation, streaks | To enable learning together |
| Support and feedback | Emails you send us, bug reports, survey answers | To answer you and improve Wynko |
| Payment data (planned, not collected today) | Billing name, email, plan, transaction ID | To process subscriptions when we launch them. Card and bank details will be handled entirely by our payment processor and will never be stored on Wynko's servers. |
3.2 Data collected automatically
- Usage data: screens and pages viewed, features used, session length, focus-timer and streak activity, clicks, referring URL.
- Device and technical data: IP address, approximate city/country derived from IP, device type, operating system, browser and version, language, time zone, crash and error logs.
- Cookies and similar technologies: see Section 8.
3.3 Voice rooms — how your audio is handled
Voice study rooms run on Agora, a real-time audio provider. When you join a voice room:
- Your audio is transmitted live through Agora's servers to the other people in that room.
- We do not record or store your voice. Audio is streamed in real time, is not saved on Wynko's servers, and Agora's cloud recording is not enabled.
- Agora processes technical call data (connection quality, timing, IP address, channel ID) to deliver and debug the call. It acts as our processor and may not use your audio for its own purposes.
- Your microphone is accessed only while you are in a voice room and have granted browser or device permission. You can mute or leave at any time, and you can revoke microphone permission in your browser or device settings.
- If we ever introduce recording, we will ask for your explicit consent first and show a clear recording indicator to everyone in the room.
3.4 Sensitive data we don't want
Please do not put sensitive personal data — health details, Aadhaar or other government ID numbers, bank account numbers, caste or religion — into your profile, notes, or chat messages. We don't need it and we ask you not to share it.
4. Why we use your data, and our legal basis
Under India's Digital Personal Data Protection Act, 2023 we rely on your consent or on legitimate uses permitted by that Act. Where the GDPR / UK GDPR applies to a user, we rely on the basis shown below.
| Purpose | Legal basis |
|---|---|
| Creating your account, running study rooms, timers, goals, chat, voice rooms, and groups | Performance of a contract |
| Transmitting your live audio in voice rooms | Performance of a contract, plus your consent given through the microphone permission |
| Keeping Wynko secure; preventing spam, abuse, harassment, and fake accounts | Legitimate interests |
| Fixing bugs, measuring performance, and improving features | Legitimate interests / consent for non-essential analytics |
| Service emails (password resets, security alerts, changes to these policies) | Contract / legal obligation |
| Product announcements and marketing emails or push notifications | Consent — withdraw any time |
| Streaks, leaderboards, and study suggestions | Legitimate interests / consent |
| Processing payments and keeping tax records (once paid plans launch) | Contract / legal obligation |
| Responding to lawful requests and enforcing our Terms | Legal obligation / legitimate interests |
We do not sell your personal data. We do not share it with anyone for their own advertising. We do not run behavioural advertising on the Platform.
5. Users under 18 — important
The minimum age to use Wynko is 13.
Under India's DPDP Act, everyone under 18 is treated as a "child". This means:
- If you are under 18, you may only use Wynko with the consent of a parent or legal guardian, and we will ask you to provide a parent's or guardian's verifiable consent before your account is fully activated.
- We do not carry out behavioural tracking, profiling, or targeted advertising directed at users under 18.
- We keep data collected from under-18 users to the minimum needed to run the study features, and we never record voice rooms.
- Voice rooms let minors speak with other users in real time. Parents and guardians should be aware of this; we act quickly on safety reports sent to founder@wynko.in.
- Parents and guardians can review, correct, export, or delete their child's data, or withdraw consent, by emailing founder@wynko.in. We will act within 30 days.
If we learn that we hold data about a child without the required parental consent, we will delete it promptly.
6. Who we share data with
We share personal data only with the service providers below, only to the extent needed, and always under contracts that require them to protect it and use it only on our instructions.
| Provider | What it does for Wynko | Data involved |
|---|---|---|
| Supabase | Database, authentication, and backend storage | Account data, profile, your content |
| Backblaze (B2) | File and media storage | Files and images you upload |
| Cloudflare | DNS, CDN, DDoS protection, security filtering, and chat storage (R2 bucket) | IP address, request metadata; chat messages with Wynky AI assistant and between users (stored in R2 for Wynky AI training only with your separate, explicit opt-in consent, then auto-deleted after 90 days) |
| Vercel | Website and application hosting | IP address, request logs |
| Google Sign-In | Login | Name, email, profile picture |
| Agora | Real-time voice in study rooms | Live audio (not recorded), IP address, connection and call-quality data |
| Google Analytics | Understanding how the Platform is used | Pseudonymous usage and device data, IP (truncated where supported) |
| Razorpay (planned) | Subscription payments | Billing details, transaction records |
About chat data and AI training — your consent matters: Your conversations with the Wynky AI assistant and between users in study groups may be stored in Cloudflare's R2 bucket for training and improving the Wynky AI model's responses and capabilities. Under India's Digital Personal Data Protection Act, this use of your data requires your separate, explicit consent, independent of your agreement to use Wynko.
AI Training — Your Consent and Choices
- Opt-in, not opt-out: You will be asked to specifically agree to AI training during signup and in your account settings. Simply using Wynko does not automatically mean your chats will be used for training.
- Separate consent: This consent is separate from your general Wynko account consent. You are not required to agree to AI training in order to use Wynko's other features.
- You can change your mind anytime: You can enable or disable AI training consent at any time in your settings, or by emailing founder@wynko.in. There is no penalty for changing your choice.
- If you opt out: New chats will not be stored for training. Previously collected chats will be deleted within 30 days of opting out. Chats older than 90 days are automatically deleted regardless of consent status.
- User-to-user chats: If you communicate with other users in study groups, all participants must individually consent to their own chats being used for training. Your consent does not cover their messages, and their consent does not cover yours.
- Withdrawal of consent: When you withdraw consent, your chats that are more than 90 days old have already been deleted. Chats younger than 90 days will be deleted within 30 days.
Storage and deletion: Chat messages are not stored in Supabase—they stay only in Cloudflare's R2 bucket. After 90 days, all data is automatically deleted. We do not share chat data with any third party for their own purposes; it is used only to train and improve Wynky.
We may also disclose data to courts, regulators, or law-enforcement where legally required, to professional advisers, and to a successor if Wynko is acquired or reorganised (we'll notify you first).
Other users only see and hear what you choose to share: your display name and profile, your messages in chat rooms you join, your voice while you are unmuted in a voice room, your activity in shared groups, and your position on leaderboards you take part in.
7. International transfers
Some of our providers (Supabase, Backblaze, Cloudflare, Vercel, Google, Agora) store or process data outside India, including in the United States and the EU. Where data covered by the GDPR/UK GDPR leaves the EEA or UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant). You can ask us for details at founder@wynko.in.
8. Wynko Focus Lock browser extension
The Wynko Focus Lock extension for Chrome and Edge helps you stay focused by blocking distracting websites during your Wynko study sessions.
What data the extension collects and stores:
- Locally in your browser: Your active focus session state, custom blocklists, and counts of blocked attempts. This data never leaves your device.
- Sent to Wynko's backend: Periodic heartbeat requests (every 30 seconds) and session status updates (start, pause, end) to keep your session in sync with wynko.in and the Wynko desktop app. These requests contain only your session ID and current status, not browsing history or page content.
- Local connection to desktop app: If you have the Wynko desktop app running, the extension connects to http://127.0.0.1:47552 to sync session state. This is a local-only connection on your machine.
Optional adult-content filter: If you enable "Block adult content" in the extension's options, the extension analyzes each page's title, meta tags, and visible text in your browser to detect explicit content. This analysis happens entirely in your browser — the page content is never sent to us. The extension only records which domains were blocked, stored locally.
No other data: The extension does not access your full browsing history, does not use cookies or tracking pixels, and does not send page content or any personally identifiable information to Wynko.
For more details, see this full privacy policy.
9. Cookies and similar technologies
We use:
- Strictly necessary cookies and local storage — login sessions, security, and load balancing (Supabase auth, Cloudflare). These can't be turned off.
- Preference cookies — remembering your settings, theme, and language.
- Analytics cookies — Google Analytics, to see which features are used.
We don't run advertising or retargeting pixels. Where the law requires it, we ask for consent before setting analytics cookies, and you can change your choice at any time by emailing founder@wynko.in or through your browser settings.
10. How long we keep data
| Data | Retention |
|---|---|
| Account and profile | While your account is active, then deleted or anonymised within 30 days of deletion |
| Your content (notes, tasks, uploads) | Until you delete it, or within 30 days of account deletion |
| Chat room messages | 12 months, or until deleted — messages you sent may remain visible to other room members in context |
| Chats with Wynky AI assistant and in study groups (for AI training) | 90 days maximum (stored in Cloudflare R2 only with your opt-in consent, then automatically deleted). Consent can be withdrawn anytime; chats are deleted within 30 days of withdrawal. |
| Voice room audio | Not stored — streamed live only |
| Voice call metadata (join and leave times, quality logs) | 3 months, held by Agora for debugging |
| Backups | Rolling backups purged within 35 days |
| Analytics data | 14 months |
| Security, abuse, and moderation logs | 12 months |
| Payment and tax records (once applicable) | 8 years, as required by Indian tax law |
11. How we protect your data
Data is encrypted in transit (HTTPS/TLS everywhere, via Cloudflare and Vercel) and at rest with our storage providers. We use Supabase row-level security and role-based access, restrict access to the minimum number of people, keep dependencies patched, and log access. No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India (and CERT-In, and your EU/UK authority where applicable) within the legally required timeframes.
12. Your rights
You can ask us to:
- Access the data we hold about you and get a copy;
- Correct anything inaccurate or incomplete;
- Delete your data;
- Port your data to another service in a machine-readable format;
- Object to or restrict certain processing;
- Withdraw consent at any time (this doesn't undo processing already done lawfully);
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP Act);
- Complain to the Data Protection Board of India, or to your local authority if you are in the EU/EEA or UK.
Email founder@wynko.in. We respond within 30 days and never penalise you for exercising a right. We may ask you to verify your identity first. You can delete your account at any time by emailing founder@wynko.in from your registered email address.
13. Changes to this Policy
We'll update this Policy as Wynko grows — for example when we launch paid plans or add new providers. For material changes we'll notify you by email or in-app at least 7 days before they take effect. The "Last updated" date above always reflects the current version.
14. Contact
Email: founder@wynko.in Operator / Grievance Officer: Mahipat Singh Sengar Address: 154 Sevagram Colony, Khajuraho, Madhya Pradesh, India
We aim to acknowledge privacy requests within 48 hours and resolve them within 30 days.