Legal
Privacy Policy
Effective 1 September 2026
English is the governing version of this document.
WinSight uses Vercel Web Analytics for anonymous, cookie-free site-use statistics. For public page views, Vercel also derives anonymous aggregate referrer, coarse location, browser, operating-system, and device categories. It records sanitised public routes and checkout-started or first-payment-succeeded counts without account, checkout, payment, provider, or prediction identifiers. This is separate from the consent-gated Whop Pixel.
This policy explains what personal information WinSight handles, why it is needed, and the choices available to you.
WinSight is built around data minimisation. Account data is limited to your email address and subscription state. Vercel Web Analytics provides anonymous, cookie-free site-use statistics; the separate Whop Pixel remains off unless you consent. We do not sell personal information or build advertising profiles.
Controller
The WinSight data controller is Alex. Contact: support@winsightapp.com.
1. Information we handle
When you create an account or subscribe, WinSight handles only the information needed to operate the account and recognise access:
- your email address and the identifiers needed for passwordless authentication;
- your subscription plan, status, renewal or expiry date, the Whop membership, checkout, and payment identifiers needed to match that status to your account, and evidence of any immediate-digital-access acknowledgement made at checkout.
- when you start checkout, the canonical first-party page path, without user-provided query parameters or fragments, that Whop needs to return you to the same page;
- for Vercel Web Analytics, a sanitised public route without query parameters or fragments, together with anonymous aggregate referrer, location, browser, operating-system, and device categories. Match and weekly-report details are replaced with generic route labels, while login, account, authentication, cancellation, preview, and API routes are excluded. Checkout-started and first-payment-succeeded events carry no custom properties or account, checkout, payment, provider, or prediction identifiers;
- if you allow the Whop Pixel, the clean public page URL and title, strict-origin referrer, ordinary browser, device, and network-request signals, and Whop's own anonymous browser and attribution matching signals needed to relate page views to Whop-hosted checkout and purchase activity. Pages with query strings, fragments, private routes, authenticated account content, or sensitive same-origin referrers are excluded. WinSight does not attach your email, name, phone number, account ID, subscription state, or prediction content to the page event;
- if you use the direct contact form, the reply email address and message you submit.
2. Information we do not collect
WinSight does not receive or store card numbers, CVVs, bank details, or payment credentials. Whop hosts checkout and processes payments. WinSight receives only the provider identifiers, billing country, amounts, status, refund, and dispute information needed to deliver access, support buyers, monitor tax thresholds, and keep accounting records.
The WinSight checkout ledger stores a localised Pricing fallback and does not store the specific match path you came from.
We do not ask for a profile name, postal address, telephone number, date of birth, betting history, or identity documents. We do not deploy Google Analytics, Meta, TikTok, Hyros, other advertising pixels, cross-site tracking, session replay, or data-broker enrichment. Vercel Web Analytics and the separate consent-gated Whop Pixel are the only site-measurement tools in this release.
3. Why we use the information
We use the limited information above to:
- send and verify passwordless sign-in links or complete an authentication request;
- show the correct free or paid access state and maintain subscription continuity;
- respond to support, privacy, refund, or security requests;
- measure anonymous site use and the checkout-started to first-payment-succeeded funnel with Vercel Web Analytics, without creating an identity profile;
- measure page views and relate them to Whop-hosted checkout and purchase activity after consent, so we can understand the product funnel without creating a separate identity profile;
- prevent fraud, misuse, and unauthorised access; and
- meet accounting, consumer-protection, and other legal obligations that apply to subscriptions.
Depending on your location, these uses rely on performing our contract with you, our legitimate interests in operating and securing the service, consent where required, and compliance with legal obligations.
4. Cookies and browser storage
WinSight currently uses essential browser storage on your device to remember your theme and privacy choice; these preferences are not sent to a WinSight account. When account sign-in is introduced, strictly necessary authentication storage may also be used to keep you signed in and protect the session.
Vercel Web Analytics does not use cookies. It runs independently of the Whop consent choice and receives only the sanitised page views and property-free conversion counts described above.
The Whop Pixel is off by default. Unless your accepted choice is successfully stored and read back, WinSight does not create the Whop global, load its script, or send a page event. Pending, rejected, blocked-storage, missing-config, and invalid-config states remain off. Rejecting does not reduce access.
You can reopen Cookie settings from the footer and withdraw at any time. WinSight first stops new local page events and then reloads only when either the stored acceptance is verified as cleared or a session-only force-off marker is verified. The new page gives force-off priority over an old stored acceptance. If neither safeguard can be verified, the current page stays open with measurement inactive. Requests already sent or in flight before withdrawal cannot be recalled.
5. Service providers
We use Vercel for hosting and anonymous, cookie-free Web Analytics, Supabase for the application database and authentication, Resend for service and operational email, and Whop to host checkout and process payments. WinSight, not Whop, supplies the subscription service and handles product-access, cancellation, and refund decisions under the published policies.
When checkout starts, Whop receives that canonical first-party source path without user-provided query parameters or fragments. The return URL may also include WinSight's fixed, non-sensitive checkout-return status so the original page can show that access is being confirmed and offer a manual refresh. These values are used only to return you to the page and support payment security or buyer support. WinSight does not use them for advertising profiles. Whop handles this navigation metadata with the payment records it needs under its own policies.
After consent, Whop receives the Pixel page information and signals described above and uses its first-party checkout and payment data to report page views, hosted-checkout views, purchases, subscriptions, and trials. WinSight sends only the official page event and does not send identity fields, custom events, or duplicate checkout, purchase, subscription, or trial events.
These providers process information under their own contractual and legal responsibilities. Hosting and security providers may necessarily process ordinary network request data, such as an IP address and request metadata, to deliver and protect the site. WinSight does not use that technical data to build advertising profiles.
We do not sell or rent personal information and do not share it with advertisers or data brokers.
6. International processing
Our providers may process data in countries other than your own. Where required, they and WinSight use appropriate contractual or legal safeguards. Local authorities may have lawful access under the rules that apply in those countries.
7. Retention
We retain account information while your account is active and for only as long afterwards as needed for support, security, dispute resolution, or legal obligations. Subscription records may need to be retained for accounting and consumer-protection purposes even after cancellation.
Contact messages are kept only as long as needed to answer and meet support, security, or legal obligations. Anti-abuse rate limiting stores a keyed, irreversible network-address digest rather than the original address. It is used only during a 15-minute rate-limit window; after expiry it no longer affects submissions and becomes eligible for bounded, request-driven deletion in batches.
WinSight does not copy Whop Pixel events into its own analytics database. Whop retains and handles Pixel and attributed checkout data under its own policies; WinSight does not promise a retention period that Whop has not published or contractually fixed for this use.
Vercel retains anonymous Web Analytics data under the limits and retention applying to WinSight's Vercel service. WinSight does not copy raw Vercel page views or conversion events into a separate analytics database and does not promise a retention period beyond Vercel's applicable service terms.
When information is no longer needed, it is deleted or anonymised. Infrastructure security logs follow the limited retention schedules operated by the relevant provider.
8. Security
WinSight uses passwordless authentication, encrypted connections, restricted database roles, and separated read and write paths. No internet service can promise absolute security; please contact us promptly if you suspect unauthorised access.
9. Your choices and rights
Depending on where you live, you may ask to access, correct, delete, restrict, or export personal information, or object to certain processing. You may withdraw Whop Pixel consent from Cookie settings without affecting processing that was lawful before withdrawal.
We may need to verify that a request relates to your email account. You may complain to the data-protection authority available in your country if you believe your rights have not been respected.
10. Children
WinSight is for adults aged 18 or over. We do not knowingly collect personal information from children.
11. Changes and contact
We may update this policy when the service or legal requirements change. Material changes will be highlighted on the site or by account email where appropriate.
Privacy questions and rights requests may be sent to: