Privacy Policy

1. Who is responsible

Boards is operated by the owner of winq.world as a private testing project. For privacy questions or requests, contact privacy@winq.world. If you were invited to the test, you can also use the address that sent your invitation.

2. Information we collect

Google account information. When you choose “Continue with Google”, Google confirms your identity and returns your email address, display name and profile picture. We use the scopes openid, email and profile. We do not request access to Gmail, Google Drive, Google Calendar, contacts or any other Google service, and we do not retain Google access or refresh tokens after sign-in.

Your Boards content. When you use the whiteboard we store the content you create, including boards, folders, titles, text, equations, handwriting strokes, diagrams, shapes, sticky notes, images and stickers, board settings, bookmarks and deleted items.

AI and MCP connection data. If you connect an AI application, we store the application’s name, redirect address, requested scope, connection timestamps and the status of the connection. OAuth access and refresh tokens are stored only as one-way hashes. We also record which account a connection belongs to so that one user’s AI cannot access another user’s boards.

Session and technical data. We store a server-side session record so you can sign out and so an expired or revoked session can be rejected. Our hosting provider processes standard request logs (such as IP address, user agent, timestamp and requested URL) for security, reliability and abuse prevention. Application logs are designed not to contain board contents, passwords or OAuth tokens.

Cookies. Boards uses only essential cookies:

• winq_session — keeps you signed in. It is HttpOnly, SameSite=Lax, valid for up to 30 days, and revoked on sign-out.
• winq_oauth_state — protects the Google sign-in redirect against cross-site request forgery. It expires after about 10 minutes.

We do not use advertising cookies, third-party analytics, tracking pixels or cross-site behavioural profiling.

3. How we use information

• To sign you in with Google and create or retrieve your account.
• To create and operate your private workspace, boards, folders and files.
• To let an AI application you explicitly authorise read and edit your boards.
• To keep different users’ workspaces separate and enforce access controls.
• To detect abuse, debug failures, maintain security and recover from incidents.
• To respond to support, privacy and legal requests.
• To comply with applicable legal obligations.

Where data protection law requires a legal basis, we rely on performance of our agreement with you (providing Boards), our legitimate interests (security, reliability and preventing abuse), your consent (Google sign-in and optional AI connections), and legal obligations where applicable.

4. Google user data and Limited Use

Boards’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used only to authenticate you and display your account identity.
• We do not sell Google user data or use it for advertising.
• We do not use Google user data to train general AI models.
• We do not allow humans to read Google user data unless you ask us to, it is necessary for security or abuse investigation, or the law requires it.
• We do not transfer Google user data to third parties except as necessary to provide Boards, to comply with law, or as part of a merger or acquisition with notice.

5. AI hosts, MCP and third-party services

Boards does not include a general-purpose AI model. When you connect an AI application such as ChatGPT, Claude, Gemini CLI or OpenCode, that application acts as an independent service under its own terms and privacy policy. Once you approve the connection, the application can read and edit the boards you make available to it, and the content you ask it to work on is sent to that provider.

We use the following service providers to run Boards:

• Google — identity verification through Google Sign-In.
• Vercel — application hosting, serverless functions and request logs.
• Turso — the libSQL cloud database that stores accounts and board content. The current database is hosted on Amazon Web Services in the us-east-1 region.

These providers process data on our behalf under their own terms and data protection commitments. We do not sell personal information, share it with advertisers, or use it to build advertising profiles.

6. International transfers

Boards is currently hosted and served from the United States. If you use Boards from another country, your information may be transferred to and processed in the United States and other locations where our providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

7. Security

We protect accounts and boards with signed, server-revocable sessions; encrypted HTTPS connections; per-user data scoping on every request; hashed OAuth tokens; short-lived authorisation codes; and access controls that prevent one account from reading another account’s boards by guessing identifiers. No system is completely secure, so please use a protected Google account and do not put highly sensitive information into a private test.

8. Retention

• Account and board content: kept while your account is active and until you ask us to delete it.
• Browser sessions: up to 30 days, or until you sign out or the session is revoked.
• AI connection grants: until you revoke them, they expire, or your account is deleted. Access tokens last about 1 hour; refresh tokens last up to 30 days.
• Request logs: retained by our hosting provider for a short operational period.
• Backups: retained for a limited period (currently up to 90 days) and then deleted or rotated.

9. Your choices and rights

You can:

• Sign out of Boards at any time; this revokes the session on the server.
• Review and revoke AI connections at /oauth/connections.
• Ask for a copy of your account and board data.
• Ask us to correct inaccurate account information.
• Ask us to delete your account, boards and AI connection records.
• Withdraw consent for future processing, without affecting processing already carried out.
• Complain to your local data protection authority where that right applies.

To make a request, email privacy@winq.world from the Google address used for your Boards account. We may need to verify that the account belongs to you before acting. We aim to respond within 30 days. Deleting an account removes its boards, sessions and runtime state; a small number of security or legal records may be retained where the law requires it.

10. Children

Boards is not directed to children under 13. If you are under 18, you may use Boards only with the involvement of a parent or guardian where required by your local law. If you believe a child has provided personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the private test evolves. The “Last updated” date at the top will change, and material changes will be communicated through the app or the invitation channel where practical. Continued use after an update means you accept the revised policy.

12. Contact

Privacy questions and requests: privacy@winq.world.

For how the service is provided, see our Terms of Service.