Winnable

Winnable Privacy Policy

Last updated: September 24, 2026

Winnable Health, Inc. ("Winnable," "we," "us") provides a web app that reads targets from your wearable and events from your calendar to plan health-related blocks on your Google Calendar. This policy explains what we collect, why, and what we do with it.

Winnable is currently available to residents of the United States only.

Information we collect

From your Google Account

Through Google Sign-In and the Google Calendar API, we collect:

  • Your email address and basic profile information, to create and secure your account.
  • Calendar events from every calendar visible to each Google account you connect, including work calendars shared into a personal account: times, status, titles, locations, descriptions, and attendees (including your own response). We use them to understand your day, for example to skip meetings you declined, notice flights and time off, and recognize important meetings. We store event details other than descriptions, which we read only to classify events, and we delete stored events once they are more than 14 days old.
  • If you connect more than one Google account (for example, a personal Gmail and a work Google Workspace account), we merge calendar data across them to build one view of your day.

We write only to a single, dedicated secondary calendar that Winnable creates in your Google account for its own blocks (movement breaks, workouts, wind-down). We never create, move, or delete anything on your primary calendar or any event you created yourself.

From Oura

With your authorization through Oura's OAuth flow, we pull:

  • Daily activity, including the 5-minute activity timeline
  • Daily readiness
  • Sleep and sleep time
  • Workouts
  • Rest Mode status

On first connection, we pull 60 to 90 days of this history to establish your baseline. After that, we receive updates through Oura's webhooks, with periodic polling as a fallback for when a webhook is missed. Because Oura syncs only when your phone app syncs, this data can be several hours stale; we design the app to degrade gracefully when it is.

Account, billing, and settings

  • Payment is handled entirely by Stripe. We never receive or store your full card number; we retain only your subscription status, plan, and a Stripe customer reference.
  • If you use the fallback work-pattern setting (for calendars we can't connect), the weekly schedule you enter is stored so we can plan around it.
  • Basic product usage, such as which blocks you complete, to power your progress view and to improve the product.

How we use your information

We use the data above only to:

  • Plan and place health-related calendar blocks around your existing meetings.
  • Re-plan in real time as your calendar or Oura data changes.
  • Show you your own trends and progress over time, described as associated with your habits, not as medical outcomes.
  • Provide customer support and keep the service secure.

We do not use your Google or Oura data to serve ads, and we do not sell your personal data.

Future employer and insurer programs

We are not currently building or offering any feature that shows your data, individually or in aggregate, to an employer or insurer. If we build one in the future, participation will require your separate, explicit opt-in on top of this policy, and no individual health or calendar data will ever be shared, only anonymized aggregates with minimum group sizes.

Who we share data with

We share data only with the vendors needed to run Winnable, each under their own data protection terms:

  • Supabase (database and authentication)
  • Vercel (application hosting)
  • Google Cloud (Calendar API and OAuth infrastructure)
  • Stripe (payment processing)
  • Oura (only to authenticate and retrieve your own data on your behalf)

We do not sell, rent, or share your personal data with any other third party.

Security

We encrypt stored access and refresh tokens, log administrative access to user data, and use database-level row security so that your health and calendar data is visible only to you, including inside our own systems.

Data retention and deletion

We retain your data while your account is active. If you disconnect Google Calendar or Oura, or delete your account, we delete the associated data within 72 hours, except where we're required to keep records longer for legal, tax, or fraud-prevention purposes.

You can remove all Winnable-created events from your calendar at any time from settings, without disconnecting or deleting your account.

Your choices

You can disconnect Google Calendar or Oura at any time from account settings, which stops new data collection immediately. You can request a copy of your data or full account deletion by contacting support@usewinnable.com.

Children's privacy

Winnable is not directed to, and does not knowingly collect data from, anyone under 18.

Google API Services Limited Use disclosure

Winnable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read your Google data except as needed for security, legal compliance, or to respond to a support request you initiate. We do not use Google data for advertising. We use Google data only to provide and improve the calendar-planning features described in this policy.

Changes to this policy

If we change how we use your data in a way not already covered here, we will update this policy and ask for your renewed consent before the change takes effect.

Contact

support@usewinnable.com