Wimsi CoveThe short version
- This policy covers the Wimsi Cove app, our website and our waitlist.
- In the app, we use your information to run your account, show your posts and messages to the people you choose, and keep the community safe.
- If you join the waitlist, we keep your email address and the hobbies you tick, so we can tell you when Wimsi Cove launches.
- If you buy in the Marketplace, our payment provider Stripe handles your card details. We never see your full card number. The seller gets your name and delivery address so they can post your order.
- We never sell your information, and we don't use advertising or tracking cookies. There are no ads in Wimsi Cove.
- Anonymous usage stats help us improve the app. You can turn them off in Settings → Privacy.
- You can unsubscribe, delete your account in the app, or ask us to delete your information at any time.
1. Who we are
Wimsi Cove is run by Wimsi Cove Ltd, a company registered in Scotland (company number SC906023), whose registered office is at 10 Derwent House, Kilmarnock ("Wimsi Cove", "we", "us"). Wimsi Cove Ltd was founded by Declan Testo and Anna Stark. We're responsible for your personal information as the "controller" under UK data protection law.
Contact us about privacy at admin@wimsicove.com.
2. What this policy covers
This policy explains how we use personal information when you use the Wimsi Cove app, visit wimsicove.com, or join our waitlist. Section 3 covers the website and waitlist, and section 4 covers the app.
3. The website and waitlist: what we collect and why
| Information | Why we use it | Our legal basis |
|---|---|---|
| Your email address, when you join the waitlist | To tell you when Wimsi Cove launches, send you early access, and share occasional pre-launch updates | Your consent, which you can withdraw at any time |
| Your interests (gaming, reading, crafts), if you choose to tick them | To understand what our early community is into and make our updates more relevant | Your consent |
| The date and time you signed up, and that you signed up through our website | To keep a record of your consent and work out who our earliest members are (for example, for Founding Member perks) | Our legitimate interests in running a fair waitlist and keeping records of consent |
| Emails you send us | To reply to you and deal with your request | Our legitimate interests in answering questions |
| Basic technical information (such as your IP address and browser type), collected automatically by our hosting and font providers when your browser loads the website | To deliver the website to your device and keep it secure | Our legitimate interests in running a working, secure website |
If you join the waitlist from the app because Wimsi Cove isn't open where you live yet, we also keep the country (and US state) you chose, so we know where people are waiting and can tell you when we open there.
We don't ask for your name, date of birth, phone number or address to join the waitlist. Please don't send us sensitive information (such as health information) by email.
4. The app: what we collect and why
| Information | Why we use it | Our legal basis |
|---|---|---|
| Account details: your email address, password (stored securely scrambled, so we can't read it), date of birth, and the country (and US state) you tell us you live in | To create your account, let you sign in, check Wimsi Cove is open where you live, and check you meet the minimum age there (16 in the UK, 18 in the United States) | To provide the app you've asked for (contract), and our legal obligations to keep younger children off the app |
| Your profile: username, display name, and anything you choose to add, such as a photo, banner, bio, interests, favourite books and games, and your Bookshelf and Game Vault | To show your profile to other members and help you find people who share your hobbies | Contract |
| What you post and share: posts, comments, photos, likes, follows, saves, reviews, reports, and an optional place name you add to a post | To show them to the people you share them with, and to build your feeds | Contract |
| Messages and Cove Circles: your private messages, group chats and the photos you share in Circles | To deliver them to the people you're talking to. We only look at messages if they're reported to us, or if we need to for safety or legal reasons | Contract, and our legitimate interests in keeping members safe |
| Marketplace: your shop details, listings and photos, files you attach to digital listings, and the items in your basket and wishlist | To run your shop and let you buy from other members' shops | Contract |
| Orders and payments: what you bought or sold, prices, postage and our commission, order status and tracking details, your email address, and (for items that are posted) your name and delivery address. Card payments are handled by Stripe. We receive a reference for each payment but never your full card number | To take payment, send your name and delivery address to the seller so they can post your order, let you download digital items you've bought, pay sellers, deal with refunds, and prevent fraud | Contract, and our legal obligations to keep financial and tax records |
| Seller payouts: if you sell, Stripe collects and checks your identity, date of birth and bank details on its own pages. We only keep the reference for your Stripe account and whether payouts are ready | To pay you for your sales and meet anti-money-laundering rules | Contract, and Stripe's and our legal obligations |
| Rewards: counts of things you do in the app, such as Roses you receive and books, games and crafts you add, and the Cove Points, badges and decorations they earn | To award your Cove Points and badges and unlock profile decorations | Contract |
| Safety information: reports, blocks, mutes, moderation decisions, and the results of our automatic photo checks | To deal with reports, enforce our Terms and Community Guidelines, and protect members | Our legitimate interests in keeping the community safe, and our legal obligations under online safety law |
| Phone notification token: a code from Apple or Google that lets us send notifications to your phone | To send you notifications you've chosen to get, such as new messages or replies. You can turn them off in your phone's settings | Contract |
| Usage stats: which kinds of screens you visit and key moments such as finishing sign-up, linked to a random account number, plus your device type and app version. Never your name, email, posts or messages, or which specific profile, post or chat you opened | To understand which parts of the app work well and where people get stuck | Our legitimate interests in improving the app. You can turn this off at any time in Settings → Privacy |
| Crash reports: technical details about what went wrong when the app crashes or a screen breaks, such as your device model, app version and the error. We don't attach your name, email or IP address | To find and fix bugs | Our legitimate interests in keeping the app working |
We remove location data (GPS details) from the photos you upload. We don't collect your phone number, contacts or precise location.
Automatic photo checks
To keep Wimsi Cove safe, photos you upload (for example profile photos, banners, post photos, Circle photos and shop photos) are automatically checked by a safety tool provided by OpenAI. Photos that appear to be sexual, graphic or related to self-harm are removed. OpenAI processes photos only to check them, and doesn't use them to train its models. If you think a photo was removed by mistake, email admin@wimsicove.com and a person will review it.
5. Cookies
Our website doesn't use cookies for advertising, analytics or tracking. If we ever add any non-essential cookies, we'll ask for your permission first and update this policy. The phone app doesn't use cookies. It remembers that you're signed in, and your settings, on your phone. When you use Wimsi Cove in a web browser, it saves the same things in your browser's storage. This is needed for the app to work, so we don't ask for permission first. When you pay, Stripe's checkout page uses its own cookies to process the payment and prevent fraud (see Stripe's privacy policy).
6. Who we share it with
We never sell your personal information, and we don't share it with advertisers. We only share it with trusted service providers who help us run Wimsi Cove and who may only use it on our instructions:
- Supabase, our database and storage provider, which stores your account, profile, posts, messages, photos and the waitlist. Our database is hosted in the European Union (Ireland).
- Netlify, which hosts our website.
- Stripe, which processes Marketplace payments, refunds and seller payouts, and checks sellers' identity. Stripe is also responsible for some of this information itself, for example to meet financial regulations and prevent fraud (see Stripe's privacy policy). Stripe's UK and EU services are provided from Ireland, and it may transfer information to the United States.
- Resend, which sends our emails (such as your waitlist welcome email). Resend is based in the United States, so your email address is transferred there, protected by the safeguards UK law requires for international transfers.
- OpenAI, which provides our automatic photo safety checks (see section 4). OpenAI is based in the United States.
- Expo, which passes phone notifications on to Apple and Google so they reach your phone. Expo is based in the United States.
- PostHog, which processes our usage stats. Data is stored in the European Union (Germany).
- Sentry, which processes our crash reports. Data is stored in the European Union (Germany).
- Apple and Google, which run the app stores you download Wimsi Cove from, under their own privacy policies.
- ipapi.co, which our server asks for your likely country when you open the sign-up screen, so we can fill in "Where do you live?" for you. It receives your IP address. We don't store your IP address, and you can change the country we suggest.
- Open Library, Google Books and Steam, which our server searches when you look up a book or game to tag or review. They receive the words you type, but not your name, account or IP address.
- Google Fonts, which supplies the fonts on our website. Your browser connects to Google's servers to load them, which shares your IP address with Google.
Other members see what you share with them, such as your profile, posts and comments, and your messages to them. Your date of birth and email address are never shown to other members.
When you buy from a shop, the seller sees your username, what you ordered, any note you leave them, and, for items that are posted, your name and delivery address. Sellers may only use these details to complete and support your order.
We may also share information if the law requires it, to protect people's safety, or if Wimsi Cove is sold or merged with another company. In that case, your information would stay protected by this policy.
7. International transfers
Some of our service providers are based in, or may access data from, countries outside the UK, such as the United States. When this happens, we make sure your information is protected by appropriate safeguards required by UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
8. How long we keep it
- Waitlist details: until 12 months after Wimsi Cove launches, unless you create an account, unsubscribe, or ask us to delete them sooner. If you unsubscribe, we may keep just your email address on a "do not contact" list so we don't email you again by mistake.
- Your account: for as long as you have an account. When you delete your account in the app, we delete your profile, posts, comments, messages and photos (order records are kept as explained below). A few things, such as reports and moderation records, may be kept for up to 2 years if we need them for safety or legal reasons.
- Orders and payments: for 6 years after the end of the financial year the order was in, because UK tax law requires us to keep financial records. We keep these even if you delete your account, but we remove them from your profile and the app.
- Usage stats and crash reports: kept by PostHog and Sentry for a limited time (no more than 12 months), then deleted automatically.
- Emails you send us: for as long as we need to deal with your request, and then for up to 2 years in case you get back in touch about it.
9. Keeping it safe
We use security measures to protect your information, including encrypted connections and strict access controls on our database, so members can only see what other members have chosen to share with them. Visitors to our website can add themselves to the waitlist but can't see anyone else's details. Only the Wimsi Cove team can access the list.
10. Age
Wimsi Cove is for people aged 16 and over in the UK, and 18 and over in the United States. We ask for your date of birth and where you live when you create an account, and you can't sign up if you're under the minimum age where you live. Please don't join the waitlist if you're under 16. If we learn that we hold information about someone under the minimum age, we'll close their account and delete it.
11. Your rights
Under UK data protection law, you have the right to:
- access the personal information we hold about you;
- ask us to correct it if it's wrong;
- ask us to delete it;
- withdraw your consent at any time, for example by unsubscribing from our emails. This won't affect anything we did before you withdrew it;
- object to, or ask us to restrict, how we use it; and
- ask us to send it to you or another organisation in a reusable format (data portability).
You can see and change most of your information yourself in the app, and delete your account in Settings → Delete account. To use any of these rights, email admin@wimsicove.com. We'll reply within one month. It's free, unless a request is clearly unfounded or excessive.
12. Complaints
If you're unhappy with how we've used your information, please contact us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this policy
We'll update this policy when we change how we use personal information, for example when we add new features. We'll change the "last updated" date at the top. If the changes are important, we'll let you know by email.