Privacy Policy

1. Scope and contact

This policy covers winnary.win, including its public demonstration and Analytics preview. It does not purport to describe every data practice of the separate Telegram product, access platform or payment provider. Those services may process account, purchase and access information under their own notices.

The Website operator is WINNARY LLC, Georgia (country). You can read the public pages without creating an account or providing a name.

2. Information, sources and purposes

• Connection and request information: your browser sends an IP address, requested URL, browser headers and request timing to our hosting infrastructure. These are used to deliver pages, troubleshoot requests and protect the service. Hosting or proxy logs may contain this information.
• Visit statistics: opening a connected page sends a random visit key and browser request to our access infrastructure. We record the visit time, connected website, approximate country from the network address, and browser, operating system and device type from request headers. This lets us count visits before anyone opens Telegram and retain source attribution when available. A page visit alone does not provide a Telegram name or account ID.
• Website interactions: when you open the Website through a connected access journey, we may record the page and actions such as opening the demonstration or selecting a free-trial button. These records help us understand Website usage and can remain associated with that access journey. A button click does not confirm that a trial started or a purchase was made.
• Preview session identifier: the Analytics endpoint sets a random, signed first-party cookie to identify a browser session. It is not a Telegram ID. It is marked HttpOnly and SameSite=Strict, and Secure on HTTPS.
• Abuse-prevention data: the application derives a keyed hash from the network address and stores a further hash, a timestamp and request count to limit bursts. Hashing does not mean that all connection data is anonymous.
• Display preferences: the embedded demonstration may save filters and display settings in local browser storage to remember your choices.
• Journey information: if you arrive through an access or referral journey, opaque continuation and return tokens may be held in session storage and internal link fragments. They allow the existing access platform to continue the correct journey and retain its source attribution when you choose to open the Winnary bot.

Public observations come from a server-side data source and are shared among visitors. Synthetic demonstration records are not records of your gambling activity. The Website does not request a gambling balance, payment-card number or government ID to view its public pages.

3. Recipients and external links

Hosting and infrastructure providers necessarily process requests to operate the Website. Our access infrastructure receives visit statistics when a connected page opens. When you choose an access button and continue to Telegram, the relevant services receive the requests and journey information needed for that transition. Account, anti-abuse and purchase processing is separate from the public preview.

The public Website includes no third-party advertising pixels or advertising analytics scripts; fonts and visual assets are served locally. The preview does not send the visitor’s browser directly to the upstream statistics API. Information may also be disclosed when legally required or necessary to address security incidents and protect legal rights.

External links lead to services with their own practices. The Website uses a strict-origin referrer policy: an eligible external request can reveal the site origin, not the full referring page path. Journey tokens are deliberately supplied to the access service when required to continue your visit; do not share access links publicly.

4. Cookies, retention and browser controls

• Observation cookie: winnary_observer_* has a browser lifetime of up to one year. You can delete it or block cookies using browser controls. Deleting it does not generate a new shared observation.
• Rate-limit records: records older than one hour are removed during subsequent rate-limit processing. This is request-driven cleanup, not a promise that every record is deleted exactly after one hour.
• Visit key: a random key in tab session storage is reused for up to 30 minutes, so a reload and the access button can continue the same visit. The server-side continuation mapping expires after 24 hours and is removed by scheduled cleanup. Visit statistics have separate retention; clearing the key does not delete already recorded statistics.
• Preferences: local storage remains until you clear it or the application replaces it. Journey session storage usually lasts for the browser tab session, subject to browser session-restoration behavior.
• Shared observation: the stored public snapshot is replaced after a successful refresh; it is not a personalized browsing history.

Infrastructure logs, support correspondence, backups and records retained from earlier preview versions have separate retention needs. The one-hour rule does not apply to them. Retention may be necessary for security, resolving requests and applicable legal obligations; this page does not promise that all data disappears when a cookie is cleared.

5. Your privacy choices and U.S. state rights

You can clear cookies and local storage, avoid entering an access journey, and exercise any applicable statutory privacy rights. Depending on your state and whether the relevant law applies, rights may also include a portable copy, opting out of sale, sharing or targeted advertising, limiting certain sensitive-data uses, and appealing a decision. We do not require you to waive applicable privacy rights to read this policy.

Contact information for submitting requests and appeals will be added here. Where applicable law provides a right to complain, you may contact your state attorney general or privacy regulator. Do not send passwords, payment details or identity-document scans through unrelated channels.

6. Advertising, Do Not Track and Global Privacy Control

The public Website code does not use personal information for targeted advertising or implement advertising-data sale or sharing. It does not track browsing across unrelated websites for advertising. A Do Not Track or Global Privacy Control signal does not disable essential session, access or abuse-prevention processing; there is no advertising-tracking feature here to switch off. This statement does not describe the independent practices of external services you choose to visit.

7. Adults 21+; children’s privacy

Winnary is intended only for people aged 21 and over and is not directed to children. We do not knowingly seek personal information from children under 13. Information identified as unlawfully collected from a child must be handled and deleted as required by applicable law. Do not submit a child’s personal information through the Website.

8. Security and international access

The Website uses HTTPS and server-side access controls. No internet transmission or storage system can be guaranteed completely secure. Providers may process information in locations outside your state or country, with different privacy laws.

9. Policy updates

The last-updated date below identifies this version. Material changes will be highlighted on the Website, and additional notice or consent will be provided where required. We will not apply a materially different use of previously collected information without the notice or consent required by law.