Privacy Policy

PRIVACY POLICY — Wingmail

Last updated: 27 August 2026

Wingmail is a slow-letters app. You choose a mark (a username), you choose a

place to receive letters at, and letters you send take hours to arrive —

carried, in the fiction, by a pigeon across a map.

This policy describes exactly what the app stores, who can see it, and what

we do not do. It describes the app as it actually behaves; where something is

less private than you might assume, it says so plainly.

Contact for any question in this policy:  kumarvikas06182@gmail.com

1. WHO IS RESPONSIBLE

Wingmail is operated by the developer of the app, reachable at

kumarvikas06182@gmail.com. Data is stored using Google Firebase

(Authentication and Cloud Firestore).

2. WHAT WINGMAIL COLLECTS

2.1 Your account

You sign in with Google. From that sign-in Wingmail receives and stores:

- A user ID, so the app knows which letters and settings are yours.

- Your display name, shown on letters and on your profile.

- Your Google profile picture (the link to it), shown on your profile, on

  letters and on the map.

- Your email address, used only to identify your account at sign-in.

Your email address is not copied into the app's own database and is never

shown to other users. It is held by Firebase Authentication as part of the

sign-in itself.

2.2 Your mark (username)

The mark you choose is stored and is permanent. It cannot be changed or

released. This is deliberate: if a mark could be given up, a stranger could

later take it and inherit every QR code and link that ever pointed at you.

2.3 Your place

You choose the place your letters are flown to by searching for it and

picking a result. Wingmail stores:

- the name of that place (for example, "Agra, Uttar Pradesh, India"), and

- its coordinates (latitude and longitude).

Coordinates are needed to draw the flight on a map and to work out how long a

letter takes to arrive.

Please read this part carefully. The app only ever displays the name of your

place — never a pin, never the numbers. But the directory of users is

readable by any signed-in Wingmail account, so the coordinates stored on your

profile are technically reachable by another user who queries the database

directly. Choose a place you are content to make public — a neighbourhood, a

town, or a city — rather than your exact home address.

You may change your place at any time from Profile, then "Your loft", then

"Move my loft".

If you tap "Use where I am now", the app reads your device's location once,

turns it into a place name, and stores the result. Wingmail does not track

your location, does not read it in the background, and does not keep any

location history. You can refuse the permission and search for your place

instead; everything still works.

2.4 Your letters

For each letter, Wingmail stores two things:

1. The envelope — who sent it, who it is for, both marks and display names,

   both place names and coordinates, when it left, how long the flight takes,

   when it arrives, and its status. Both people can read this.

2. The words — stored separately from the envelope.

The words of a letter are unreadable to the recipient until it lands. This is

enforced on the server, not merely hidden in the app: the database refuses to

hand over the text until the arrival time has passed, checked against the

server's clock. The sender can always re-read their own letter.

A sent letter cannot be edited, unsent or deleted by anyone, including the

person who wrote it. This is intentional and is what the app means by sending

a letter.

The sender is told when the recipient breaks the seal, and when.

2.5 Who you write to

Wingmail stores the standing between you and each person you correspond with

(requested, accepted, turned away, or blocked), and the private list of

people you have kept in your book. Your book is private to you and cannot be

read by anyone else.

2.6 On your device

Letters you have sent or received are also cached on your phone so the app

works without a signal. This cache is kept separately for each account signed

in on the device, and is cleared when you sign out.

3. WHAT WINGMAIL DOES NOT DO

- No advertising. There are no ads and no advertising identifiers.

- No analytics or tracking. The app contains no analytics, no crash

  reporting and no tracking SDKs of any kind.

- No selling or sharing of your data. Your information is never sold,

  rented, or handed to data brokers.

- No reading of your contacts, photos (beyond a single picture you choose to

  scan), microphone, or files.

- No background location.

4. OTHER SERVICES THE APP TALKS TO

- Google Firebase (Authentication, Cloud Firestore) — receives your account

  and everything in section 2, for sign-in and storage.

- Google Sign-In — receives your sign-in, to identify you.

- OpenStreetMap Nominatim — receives the place text you type while searching,

  and a coordinate when you use "Use where I am now", to find real places and

  their coordinates.

- OpenStreetMap tiles — receives which parts of the map your app is drawing,

  to provide the map imagery.

- Esri, Maxar and Earthstar Geographics — the same, if you choose the

  satellite map style.

These services receive your device's IP address as part of any ordinary

internet request. Wingmail does not send them your name, your mark, or the

contents of your letters.

5. PERMISSIONS THE APP ASKS FOR

- Location (optional) — only when you tap "Use where I am now", to pre-fill

  your place. Refusing it costs you nothing; search instead.

- Camera (optional) — only to scan someone's QR mark. No image is stored or

  uploaded.

- Photos (optional) — only when you choose a picture to scan a mark from. The

  picture is read on your device and is not uploaded.

- Notifications (optional) — to tell you when a letter of yours is due to

  arrive. These are scheduled on your own device.

6. HOW LONG THINGS ARE KEPT

Your profile, your letters and your connections are kept until your account

is deleted. See the separate Account Deletion page for what deletion removes

and what necessarily remains.

7. CHILDREN

Wingmail is not directed at children under 13, and accounts should not be

created by them.

8. YOUR RIGHTS

You may ask, at kumarvikas06182@gmail.com, to:

- see a copy of the data held about you,

- correct your display name, place or picture (most of this you can change in

  the app yourself),

- delete your account (see the Account Deletion page).

9. SECURITY, HONESTLY STATED

Access to letters is controlled by server-side security rules, which are

tested. Those rules enforce that only the two people involved can read a

letter's envelope, that its words stay sealed until arrival, that a letter

cannot be altered after sending, and that your book of saved people is

private to you.

Letters are not end-to-end encrypted. They are protected in transit and at

rest by Google Firebase, and by the access rules above, but the operator of

the service has the technical ability to read stored data. Please do not send

anything through Wingmail that you would not be willing to entrust to an

ordinary email provider.

10. CHANGES TO THIS POLICY

If this policy changes, the date at the top will change with it. Material

changes will be announced in the app.

11. CONTACT

kumarvikas06182@gmail.com