Privacy

1. Controller

The operator named in the imprint is responsible for the processing of personal data on winku.de.

2. Visiting the website

When you visit the site, technically necessary server logs are stored (IP address, time, page requested, amount of data transferred, browser identification). They serve the operation and security of the site and are deleted after a short period. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We do not use tracking cookies or advertising networks.

3. Cookies

We only use technically necessary cookies: a session cookie after you sign in, a cookie for the language you selected and — if someone bypasses maintenance mode using a key — a cookie for that exemption. No consent is required for these.
So that you do not have to enter your credentials again on every visit, we also set a cookie after sign-in that keeps you signed in. It contains a random identifier, no password and no details about you; only a non-reversible check value of it is stored on our server. The identifier is renewed on every use, so an intercepted older value no longer works. It expires after 180 days without use and becomes invalid immediately when you sign out, change your password or delete your account. If you do not want this, sign out after your visit.
A complete list of all cookies with purpose and duration is available at winku.de/cookies.

4. User account

For an account we store your email address, chosen name, password (only as a non-reversible hash), the time of registration and of the last sign-in, and the update channel you selected. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR). If the account is deleted, we delete this data and the content associated with it.
A single sign-in applies to all Winku programs on the same device: the session token is stored locally on your device so that you do not have to sign in to each program separately. This means that any Winku program on that device can act on behalf of your account. The token does not leave your device; signing out removes it everywhere.

5. Settings stored with your account

On request, the programs store their settings with your account so that they are the same on several devices. Only settings of the respective program are stored — for example volume and export defaults, keyboard shortcuts, templates for chat messages, the appearance of overlays and moderation rules. Details about other people do not belong there: lists that may contain third-party names — such as block lists used for moderation — are not synchronised with your account. They stay on the device and never reach our server, neither in plain text nor in encrypted or converted form. Anyone who wants to move such a list to another device can export it in the respective program and import it there. The legal basis is Art. 6(1)(b) GDPR. The settings are deleted along with the account.

6. Reviews and profile pictures

Reviews are published with your chosen name and are checked before publication. Profile pictures are also checked and only shown publicly afterwards; before approval only the person who uploaded them can see them. The legal basis is Art. 6(1)(b) GDPR. Both can be deleted from your account at any time.

7. Shared files

Files uploaded through the share function are stored for as long as the link is valid (currently three days) and can be accessed publicly via that link. They are deleted afterwards. You are responsible for the content you upload there; do not upload third-party works to which you hold no rights. You can revoke this at any time by deleting them in your account.

8. Support requests

When you send a support request we store the details you provide and the message history in order to handle the request (Art. 6(1)(b) and (f) GDPR). We delete them once they are no longer needed.

9. Program updates

The programs retrieve update information from winku.de on their own and download installation files. This produces the same server log data on our side as visiting the website. No user account is required for this.

10. Error reports from the programs

If an installation or update fails, the programs transmit a technical error report: the program affected, version, the step being performed, the type of error, a short technical message and the operating system designation. The programs sanitise the message beforehand; file paths, user names and credentials are replaced. No connection to an identified person is intended. This report is sent automatically, without any action on your part, and only when an error occurs; at most one report is created per error. The sole purpose is fixing the error (Art. 6(1)(f) GDPR).

11. Usage figures from the programs

Some programs transmit usage figures to winku.de so that the evaluation is also visible in your account on the website. Only figures are transmitted and — where the purpose requires it — music data such as title and artist. The following are expressly NOT transmitted: names or identifiers of viewers, third-party profile pictures, chat content, credentials and identifiers of third-party services. The server rejects submissions containing such fields.
The figures are associated with your account so that they can be displayed there; the legal basis is the performance of this function (Art. 6(1)(b) GDPR). Since this transmission is part of using the service, there is no separate opt-out for it. This does not affect your right to delete your account — which also deletes the stored figures — or your statutory data subject rights under section 15.

12. Anonymous usage statistics from the programs

The programs additionally report anonymous figures to winku.de automatically, without any action on your part, so that we can see how many installations are running on which version, how reliably updates complete and which programs are being used. Only the following are transmitted: program name, version, update channel, type of operating system (Windows, macOS, Linux), processor type, language code, the event (start, installation, update succeeded, update failed, uninstall) and plain counts that the respective program keeps.
So that an installation is not counted more than once per day, the program generates a random identifier once. This identifier is not stored on the server: together with the program name, the date and a secret known only to us it is turned into a daily hash. On the following day the same identifier produces a different value. An installation can therefore neither be tracked across several days nor be linked to a person. The daily hashes are deleted after 40 days; only daily totals remain. No IP addresses are stored in this process.
In addition, we condense the requests for update files from the server logs into daily totals (program, version, type of file, origin of the request). Here, too, no IP address is stored.
The legal basis is our legitimate interest in maintaining the programs, detecting faulty deliveries and aligning further development with actual usage (Art. 6(1)(f) GDPR). Since this data cannot be attributed to any person, there is no separate opt-out for it; no connection to an identified person arises. Not to be confused with section 10: the figures described there belong to your account, the ones described here do not.

13. Streamer mode

Streamer mode hides personal details in the programs while you are streaming. It works entirely on your device: the live state is detected locally and stored in a file in your user folder. Nothing is transmitted to winku.de in the process. The placeholder details (name, address, picture) shown instead are retrieved from winku.de without any connection to a person.

14. Third-party services

Some programs connect to third-party services at your request. These connections are made directly between your device and the respective provider; in doing so your IP address is transmitted to that provider. The credentials for them remain encrypted on your device and are not transmitted to winku.de. The privacy notices of those providers apply in addition.
In detail:
- Twitch: sign-in of the streamer, reading chat and channel point redemptions, retrieving display names and profile pictures of the viewers involved, writing replies into your own chat. This information stays on the streamer's device and is not transmitted to winku.de.
- Spotify: search, queue and playback control as well as the account name and profile picture of the signed-in account.
- YouTube and Google: only if you explicitly enter an address from which something is to be loaded.
- OpenAI and Hugging Face: one-off retrieval of the models for local speech and speaker recognition on first start. The processing itself then runs entirely on your device; audio and video content is not transmitted.
- Microsoft and python.org: retrieval of required additional programs during setup.
- OBS: exclusively locally on your device (127.0.0.1); no data leaves the device in the process.
On the website we do not embed any third-party content that sends data to external servers; the fonts we use are hosted on our own server.

15. Your rights

You have the right to information, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. A message through the support form or to the address in the imprint is sufficient for any request.

16. Retention

We store personal data only for as long as it is required for the respective purpose or for as long as statutory retention obligations apply. Account data and the content associated with it are removed when the account is deleted.

← Back