Short version: your private content stays private. This website uses limited first-party aggregate measurement for visits, approved campaign categories and download actions. It does not use an analytics cookie or device identifier. The WinTinyBar desktop app sends product metrics only if you switch them on yourself, in the app's My interests & privacy settings. Until you do — and in any build with no such switch — it sends nothing at all. Switching it off again deletes the counters and the queue held on your PC. Community research is absent entirely. The other optional connected features described below are staged, disabled, and will not be enabled without their own in-app explanation and choice. Accepting the Terms is not consent to either one.
WinTinyBar is made by Uppercut Studio Ltda, an independent software studio registered in Brazil under CNPJ 44.993.043/0001-90, at R. Benedito Alvarenga Carvalho 91, São José dos Campos, SP, 12246-120, Brazil. It is the data controller for the services described here. For anything about this policy or your data, write to wintinybar@uppercut.studio; the team reviews requests and responds as capacity and applicable deadlines require.
That address is the official communication channel for data-protection requests under the Brazilian LGPD (Lei 13.709/2018) and, where it applies, the GDPR. Every request is acknowledged on receipt.
The page sends one first-party site_visit event with an approved
referral-campaign category and a two-letter region inferred from the browser language
(or ZZ). The separate download redirect counts a redirect/click and a
coarse country inferred from trusted hosting headers when available, otherwise from
Accept-Language. A click count cannot prove that the browser completed the
download or that WinTinyBar was installed. Unknown campaign text is reduced to
unknown; it is not stored as a free-form analytics value. We do not use an
analytics cookie, fingerprinting or a device ID, and we do not sell these counts.
Support messages stay outside these aggregate metrics.
If you submit the optional support form, we store the fields you provide—report type, impact, title, description, app version, Windows version, and optional name/e-mail—plus fixed routing and audit metadata such as consent/submission/update times, workflow status, spam flag and, after review, reviewer/time. The form does not automatically attach notes, dictation, files, logs, clipboard data, or a device identifier. The report is stored in restricted Google Firestore and, for non-spam notifications and replies, processed through Google Workspace/Gmail. Ordinary request metadata may appear in provider infrastructure logs; a configured Google reCAPTCHA anti-abuse check may also process browser/network signals. Only authorized staff can triage reports. You may request correction, export, or deletion at wintinybar@uppercut.studio.
WinTinyBar keeps settings, sticky notes, sketches and diagnostic logs as local files
under %LOCALAPPDATA%\WinTinyBar
(that is C:\Users\<you>\AppData\Local\WinTinyBar). Downloaded voice models
live in %LOCALAPPDATA%\WinTinyBar\ai\models. Notes and ordinary settings can
be readable local files. Manual interests and potentially sensitive data created by
the legacy optional Break Room tool
(height, weight, pregnancy/lactation choices, hydration goal/history and break history)
live in separate current-user DPAPI vaults. They fail closed rather than falling back
to plaintext. The Persona/personal-dictionary vault is staged local infrastructure and
is not yet connected to ordinary app use.
Interests use fixed IDs that you choose and can edit or delete. A future suggestion may retain only bounded metadata such as the fixed tag, state, strength, a capped session count and first/last calendar day. It does not retain the phrase, audio, selected text, translation, keyword, embedding or document that led to the suggestion. These vaults have no network or telemetry integration. Deleting the WinTinyBar local-data folder removes local data, models and caches, but it cannot erase a support message you sent, a payment record, ordinary infrastructure logs, or an aggregate report already accepted after a separate choice.
The current app requests public resources only when the related tool is used. The request itself still exposes ordinary connection metadata—such as IP address, time, user agent and requested path—to the provider carrying it. Private work is not added to these requests:
USD-BRL).Manual interests are local. A future Learn from translations switch may run a signed classifier on a successful translation on this PC. Sensitive, uncertain or low-confidence material produces no suggestion. A suggested fixed tag does not become durable until you approve it; the observation itself is discarded.
Fresh Picks will request one common, bounded, signed multilingual catalog from a fixed WinTinyBar URL. Every installation receives the same catalog; the request has no interest, locale, account, cookie, installation ID or content ID. This PC performs the ranking. Opening a result visits the named publisher in your browser, so that publisher then receives normal web-connection metadata and applies its own policy. WinTinyBar does not send a click beacon, tag or “more like this” action.
Product metrics exist in this build as a choice of their own, and that choice ships switched off. Nothing is counted and nothing is sent until you turn them on in the app's My interests & privacy settings, and the app re-checks that stored consent against the payload schema on every start, so a hand-edited settings file cannot open the transport on its own. What can travel is a closed vocabulary of small counters — a tool starting, completing or failing — plus the app version and whether this is Windows 10 or 11. No text, audio, interest, wellness value, clipboard, file name, window title or free-form error is accepted: the schema 2 payload has no account, installation/device ID, persistent UUID, exact timestamp, text or topic field that could carry them. Each encrypted retry batch receives a different random one-use receipt, reused only while that exact immutable batch is retried and erased locally after acceptance, so two sends from the same PC cannot be tied to each other.
Your IP address is the one thing that list does not cover, and you
should hear it from us rather than work it out. The app posts the batch straight to
uppercut.studio, so — exactly as on any other web request —
the receiving server sees your IP address and the time of the send. That rides in the
transport, not in the report, which is why the sentence above does not reach it. We are not telling you that
address is discarded: that would be a claim about the receiver, and we do not publish
claims we have not verified.
Turning the choice off stops sends not yet issued and erases the local encrypted queue without waiting for the network. At most one batch already claimed by the background sender may finish in flight; it cannot recreate the deleted queue or start another batch. Because there is no account, install ID or device ID, there is nothing on the server to look up and erase afterwards — what can be erased is the copy on your PC, and switching the setting off erases it.
Community research, if launched, will have its own choice, endpoint, collection, access policy and dashboard. While its local state remains intact, the PC attempts at most one contribution per 30-day period. It may map an approved non-sensitive tag into one of five broad categories and randomize that category locally with an epsilon-1 randomized-response mechanism. The report body contains the schema, mechanism, epsilon, randomized category and a random one-use anti-replay receipt. It has no local tag, phrase, audio, translation, dictionary, language, country, app version, persistent device/install ID or account. Deleting local state or reinstalling can reset the local period guard; launch therefore also requires the receiver to consume each receipt once and discard it under a published fixed limit. We describe this accurately as a locally randomized report body without a persistent user identifier, not a guarantee that the network connection is anonymous. Firebase/Google still processes ordinary request metadata. Refusing research does not change tools, local learning or Fresh Picks.
| Plane | Data and purpose | Destination / retention | Your control |
|---|---|---|---|
| Persona & interests | Staged languages/style/dictionary and current approved fixed tags for local assistance | DPAPI-protected on this PC until you delete them; Persona runtime integration is not yet active | Edit or delete manual tags; the staged Persona vault supports an explicit user-chosen local export before runtime integration; no research choice required |
| Legacy optional wellness data | Water-planning inputs and local daily water/break history | Separate DPAPI-protected vault on this PC until you reset or delete it; not imported by telemetry | Edit/reset in the app or delete local data |
| Common catalog | No profile payload; fetches the same signed catalog for fresh information | Not requested by 1.16.0-beta. Before launch: public Uppercut/Firebase delivery, a signed local-cache expiry and a configured, published infrastructure-log limit | Feature off/on and clear cache; ranking stays local |
| Product metrics | Fixed operational counters for reliability and roadmap allocation | Off until you switch it on. Sent to the WinTinyBar
endpoint on uppercut.studio, which — like any web server — sees the IP address
and time of the request itself. Published retention,
which this row previously required before launch: your PC retries an unsent batch for at
most 14 days and discards the queue after 21; the server
keeps a receipt for 45 days only to recognise a retry, and daily totals
for 400. No detailed all-time event rows. There is no account, install ID
or device ID, so nothing on the server can be traced back to you and erased on request —
switching the setting off erases everything erasable, which is the copy on your PC |
Separate opt-in, exact payload view, turn off and forget local queue |
| Community research | One locally randomized broad category to estimate population-level priorities | Not collected by 1.16.0-beta. Launch requires a separate collection, one-use receipt handling and a configured, published fixed retention limit | Separate opt-in, no effect on benefit, turn off and forget local marker |
| Website | Site visit and download-redirect click are separate counts; approved campaign bucket plus language-region/coarse-country for aggregate reach. They are not install counts | Uppercut/Firebase daily aggregates and ordinary provider logs. A fixed deletion schedule has not yet been configured and published; we do not claim a 13-month/30-day limit until it is | No analytics cookie or device ID; browser/network controls still apply |
| Support / commerce | Submitted fields, fixed workflow/audit metadata, replies, purchases and refunds | Restricted Google Firestore/Workspace and payment systems. Until a fixed support schedule is adopted, records are kept for triage/reply and applicable operational or legal needs | Access, correction and deletion request, subject to mandatory recordkeeping |
Uppercut Studio operates the WinTinyBar services described here. Firebase, Google Cloud and Google Workspace act as infrastructure providers and may process connection metadata and stored service data in facilities outside Brazil. We use the providers' available encryption and access-control features. Encryption does not make request metadata disappear or replace LGPD duties. Product metrics travel over that infrastructure only after you switch them on, and its request metadata — your IP address and the time — is processed there like any other web request. Community research and the common catalog remain off until their purpose-separated access, fixed retention and the applicable international-transfer mechanism/provider terms are documented and configured.
If you e-mail us — to get the app, ask for support, or request a refund — we see your e-mail address and use it only to reply and deliver what you asked for. The same applies when you voluntarily include an e-mail address in the support form. No newsletters unless you explicitly ask for one. We do not sell addresses; we disclose them only to providers needed to deliver support/commerce or when law requires it.
Your private work remains on your disk. For personal information we do hold, such as support messages or purchase records, applicable law may let you request confirmation and access; correction; anonymization, restriction/blocking or deletion; information about sharing; portability where applicable; objection to certain processing; and withdrawal of consent without affecting processing already lawfully performed. Where applicable, you may also request review of a decision based solely on automated processing and complain to Brazil's ANPD or another competent supervisory authority. Some requests are subject to identity checks, legal exceptions and mandatory recordkeeping; if we cannot fulfill one, we will explain why. Write to wintinybar@uppercut.studio.
WinTinyBar is a general-purpose tool that may be used by children and adolescents. Connected profiling and community research remain unavailable to users we know are minors; an initial community-research launch is adults-only. Before any child/teen mode or child-directed connected feature, we must complete an age-appropriate risk review and implement the most protective settings and safeguards required by applicable law. A minor's local profile may not select advertising or paid offers. A parent, guardian or young person may contact us about access, correction or deletion.
A material change in taxonomy, purpose, report frequency, privacy budget or payload requires a new explanation and, where consent is the basis, a new choice. Staged features remain off until the matching app UI, server contract, retention controls and public copy ship together.
← back · Help & FAQ · Terms · EULA