What we collect, and what we don't.

Last updated 10 October 2026

This policy covers winnowcards.com. It's written to be read, not to be impressive. If anything here is unclear, email and ask.

Who runs this site

Winnow is operated by Winnow Cards, a sole proprietorship based in California, United States. For anything in this policy, including a request to delete your data, write to zoe@helmcrest.co.

Your sort stays on your device

When you sort the deck, your choices are saved in your own browser using local storage, under a key named winnow.v2. Local storage is not a cookie. It is never transmitted anywhere. It exists so you can close the tab halfway through and pick up where you left off.

Nobody at Winnow can see it. There is no database of sorts, no admin screen, and no lookup. If you clear your browser data, or press Sort again, it's gone and we cannot recover it for you.

Share links

When you copy a share link, your results are encoded into the part of the web address that comes after the # symbol. Browsers never send that part to a server. It travels only inside the link itself.

That has one practical consequence worth knowing: anyone you send that link to can see those results, and so can anyone they forward it to. Treat a share link the way you'd treat a screenshot.

What we collect, and only when you choose to give it

There are exactly two forms on this site. Both are optional. If you never fill one in, we never receive anything about you beyond the anonymous counts described further down.

If you ask us to email your results

If you request the team kit

That's the whole list. We don't ask for your name, your employer, your phone number or your address, and there's nowhere on this site to give them to us.

Counting visits

We'd like to know roughly how many people use this and which pages they land on. Both tools we use for that are privacy-preserving by design.

Cloudflare Web Analytics records page views, the site that referred you, your country, and your general device type. It sets no cookies and does not fingerprint your browser or device. It cannot build a profile of you and cannot follow you to other websites.

Netlify hosts this site. Like every web server, theirs records requests as they arrive, which includes your IP address, the page requested, and your browser's user-agent string. That's used for aggregate visitor counts, for keeping the site up, and for blocking abuse. We see these only as totals.

Cookies

This site sets none. Not for analytics, not for advertising, not for preferences. That isn't an oversight, it's the reason you weren't greeted by a banner asking you to accept things. We'd rather not collect what we don't need.

There are no advertising networks, tracking pixels, social media widgets, session recorders or heatmaps on this site.

Who else can see your information

Two companies process data on our behalf, and only to provide the service:

• Netlify hosts the site and receives form submissions. Their privacy policy.
• Cloudflare provides the analytics described above. Their privacy policy.

Beyond those, nobody. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not hand it to data brokers, advertisers or anyone else. We never have, and the business doesn't make money that way.

The one exception anyone has to list: if we're required to disclose something by law, a court order or valid legal process, we will. Given how little we hold, there's very little to disclose.

How long we keep things

• Your email address and the results you sent us are kept while you're on the list, and deleted when you unsubscribe or ask us to delete them.
• Server and analytics records are kept on Netlify's and Cloudflare's own retention schedules, which are short, and are held in aggregate rather than against you.
• Your sort we never had, so there's nothing to keep.

Your rights over your data

Wherever you live, you can email zoe@helmcrest.co and ask us to show you everything we hold about you, correct it, or delete it. We'll do it within 30 days and we won't charge you or ask why. Because we hold so little, these requests are usually answered the same week.

If you're in California

Under the California Consumer Privacy Act as amended, you have the right to know what personal information is collected and why, to request its deletion or correction, to request a copy, to opt out of its sale or sharing, and to not be treated differently for exercising any of those rights. We don't sell or share personal information, so there is nothing to opt out of. We don't use it for automated decisions or profiling either.

Winnow is a very small business and falls below the revenue and volume thresholds at which that law applies. We honour these requests regardless.

If you're in the UK, the EU, or the EEA

You have the right to access your data, correct it, have it erased, restrict or object to how it's used, receive a portable copy, and withdraw consent at any time. Our lawful bases are consent, for anything you typed into a form and for the emails you asked for, and legitimate interests, for the server records that keep the site secure and tell us how many people visited.

Withdrawing consent is as simple as clicking unsubscribe. If you think we've handled your data badly, you can complain to your national data protection authority, though we'd appreciate the chance to fix it first.

Email we send you

Only what you ticked a box for. Every email we send has a working unsubscribe link, and unsubscribing takes effect immediately. We don't rent, sell or lend the list, and we don't send anything on behalf of anyone else.

This site is for adults

Winnow is for people aged 18 and over. We don't knowingly collect anything from children. If you believe a child has sent us their email address, write to us and we'll delete it.

Keeping it safe

The site is served over HTTPS everywhere. There are no accounts and no passwords, so there are no credentials for anyone to steal. Form submissions sit in Netlify's systems behind two-factor authentication. The best protection, honestly, is that we hold almost nothing worth taking.

No service can promise perfect security, and we won't pretend otherwise. If something ever did go wrong in a way that affected you, we'd tell you promptly and directly.

Changes to this policy

If this changes, the date at the top changes with it. For anything that meaningfully affects what we collect or how we use it, we'll say so on the site, and by email to anyone on the list.

Governing law

This policy, and anything arising out of it, is governed by the laws of the State of California, United States. Disputes are handled as set out in section 16 of the terms of use, which asks both of us to try to resolve things by email first. If you're a consumer outside the United States, your own country's data protection and consumer law still gives you rights this policy can't take away.