Talewind privacy notice

1. Who we are

We're Wunsupona, LLC ("Once Upon a"), a wellbeing company. Talewind is our app. Your employer pays us so you can use it: Health Quests, live and on-demand classes, Connections talks, the Library, the Campfire, challenges, and our visits to your office.

In this notice, "we" and "us" mean Wunsupona, "your employer" means the company that gave you access, and "the app" means Talewind on the web, on your phone's home screen, and in the App Store and Google Play once it is there.

We wrote this in plain words on purpose. If anything is unclear, write to us (section 19) and we'll explain.

2. The short version

• We don't show your individual stuff to HR unless it's something you've allowed them to see. Your employer sees group totals, never who.
• Any number your employer sees is made from at least 5 people. Below that, it says "Not enough participants yet." There's one small exception for program requests, in section 5.
• We don't collect medical information: no diagnoses, no medications, no lab results, nothing from your health plan.
• Health and wellbeing questions are always optional, and nothing you can win ever depends on what you answer.
• We don't sell your information, we don't share it for advertising, and we don't show you ads.

3. Where this notice applies

This notice covers the app and what we do with what you tell us in it. It doesn't cover your employer's own systems, and it doesn't cover the outside services in section 10 when you use them directly under their own terms (for example, picking your gift card on Tremendous's site, or a Zoom call).

4. What we collect

We sort what we hold into three kinds. Each kind has its own rule about who can see it.

4a. Taking part (your employer sees counts only)

• Your account: your name, the email you joined with (work or personal), your company, your role, and, if your company gives us a staff list, the line on that list you were matched to (your work email or employee ID).
• Your public name for the app, and your picture if you add one.
• What you join and attend: Quests, challenges, live classes, Connections talks, company sessions and on-site visits.
• Your points, stars, levels, awards and any prizes you win.

4b. What you do in the app (your employer sees group numbers only, from 5 people)

• Your Quest check-ins (whether you did your habit that day) and your habit in your own words.
• What you watch, save and open in the Library, and simple records of using the app: when you open it, which pages you visit, which videos you finish.
• Your posts, comments and cheers, and questions you send ahead to a talk or session.
• Messages between you and your coach (Message Coach).
• Your age band, if you give it at sign-up ("How old are you, roughly?"). It's optional. We store the middle of the band, not your age or birth year. Age isn't health information, but it is protected, so your employer never sees it against your name.
• Your birthday (month and day only), if you choose to give it, so we can wish you a happy birthday.
• Your time zone, your settings, your notification choices, and the private name you can give yourself for your Home greeting, which only you see.
• Numbers from your phone or watch, only if you connect it (section 4e).
• For a prize or a free box that ships: the address and the name for the package, kept apart from everything else (section 10).

4c. Health and wellbeing answers (nobody sees them person by person)

• Your answers to a Quest's before and after survey. The questions are about your habit only: how often you did it and how automatic it feels.

The database lets only you read your own answers, and that includes our own team. Your employer sees totals only, and only when at least 5 people answered that question. Every question has "Prefer not to say", and one tap sets it for every question. Our wellness program notice says more, and you can ask us for it any time.

4d. What we never collect

No diagnoses, medications, lab values or anything from a health plan. We don't ask about your family's medical history. We don't collect your location or your contacts. We don't take payment details, and there are no passwords. Nothing from your phone or watch unless you connect it.

4e. Your phone or watch (device sync)

Connecting works only in the Talewind phone app. In a plain browser the screen says so, and you type numbers in.

Only if you say yes. Connecting your phone or watch is its own choice, separate from our terms, made on its own screen. Nothing is read until you pick what to share and tick "Yes, share these daily totals with Wunsupona". Your phone then asks you as well.

What we read, and nothing else. Daily totals only, of the ones you pick: steps, active minutes (workout minutes on Android phones), sleep, workouts (how many and how long), mindful minutes and water. Never your heart rate, location, medical records or any other health data, and never the readings behind a total. Nothing from before the day you connected. Your phone reads them from Apple Health on an iPhone or Health Connect on Android, which is how a Fitbit, Garmin, Samsung, Oura or Apple Watch reaches us.

Why. To show you your own day, and to fill in challenges that count from a phone or watch, so you don't have to type the number in. Typing it in always works too. In a challenge with a daily goal, "I moved my way today" counts the day for anyone, with the same points, so nobody has to reach a number to take part.

Who sees it. Only you see your own numbers. Your employer never sees your numbers, only group totals from 5 or more people, with no names, like "142 people logged 1.2M steps this week", and no other way to trace them to a person. Coaches and Wunsupona staff don't see your numbers either. We never sell them, never share them with anyone, and never use them for advertising.

Who stores it for us. Supabase (our database) and Vercel (our servers) store and carry it for us, encrypted, and may not use it for anything else. Our server seals each day's numbers with its own key before they're stored. No one else receives it.

How long we keep it. A challenge's numbers are deleted 30 days after the challenge ends. Any other day is deleted after 30 days. Both limits are settings, and the connect screen always shows the current ones. Copies in our backups are overwritten within 7 days.

Your choices. In Settings, under Your phone or watch, you can see every number we've stored, change what you share, and disconnect. Disconnecting deletes all of it straight away. Deleting your account (on the day you ask, not 30 days later), or leaving your employer (on the day your access ends), deletes it too. If your employer's contract with us ends, we delete everything from phones and watches for that company, group totals included.

If something goes wrong. If your numbers were ever reached by someone who shouldn't have them, we'd tell you, and the Federal Trade Commission, as the law requires.

5. What your employer sees

We don't show your individual stuff to HR unless it's something you've allowed them to see. Your employer's HR team has a dashboard. Here is everything on it, in plain words.

• Counts, never names. How many people joined, took part this month, or signed up for a Quest, a talk or a visit. Never who.
• Nothing under 5. Any number made from fewer than 5 people is hidden and shows "Not enough participants yet". That holds for every filter HR can pick (department, location, week, program). HR picks whole months or quarters only, so two reports can't be compared to find one person. Numbers refresh once a day, at 6:00A Eastern, so nobody can be spotted signing up.
• Not even who has joined. HR sees how many people have registered, never which people on their list, and never your email or chosen name against anything you do.
• Your answers and check-ins stay with you. HR never sees anyone's check-ins, survey answers, posts, comments, messages, phone or watch numbers, or age. Survey totals reach HR only when 5 or more people answered.
• One exception, for requests. If you ask for a program your company hasn't bought, HR's "Your team is asking" card can show that it has been asked for, from the first ask, with no number, no name and no date. Numbers appear only from 5.
• A post reaches HR only if you choose. On some Quest and challenge posts you can switch on "Can we brag about you to HR? (no name)". HR then sees that post's words, the day and any photo you chose to send, without your name or picture. If you add a photo, we warn you first that a photo you can be recognized in might tell HR who you are.
• Prizes reach you without HR learning who won, including prizes your employer paid for.
• What you post where coworkers can see it. The Campfire, a Quest room and a challenge board are shared spaces, and people from your company may be in them, HR staff included, as members. What you post there shows your public name (or no name, if you choose "Someone"). That's sharing with other people, not a report to HR.

6. What coaches and the Wunsupona team see

Coaches lead classes, talks and Quests for us.

• A coach sees posts on the boards they look after and on the Campfire, under the poster's public name, unless it was posted with no name (section 7).
• In a Health Quest, the Quest's coach sees who checked in, by the name you use in that Quest, so they can cheer you on; your employer never does. A check-in is just "did it" or not.
• A coach sees your messages to them, questions sent ahead to their session (without names), requests from your tribe, and attendance at their own sessions.
• If something you post sounds like a crisis, the post is also marked in the coaches' inbox, with no alert to anyone (section 7).

The Wunsupona team runs the service. They can look up one person to help with access, two-step sign-in or a deletion, and they see participation by account where running the service needs it (for example, sending a prize). Every look-up and change they make goes in an audit log nobody can edit. They can't browse health and wellbeing answers by person, or anyone's phone or watch numbers.

7. The Campfire, Quest rooms and posting with no name

• The Campfire is shared by people from every company that uses Talewind, not just yours. Posts show your public name and picture. Showing your company's name is your choice: "Show my company name at the Campfire" in Settings, off until you switch it on.
• Quest rooms and challenge boards are shared with the people in that Quest or challenge.
• Posting with no name. Any Campfire post or reply can be made as "Someone at the campfire", and any Quest post or reply as "Someone on the Quest". Then no name shows to anyone: not other members, not coaches, not our team. We still store who wrote it, so the house rules can be kept: if a post with no name is reported, our team can end that writer's access without seeing who they are. We would reveal a writer only if the law required it.
• Your private name is never shown to anyone else.
• Crisis help. If you type something that sounds like a crisis, the app shows you free crisis lines straight away (988 in the US, 911 in an emergency). Your post still goes up. Posts and replies with those words are marked in the coaches' inbox, so a coach may see it the next time they look. It isn't an alert: nobody is phoned or emailed, nobody is watching in real time, and nothing reaches your employer. We are not an emergency service.
• Reporting. You can report a post. Reports go to our team, never to your employer.

8. Live sessions, recordings and Zoom

• Live classes, talks and Quest sessions run on Zoom accounts Wunsupona owns.
• What Zoom gets about you: the name you use for that session (your app name, or one you pick just for that talk or Quest) and a made-up address we create for your seat, on a Wunsupona web address that takes no mail. Zoom never gets your real email. That seat is how we know you attended.
• On a computer a session can open inside the app using Zoom's own web software; on a phone it opens the Zoom app. Either way, Zoom handles the call under its own privacy terms and sees what any video call sees, such as your device and network.
• Everyone joins muted, and your camera is up to you.
• Recordings. Every kind of session is recorded except Quest Q&As, and a coach can stop a recording, or start one in a Q&A. When a session is recorded, its page says so ("This class is recorded" or "This session is recorded"), and Zoom shows its own recording notice in the room. We aim to record the coach or speaker, not participants, but if you unmute or turn on your camera, you could be heard or seen. A recording goes into the Library and comes out after a week (classes, Quest sessions and Connections talks) or 30 days (a session your company bought), and is then deleted from our video service. A coach can keep a class recording longer.

9. Email, notifications and cookies

• We send email for sign-in codes, for things about your account (such as a deletion date), and for the reminders and news you choose in Settings. Every reminder and news email has a link to stop that kind of email. Emails come from "Talewind by Wunsupona".
• Notifications. If you allow them, your browser or phone gives us an address for your device. Messages travel through your browser maker's push service (Apple, Google, Mozilla or Microsoft). The words are encrypted on the way, so those services see only that a message was sent. Your phone may show the words on your lock screen; you choose that in your phone's settings.
• Signing out removes that device's notification address first, so a shared device doesn't get the last person's reminders.
• Cookies. The app uses only the cookies it needs to keep you signed in. No advertising or tracking cookies.

10. Outside services that handle your information

We use a small number of companies to run the app. Each handles only what its job needs, under a contract that doesn't let it use your information for anything else.

Gift cards. Gift cards from Wunsupona come through Tremendous, a gift card service. When you claim one, we send Tremendous your email address and the first name our emails greet you by (your private name, if you set one), and nothing else about you: not your company or anything you've done in the app. Tremendous uses them to deliver your gift card, and you pick your card on their site, under their own privacy policy. We keep a note of which gift card you were sent so you can open it again. Your employer never sees who claimed a gift card.

Shipping addresses are seen only by Wunsupona (Google suggests addresses as you type the street, and sees only that typed address, with nothing to say who you are), used for that one parcel, never sent to Zoom, never shown to your employer, and deleted once it's delivered, or 30 days after it's sent if nobody marks it delivered. A free box address is deleted 30 days after its session.

We don't sell your information, and we don't share it for advertising.

11. Coaches who connect a Google account

This section is for Wunsupona's coaches. It doesn't apply to employees, who never connect a Google account.

If you're a coach and choose Continue with Google or Connect my Google Calendar, you decide which Google account to use, and Google asks your permission first.

What we get from Google. Your name, email address and Google's lasting ID for your account, to sign you in. When your calendar is busy, but not what your events are. We don't read your events' titles, guests or notes.

What we do with it. We use your busy times so nobody can book you then. We add, change and remove the calendar entries for your own Wunsupona bookings. Those entries can hold the client's company name, session details and meeting links. We ask Google only for what these features need: your availability, and events on calendars you own.

How we keep it. Our server seals your Google token with its own key before storing it, and no browser can read it, our team's included. We keep your busy times, only the start and end of each, so the booking pages can show your open times.

Who sees it. Our team can see which calendar you connected and its email address, and when it was last checked. Clients see only your open times. We don't share your Google data with anyone else, except the services in section 10 that run the app for us, or if the law requires it.

What we never do. We don't sell your Google data, use it for advertising, use it to train AI, or use it for anything other than these features. Our team doesn't read it, unless you ask us to help, it's needed for security, or the law requires it.

Your choices. You can disconnect at any time in your coach area, under Booking hours, or remove our access in your Google account. Disconnecting deletes your token and busy times from Talewind. Entries already on your calendar stay until you delete them.

Our use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

12. How long we keep things

13. Leaving your employer, and deleting your account

These are two different things, and they do different things to what you wrote.

If you leave your employer, or they take you off their list, you keep the app until the end of that month. That's at a company that gives us a staff list. At a company where people join with their work email, your access ends when your employer tells us and our team ends it, or when you can no longer get a sign-in code at that email. After that you can't sign in. Your posts and comments stay where they are, shown as "Former member" instead of your name, so the conversations you were part of still make sense. 90 days later we clear your name, email, picture, birthday, age band and settings, along with your private name, shipping addresses, the names you used for Quests and talks, your notes to yourself, your messages with your coach and your prize wins. If you'd like that done sooner, write to us.

If you delete your account yourself, in Settings, you type "delete" to confirm and we sign you out on every device. Your account is deleted 30 days later, and we email you the date. Changed your mind? Sign in with a new code any time in those 30 days and it's cancelled, with everything just as you left it. While you wait, we send you nothing. After 30 days we delete your personal information: your name, your picture, your email, your posts, your comments and the rest. Your posts and comments are gone, not kept under "Former member", and replies under your posts go with them. We may keep information that has been de-identified, meaning it can no longer reasonably be linked to you, or combined with other people's, such as your company's past totals. Copies in our backups are overwritten within 7 days. Signed consents and your fitness waiver are kept as a record that you agreed.

If you're an HR admin or a coach, your account runs part of the service, so write to us and we'll delete it with you.

If your employer's program with us ends. From the day it ends, nobody earns points or stars, and the app opens only to your rewards, so you can claim anything you earned. You have 30 days (a setting), and we tell you the date once. A gift card you've already claimed stays yours. 30 days after that last claim day, we delete everything for your company: your account, what you wrote and did, and the company's own totals. We keep only our audit log, signed consents, and prize records with the company's name and no person on them.

In every case the numbers your employer already has stay the same. They were only ever counts, like how many people took part in a month, never who, and after you go they have nobody's name on them at all.

14. Taking back a consent

To withdraw a consent you gave, such as one you signed for an on-site visit, the fitness waiver, or your yes to share phone or watch numbers, write to us through Write to us in the app or at support@wunsupona.com, and we'll take it from there. For your phone or watch, you can also just disconnect in Settings, which deletes your numbers at once. Taking back a consent doesn't undo what was done before, and we keep the signed record as proof of what you agreed at the time.

15. Your choices and your rights

You can, at any time:

• See and change your name, picture, age band, birthday, private name and notification choices in Settings.
• See your phone or watch numbers, change what you share, or disconnect, in Settings.
• Ask for a copy of what we hold about you, by writing to us. There's no download button yet, so our team puts it together by hand, within 45 days.
• Ask us to correct something you can't change yourself.
• Delete your account in Settings, or ask us to clear your details sooner after you leave.
• Take back a consent (section 14).
• Stop emails and notifications in Settings, or from the link in any email.
• Skip any health or wellbeing question with "Prefer not to say".

State privacy laws. Some US states give people rights over their personal information, and some give extra rights for health data. We give these rights to everyone who uses the app, wherever you live. We won't treat you differently for using any of these rights.

To ask, write to support@wunsupona.com or use Write to us in the app. We may need to check it's really you, usually with a sign-in code sent to your email. If we say no, you can ask us to look again by replying to our answer.

16. How we protect your information

• Sign-in by a 6-digit code sent to your email, or for coaches, a Google account. No passwords.
• HR admins, coaches and our team must use two-step sign-in.
• Each company's information is walled off from every other company's in the database itself, not just on the screen, and every one of those walls is tested.
• Encrypted on the way to you and when stored. Phone and watch numbers are sealed again by our own server.
• Every staff action, and every download of company numbers, goes in an audit log nobody can change.
• Daily backups, and a written restore test each quarter.

No system is perfect. If something goes wrong with your information, we'll tell you as the law requires.

17. Children and age

Talewind is for people at work. It's never for children under 13, and we don't knowingly collect information from them.

18. Changes to this notice

If we change this notice in a way that matters, we'll tell you in the app before it takes effect. The date at the top shows the latest version.

19. Contact us

• Employees: support@wunsupona.com, or Write to us in the app (under Need a hand?).
• HR teams: hello@wunsupona.com.
• Coaches: hello@wunsupona.com.