Security
Security and data access: what Winback can see
Winback sees only what you choose to send it. The planner at /planner/ runs entirely in your browser, and your export never leaves it. During early access we connect your RevenueCat or Stripe webhook by hand with you, and Winback receives read-only subscription events. Winback never changes a subscription or charges a customer; your own billing stays in charge.
What Winback can see, and what it cannot do
| Part | What Winback can see | What Winback cannot do | How you can check |
|---|---|---|---|
| Planner (/planner/) | Nothing. Your export is read, and the CSV is built, inside your browser | Receive, store or upload your export or the CSV | Open your browser's network panel while you use the planner. Apart from Google Fonts, the only requests are for this site's own files, and none carries your export |
| Webhook, early access | The subscription events RevenueCat or Stripe sends to the webhook we set up with you | Change, pause or cancel a subscription, refund, or charge a customer | The webhook is listed in your own RevenueCat or Stripe dashboard, and you can remove it there at any time |
| Offers | The offer limits and offer links you give us | Create or change offers in App Store Connect, Google Play or Stripe | Your offers stay in your own billing accounts |
| Early access form (/#start) | Your email and the fields you type: app or store, billing system, subscriber count | Use your answers for anything other than talking to you about Winback | Every field you fill in is on the form in front of you |
| Visiting this site | No analytics cookies, no third-party trackers | Follow you around the web | Your browser's developer tools. The only outside request is Google Fonts |
Checked 17 Oct 2026 against how the site and planner are built today. If this changes, we will update this page first.
The planner runs in your browser
The planner reads a RevenueCat customer export or a Stripe subscriptions export that you pick from your computer. It segments lost subscribers, applies your offer limits, writes one message per person and builds the CSV, all in the browser tab. Nothing is uploaded, so you can try it on real data without sending it to us.
Early access: a webhook we set up with you
During early access there is no self-serve connection. The founder connects your RevenueCat or Stripe webhook by hand with you, so you see exactly what is set up. The webhook sends read-only subscription events to Winback. Winback uses them to know who left and who came back, and to measure the 15% fee.
Winback never changes a subscription and never charges your customers. When someone comes back, they pay through your own billing, the App Store, Google Play or Stripe, exactly as before. We use your subscribers' data only for your app's win-back messages, and delete it when you ask or 30 days after you stop, as set out in our privacy policy. How the fee works is on the pricing page.
The website
- winbackhq.com is hosted on Hostinger.
- There are no analytics cookies and no third-party trackers.
- The only resource loaded from another company is Google Fonts, so your browser requests the fonts from Google when a page opens.
- The early access form stores your email and the fields you type on our server, and emails them to support@winbackhq.com, with a copy to our company inbox, support@aguna.app, so we can reply.
What we do not claim
Winback is new and in early access. It does not claim any security certification, and we have no customer results to show yet. If you have a security question, or think you have found a problem, email support@winbackhq.com. Winback is run by AGUNA Wellness Ltd, RC 9590421, Abuja, Nigeria. See also how Winback works with RevenueCat.
FAQ
Does Winback need write access to my RevenueCat or Stripe account?
No. During early access we connect your RevenueCat or Stripe webhook by hand with you, and Winback receives read-only subscription events. It never changes a subscription or charges a customer. Your own billing stays in charge.
Does the planner upload my export?
No. The planner runs entirely in your browser. It reads your RevenueCat or Stripe export, writes the messages and builds the CSV there. Neither the export nor the CSV is sent to us.
Does winbackhq.com use tracking cookies?
No. The site has no analytics cookies and no third-party trackers. The only outside resource is Google Fonts, so your browser requests the fonts from Google when a page loads.
Where is Winback hosted?
The website is hosted on Hostinger. Early access form answers are stored on that server and emailed to support@winbackhq.com.
Does Winback have a security certification?
Winback does not claim any security certification. It is new and in early access. If you need answers for a security review, email support@winbackhq.com and the founder will reply.
Who is behind Winback?
AGUNA Wellness Ltd (RC 9590421) in Abuja, Nigeria. Contact support@winbackhq.com for any security or data question.
Try it on your own data, safely
The planner needs no account and your export stays in your browser. Upload a RevenueCat or Stripe export to see who you lost, who you could win back, and the message each person would get. Want us to set it up with you instead? Early access is open, and you pay nothing until someone comes back.