Privacy Policy

1. Scope and data controller

This policy applies to the Whisper web chat service. The operator of the deployment through which you received access is responsible for the service and privacy requests. Contact the site owner through the same channel that provided your access.

2. Information we process

• Account information: email address, optional display name, salted password hash for email accounts, Google account identifier when Google sign-in is used, hashed session tokens, account public keys, and registered device public keys.
• Social and safety data: contacts, invitations, conversation membership, blocks, reports, restrictions, and security events.
• Encrypted communications: message ciphertext, MLS protocol records, encrypted backups, encrypted media objects, encrypted thumbnails, sizes, timing, retention choice, and broad media category.
• Optional notification data: browser push endpoint and public subscription keys. Notification payloads contain only a generic new-message alert, but the browser push provider can observe delivery timing and network metadata.
• Operational data: rate-limit counters, health results, and minimal alert metadata. Rate limiting uses one-way identifiers where practical.

3. What end-to-end encryption does and does not hide

Message bodies, attached filenames, MIME types, media keys, and media contents are encrypted before storage. Whisper cannot use those contents for advertising or moderation. The service still sees account identifiers, membership, device identifiers, timing, ciphertext sizes, broad attachment type, reports, and retention settings.

4. Purposes and legal basis

We process data to provide the requested chat service, authenticate users, synchronize encrypted records, prevent fraud and abuse, respond to reports, secure the service, meet legal obligations, and establish or defend legal claims. Depending on the deployment and jurisdiction, these purposes rely on contract, legitimate interests, consent, or legal obligation.

5. Service providers and transfers

Vercel hosts the application and encrypted object storage, Turso hosts application records and ciphertext metadata, Resend processes email addresses to deliver verification messages, and Google processes authentication information only when you choose Google sign-in. Online GIF search is optional and sends search terms and network information to the configured GIF provider; locally uploaded GIFs use Whisper’s encrypted storage instead. We do not sell personal information.

6. Retention

Uploaded media follows the sender’s selected 1-day, 7-day, 30-day, or manual-delete period. Deleted and expired objects are removed by application cleanup and platform storage controls. Rate-limit buckets expire automatically. Security and moderation records are retained only as long as needed for protection, investigation, legal duties, and dispute handling. Encrypted messages and account records remain until deleted or the deployment’s retention process removes them.

7. Your choices and rights

You can edit your display name, block accounts, delete your own messages and retained media, remove recovery backups, revoke devices, disable browser notifications, and sign out. Notifications are off until you explicitly enable them in a supported browser. Depending on local law, you may request access, correction, deletion, restriction, portability, or objection and may complain to a data-protection authority. Some encrypted content cannot be recovered or identified by the operator without your keys.

8. Security and incidents

Whisper uses authenticated access, MLS end-to-end encryption, client-side media encryption, authorization checks, rate limits, abuse restrictions, security monitoring, and encrypted recovery backups. No system is perfectly secure, and this application has not received a formal independent security audit. Material incidents are handled under the deployment’s incident-response process.

9. Children and changes

Whisper is not directed to children under 13, or a higher minimum age where required. We may update this policy as the service changes; the effective date above identifies the current version.