Key Updates

What changed in these documents, newest first.

Version 1 · in force since 30 August 2026 · what changed. Drafted in good faith; not legal advice.

Coming into effect on 27 November 2026.
The changes dated 28 October 2026 below are published now and become binding on existing accounts on 27 November 2026 — 30 days’ notice. Until then the previous version continues to apply to you. You do not need to do anything; if you would rather not accept them you can close your account at any time.

6 November 2026

Acceptable Use Policy · version 4

Clarified that graphic real-world violence and gore are objectionable content, except where newsworthy and shown with context. We already removed this; no new notice period.

Deleting Your Account · version 2

New section: how to delete some of your data and keep your account, what that removes and what is kept.

Photos in public and shared places: photos posted as updates or to channels, and photos sent to groups, open rooms and marketplace chats with people you aren't connected to, are checked by our AI provider for nudity, graphic violence and sexual content involving children. A match only flags the photo for our staff. Direct chats, private chats, calls, videos and view-once media are not checked.

Subprocessors & Transfers · version 14

The AI provider also checks photos posted as updates or to channels, and photos sent to groups, open rooms and marketplace chats between people who aren't connected.

29 October 2026

Child Safety · version 4

Minimum age — 18, everywhere, on the website as well as the apps; the table of country ages is gone. What happens to an account made earlier by someone younger.

§2 Who may use it — Whinchat is for people 18 and over, everywhere and on every device, the website included. An account made earlier by someone younger is kept, but can only download its data or be deleted until its owner turns 18.

28 October 2026

Acceptable Use Policy · version 3

Sexually explicit content — pornography and other sexually explicit images, video or text are not allowed.
No tolerance for objectionable content or abusive users — what we remove, the filter where people who don't know you can reach you, and blocking and reporting.

Child Safety · version 3

Minimum age — the iPhone and Android apps are for people 18 and over; the website keeps the minimum ages in the table.

§2 Who may use it — the Whinchat apps for iPhone and Android are for people 18 and over; the website keeps its minimum age.

§5 What you may not do — no sexually explicit content, and no tolerance for objectionable content or abusive users.

27 October 2026

Contacting support without signing in: the sign-in screen now has a form for people who can't sign up or sign in. It asks for an email address, sends a code to it, and keeps the address with the request to answer you by email.

Data Retention · version 9

Support requests written from the sign-in screen keep the email address you gave, for the same 2 years after the case closes.

26 October 2026

Who else processes it: Google Firebase delivers notifications in the iPhone and Android apps (see Subprocessors).

Subprocessors & Transfers · version 13

Added Google Firebase Cloud Messaging, which delivers notifications to the iPhone and Android apps when they are closed. It receives the app's notification token and the notification's words (for example who is calling), never the text of your messages.

25 October 2026

Marketplace & Seller Terms · version 15

Invites and rewards — an invite counts once the person who joined through your link buys or sells something on Whinchat. Counted invites earn badges, free buyer protection on an order, and, for a seller who brings in other sellers, a lower commission for a time. Rewards earned by fake accounts, or by buying from yourself, are taken back.

Marketplace & Seller Terms · version 14

Staying on Whinchat — a sale that starts on Whinchat is paid on Whinchat. Asking a buyer to pay some other way is not allowed; a confirmed report brings a warning, and a second within 180 days pauses new orders until our staff review the shop. Ratings, sales counts and badges come only from orders paid on Whinchat.
New shops — until a shop has completed a set number of sales, its orders have a maximum value, only so many can be open at once, and larger orders are paid out a few days later.
Branded goods — a listing that names certain brands is approved only after the seller's supplier invoice and a photo of the item with its own code are checked; copies of a brand are not allowed; a verified brand owner can report a listing, which is taken off sale and its payouts held until our staff decide.
Your own buyers — a buyer who comes through your own shop link pays the usual price, and you pay a lower commission on their orders for a time.

23 October 2026

§3 What we collect — Which country you're connecting from: the country code of the phone number on your account is checked the same way as your network address, and creating an account or moving money is refused from the networks of cloud and VPN companies. Nothing is kept unless it stops you.

§3 What we collect — Searches in the marketplace: a search is answered by our server, and is counted for sellers ("what buyers search for") without saying who made it. The same person counts once a day under a code that changes every day, a search that looks like a phone number or an email is never kept, sellers see a search only once at least 3 people made it, and counts are deleted after 30 days.

§3 What we collect — Which country you're connecting from: the network address of a sign-up, a sign-in and each request is matched to a country on our server (only the country, never a city), so the app can be closed to a country where the law or our business requires it. The address is not sent anywhere for this, and the country is not stored unless it stops you.

Sanctions & Export Control · version 3

Where you are — the address check now uses a table of every country's address ranges, because the app can also be closed to other countries (see the Privacy Policy). It still works out only the country, on our server, and nothing is kept unless it stops you.

15 October 2026

Dispute Resolution · version 2

“Where a dispute is heard” now names the courts directly. It used to repeat the governing-law wording, which made the sentence read incorrectly.

12 October 2026

Intimate Images Shared Without Consent · version 2

What we do — near copies of a removed picture (re-saved, resized, mirrored, rotated, lightly cropped or bordered) are now blocked from upload and taken down too, using a fingerprint of the picture. What is still not caught is listed.

Marketplace & Seller Terms · version 13

I'm here — on a local delivery the seller (or their delivery partner), and on a collection the buyer, can tap I'm here to tell the other person they have arrived. It sends no location and changes nothing about the order.
Signature at handover — when a collection or local delivery is completed with the buyer's code, the buyer may also sign on the seller's screen. It is optional and is kept with the order as evidence; the code is still what completes the order.

§3 What we collect — when you collect an order or take a local delivery, you may sign on the seller's screen. The signature (and a name, if you type one) is kept with the order record and seen only by the buyer, the seller, their delivery partner and our staff in a dispute. Tapping I'm here on an order sends no location.
§3 What we collect — every picture you upload gets a fingerprint: a short code worked out on our server that cannot be turned back into the picture. It is used only to stop a picture removed as an intimate image from coming back as a near copy.

11 October 2026

Acceptable Use Policy · version 2

Intimate images shared without consent: how to have one removed (within 48 hours) is now on its own page.

Marketplace & Seller Terms · version 12

Shipping prices — a seller offers free shipping or sets a flat shipping price (and optionally a price for each additional item); it is shown on the listing and at checkout, paid to the seller in full, and carries no commission. Collection, local delivery and digital items have no shipping charge.
Estimated delivery — listings, checkout and orders show an estimated delivery date; it is an estimate, and the date the seller must send by is what the seller promises.
Order emails — receipts and order updates are emailed to both of you.
Delivery photos — a seller may add up to three photos of where an order was left; they are evidence for both of you and for us in a dispute, and confirm nothing on their own.

Marketplace & Seller Terms · version 11

Sending orders — every listing says how many business days the seller takes to send it; an order not sent by then is flagged to both of you, and you can cancel it for a full refund (the US FTC Mail Order Rule).

§7 Who else processes it — the email service also sends order emails: your receipt, and updates when an order is sent, arrives, is cancelled, refunded, late or has a problem. They carry the item, the amounts and the other person's username, never a delivery address or a collection code.
§3 What we collect — a seller (or their delivery partner) may add up to three photos of where an order was left. Only the buyer, the seller and our staff (in a dispute) can see them; they are kept with the order record.

§3 What happens when you sign up — the operator's account is no longer added to the contacts of anyone under 18, and links made before this change were removed.
§3 Camera effects — the face tracking behind Beauty and Fun effects runs only on your device; no picture or face measurement is sent, stored, or used to recognise anyone.
§3 Updates — only people 18 or over can post an update to Everyone; an update by someone under 18 is seen by their contacts only.
§7 Who else processes it — the summary now lists every kind of provider: the email service sends welcome and connection emails too, and the birr payment gateway, the video provider and the shipping provider are named.

§3 What we do not hold — no ads are shown to anyone under 18, or to an account whose date of birth we do not hold.

Sanctions & Export Control · version 2

Where you are — besides the country you declare, the network address you sign up or sign in from is checked against the embargoed countries (IP Geolocation by DB-IP).
Names — close matches (another word order, an extra middle name, a near spelling) hold a payment until a person has looked; they never refuse it on their own.

Subprocessors & Transfers · version 12

The email delivery provider also sends order emails (receipts and order updates).

Subprocessors & Transfers · version 11

The email delivery provider also sends the welcome email when you join and an email when someone asks to connect with you.

§8 Calls and meetings — calls are not a phone service and cannot reach 911 or any other emergency number.

US State Privacy Rights · version 2

Categories collected — precise location is collected in one case (a courier during a local delivery); the page used to say location was only ever country-level.
Sensitive personal information — names what we hold that the state laws treat as sensitive, what we use it for, and how long we keep it.

9 October 2026

Cookies & Local Storage · version 3

A random install id in local storage, sent with requests, so a banned account coming back on the same device can be noticed. It identifies the browser to us and nothing else, and is never used for advertising or analytics.

EEA & UK Privacy Notice · version 2

§6 Automated decisions — lists every automated check that can act before a person looks: refusing a new account whose email belongs to a banned account, and pausing new orders to a shop with many disputes or refunds or very low ratings (the seller is told why and staff review every pause); and the two that only flag for a person (a device or phone shared with a banned account; the photo check).

Marketplace & Seller Terms · version 10

Paying in birr — through Chapa (telebirr, CBE Birr, cards), straight to the seller: no escrow and no buyer-protection fee on a birr order; unpaid orders are cancelled.

Marketplace & Seller Terms · version 9

Local delivery — a seller may bring an item themselves and share their location with the buyer while on the way; it ends with the buyer's code, which can also be shown as a QR.
Fulfilment partners — a seller may ask another account to send or deliver orders; a partner sees what sending needs and never touches payments.
Shipping labels — bought in the app, paid from what that order pays the seller.

Marketplace & Seller Terms · version 8

Escrow — with carrier tracking, the payment is released a few days after the carrier reports the parcel delivered, waits while it is still on its way, and is not released by the clock if the carrier reports it returned or lost.
Digital items — delivered in the app as soon as the payment is held; they cannot be returned once delivered, but a problem can still be reported.

Marketplace & Seller Terms · version 7

Buyers in the EU — a seller sells to addresses in the EU, Iceland, Liechtenstein and Norway only after choosing to, as a trader (with their details shown to buyers) or as a private seller (shown as such).
Your record — buyers see a seller's stars, % positive and % disputes over the last year (percentages from 5 orders on). A shop with many disputes or refunds or very low ratings stops taking new orders until our staff review it; the seller is told why.
Reporting an illegal listing — say why, give your name and email, and confirm it is in good faith; we tell you it arrived and what we decided. A seller whose listing we take down is told what, why, on what ground, and how to contest it.
Photos — every listing photo, and a still from a host's camera during a live, is checked automatically for prohibited goods; a match only flags it for our staff. A listing may only use photos and video its seller uploaded.

§3 Nearby chat — photos can be sent too, phone to phone. A nearby friend can carry your unsent messages, sealed so their phone cannot read or change them, and send them when they are online; we then post them as from you and record who carried them.

§3 Nearby chat — two phones on the same Wi-Fi or hotspot can talk with no internet. Those messages go straight from one phone to the other: they never reach our servers, we cannot read, keep or recover them, and they are kept only on the two phones. It is not offered in some countries.

§3 Payments in birr — Chapa, an Ethiopian payment gateway, receives the amount and the buyer's email for a birr payment, and a seller's payout account (we keep its last four digits).

§3 Local delivery — while a seller or their partner delivers an order themselves, the buyer sees the latest point of their location; nothing is shared before or after, the last point is kept 30 days for disputes, and the buyer's own location never leaves their phone.
§3 Sending an order — the delivery address may be seen by the seller's fulfilment partner, and by our shipping provider when a label is bought.

§3 Keeping banned accounts out — we keep scrambled forms (keyed hashes, never the values) of your email, any phone number you give us, and a random id your browser keeps for this app. If an account is banned, a new account that matches is refused (the same email) or held from buying and selling until our staff check it (the same device or phone). Deleted with your account; a banned account's are kept for the length of the ban.
§3 Checking for prohibited goods — every listing photo, and a still from the host's camera every few minutes during a video live, is checked automatically (by our AI provider) for goods we do not allow. A match only puts it in front of our staff. A still that is clear is deleted at once; one that is flagged is deleted when staff have looked at it, and after 30 days at the latest.

Data Retention · version 8

Local delivery: the last point of a courier's location is kept 30 days after the delivery ends, then deleted.

Data Retention · version 7

Identifiers kept to keep banned accounts out (hashes of your email, phone and this browser's install id): deleted with your account; for a banned account, kept for the length of the ban and never more than two years.

Subprocessors & Transfers · version 10

Added Chapa, an Ethiopian payment gateway, for payments in birr (telebirr, CBE Birr, cards) and for sellers' birr payout accounts.

Subprocessors & Transfers · version 9

The tracking provider is now the shipping provider: when a seller buys a postage label it also receives the delivery and return addresses and the parcel's size and weight.

Subprocessors & Transfers · version 8

Added a tracking provider, which receives a parcel's tracking number and carrier when a seller gives one, to follow it.

Subprocessors & Transfers · version 7

The AI provider also checks every listing photo, and a still from a host's camera every few minutes during a video live, for goods we do not allow. A match only puts the picture in front of our staff.

§6 Buying and selling — the escrow holds the buyer's money until the order is confirmed or, if the buyer says nothing, a set time passes; the Marketplace Terms now say how long for tracked parcels, digital items and everything else.

8 October 2026

Marketplace & Seller Terms · version 6

Buyers outside the US — you can buy for delivery to any country except those under US embargo; no US sales tax is charged on a delivery abroad, and any import duty or VAT is between you and your country. Shop and item pages can be shared by link.

Marketplace & Seller Terms · version 5

Seller obligations — you must be 18 or over to sell, open a shop or be paid.
Listings — every listing is reviewed before it is shown; changing what an item is sends it back for review; you can mark an item sold, hide it or delete it; a listing no longer carries your email or phone (buyers message you in the app).

§3 Shops and listings — a seller sees how many times their shop and each item were viewed. We count each account once a day and never keep who looked; a visit to a public shop page from the web is counted the same way, by a code made from the visitor's address that is held in memory for the day and never stored. A listing no longer carries the seller's email or phone.

§3 Devices you're signed in on — for each sign-in we keep the browser's name, a shortened network address and when it was last used, so you can see your devices and log one out. It is deleted about a month after that sign-in stops being able to work.
§3 Channels and communities — what a channel posts is public; who follows a channel is not shown to anyone. A community's admins see who its members are, and its members see your name in its groups. Its announcements are kept like channel posts.

§3 Voice-message transcripts — if you turn on writing out your voice messages, your own browser sends your speech, while you record, to its speech-recognition service (provided by the browser's maker). The text it returns is sent with the voice message, is kept like the message, and is deleted with it. We never receive audio for this. It is off until you turn it on.

Data Retention · version 6

Disappearing messages: deleted 24 hours, 7 days or 90 days after they were sent, as chosen in each chat. View-once photos and videos: deleted once opened by everyone they were sent to, or after 14 days. Reported ones are kept until the report is dealt with.

4 October 2026

§3 Recovery email — you may add a second email address. We use it only to send you a one-time code (to confirm the address, to sign in if you turn that on, or to reset your password) and a notice when your password changes. Codes last 10 minutes and are kept only in a form that cannot be read back. It is never shown to other people. It is kept until you remove it or delete your account. These emails are sent through an email delivery provider — see Subprocessors.

§3 What we do not hold — ads are labelled Sponsored and sold by placement: an advertiser may choose a category and a country (the one you gave at signup). We record that you were shown an ad, once a day, to count people reached; your name is removed from that after 30 days. Using a seller's discount code keeps which code you used on which order.

Subprocessors & Transfers · version 6

Added an email delivery provider, which sends account-security emails (verification and sign-in codes, password resets, password-changed notices).

3 October 2026

§3 Business profiles — what a shop chooses to publish (category, opening hours, address, website, phone) is public on its shop page. Its greeting and away messages are sent from its account, labelled as automatic, never in a private chat. Saved replies are private to you. Applying for the verified badge sends the business's legal name, address and contact details to our staff only.
§3 Live captions on calls — if you allow captions, your own browser sends your speech to its speech service (provided by the browser's maker) to turn it into text, which goes to the people on the call who asked for it. We never receive your audio and do not keep captions. A finished caption line is sent through our translation service to show it in the reader's language. We count the minutes each account reads, by month.

24 September 2026

Cookies & Local Storage · version 2

Your messages are now kept in the browser's IndexedDB rather than its local storage, which is far larger, so a long history no longer fills it up.
CORRECTION. This page said signing out clears the local copy of your messages. It does not, and did not before: the copy stays on the device, under your account, so it is there when you sign back in. Deleting your account removes it, and so do your browser's site-data controls.

Law Enforcement Guidelines · version 4

Call audio and video: a large meeting passes through our video provider, which does not store it; we still hold no copy unless a cloud recording was made.

§3 Going live — to watch from a shared link you must be 18 or over; we use the date of birth you gave when you signed up and ask only accounts that have none. A reply to a comment shows a short quote of it; the host can pin a comment for everyone.

§3 Going live — everyone watching a live can see who else is watching. A viewer the host lets on stage is seen and heard by everyone watching (and is not in the host's recording). Comments are checked automatically before they are shown; one that is refused is not kept, and only the fact that it was refused is logged.

§3 Going live — the host can record their own live. Only the host is in the recording, never a viewer's name, face or words. Everyone watching is told. It is kept 2 days for the host to download. A live stopped by our staff or by a report is not handed to the host: its recording is held for as long as the law requires, then deleted.

§3 Feedback — a review can carry a rating of 0 to 5 stars, kept with the rest of what you sent. Now and then the app asks whether you would like to rate it: at most once a month and four times in all, and not for six months after you rate. We keep when we last asked.

§3 Whinchat Artists — if you add a song to the music library, the title, the artist name, the genre and language you give, and the recording are shown to everyone who uses the music sheet, and the artist name is credited on every update that uses it.

§3 Going live — anyone you send your live's link to can also watch it, and the people told you are live are told at most once every 10 minutes (it was once an hour).

§3 Going live — who can watch (your contacts and the people who follow your shop), who is notified, that a live goes through our video provider and is not end-to-end encrypted, that nothing is recorded, that staff may watch any live to moderate it, and that comments and who watched are kept 30 days after it ends.

§3 Feedback — what you send from Settings → Send feedback is kept with your username, the kind you picked and your browser's name, read only by staff, included in your data export and deleted with your account.

§3 Large meetings and recordings — a Business host can make a meeting large (up to 50 people). Its audio and video then go through our video provider's servers instead of directly between phones, so a large meeting is not end-to-end encrypted: our video provider forwards it and could technically access it. Neither it nor we record it unless the host starts a cloud recording.
§4 How well it is protected — calls stay encrypted between the people on them, except large meetings, which are encrypted to our video provider's servers.

§3 Meeting recordings — the host of a meeting on the Business plan can record it to the cloud. Everyone in the meeting is told, including anyone who joins later. The recording is stored privately, encrypted, can be downloaded only by the host and the people who were in the meeting, and is deleted after 2 days. See Recording & Consent.

§3 Updates and hashtags — music now plays from Whinchat's own storage. Previewing or playing a track no longer makes your phone contact the site that published it; our server fetches one copy of each track instead.

§3 Updates and hashtags — music may now also be licensed share-alike (CC BY-SA), where the artist asks that what is made with the track is shared under the same licence.

§3 Updates and hashtags — while you type a hashtag, the app suggests matching ones with how many public updates have used each. To suggest familiar names, the letters you have typed after # are sent from our server to a public encyclopedia service — never from your phone, and never with your name. The count for each hashtag covers public updates only.

§3 Updates and hashtags — an update can now carry a feeling from a fixed list and a piece of free music. Music searches are sent from our server to an open-licence music search service, never from your phone and never with your name. Playing a track streams it from the site that hosts it (usually a free-music host), which sees your device's address the way any website you visit does.

Call Recording & Consent · version 3

Recording a live: who can, who is told, what is in it (only the host), who can download it, and when a recording is held instead.

Call Recording & Consent · version 2

Cloud recording of meetings: who can start one, who is told, where it is kept, who can download it, and that it is deleted after 2 days.
What we store — rewritten: a call recording still stays on the recorder's device; a cloud recording of a meeting is held by us for 2 days.

Data Retention · version 5

Recordings of lives: 2 days, like meetings; a live stopped by staff or a report: held 90 days, then deleted.

Data Retention · version 4

Whinchat Artists songs: until the artist withdraws them or deletes the account, or we remove them.

Data Retention · version 3

Lives: the comments, the hearts and who watched are kept 30 days after the live ends, then deleted. The video itself is never stored.

Data Retention · version 2

Cloud recordings of meetings: 2 days, then deleted.

Security & Breach Notification · version 4

Calls: a large meeting is encrypted to our video provider's servers, not end to end.

Subprocessors & Transfers · version 5

The video provider now also carries lives (one person broadcasting to their contacts and followers).

Subprocessors & Transfers · version 4

Added a video provider, which carries the audio and video of large meetings.

§8 Calls and meetings — watching a live from a shared link is for people 18 or over. The host of a live can mute someone in its chat, pin a comment for everyone, and mute a guest's microphone or turn their camera off; the host cannot turn anyone's camera or microphone on, only ask.

§8 Calls and meetings — the host of a live can let viewers on stage to be seen and heard, and takes them off at will; guests must be 18 or over. Comments in a live are checked automatically: slurs, threats, sexual harassment and rude emoji are refused, everyday swearing is masked, and repeated refusals pause commenting for 10 minutes.

§8 Calls and meetings — the host of a live may record it, on any plan, to download and share; the recording carries the Whinchat name. The host is responsible for having the right to publish what is in it.

§8 Calls and meetings — going live: you must be 18 or over to host; your plan sets how many people may watch and for how long; you are responsible for what you show and sell; we may stop a live at once, and a live is stopped automatically if it is reported as child sexual abuse.

§8 Calls and meetings — on the Business plan a host can make a meeting large, for more people than a direct call can carry, through our video provider's servers.

§8 Calls and meetings — the host of a meeting on the Business plan can record it to the cloud; it is kept for two days. Getting any consent the law requires is the responsibility of whoever records.

23 September 2026

§3 Updates and hashtags — updates you post last 24 hours and go to your contacts unless, for that one update, you choose Everyone. A public update can be seen by anyone signed in and found through its hashtags. Hashtag pages, suggestions and counts only ever include updates the person looking is allowed to see.

20 September 2026

Law Enforcement Guidelines · version 3

Private chats: content is ciphertext we cannot produce.

Law Enforcement Guidelines · version 2

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.
"What we cannot give you" is now "What we can and cannot give you", and says that message content on or after that date is obtainable on a warrant.

Marketplace & Seller Terms · version 4

Protected deals in a chat: two people can agree a sale in their own conversation on the same escrow — who may cancel, pay, send and confirm, what happens if either of them walks away, and how a frozen deal is settled.

§3 Shops you follow — following a shop or a category is recorded so that you can be told when something new is listed. At most one message a day, never one per item. What you follow is private: a seller is never told who follows them and never given a follower count.

§3 Measuring how the app performs — the app now reports load times, which screens were opened and which named buttons were pressed, so that what is slow or unreachable can be found. It never carries anything you typed. Before sign-in it uses an identifier that lasts one browser tab. It can be switched off in Settings, and Global Privacy Control and Do Not Track are honoured automatically.

§3 Private chats: either person can make a direct chat end-to-end encrypted. What it covers, and the five things it does not, are listed.

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.
§3 How well it is protected — rewritten to say what is really encrypted (calls, old messages, passwords) and what we can read (everything else).

§3 What happens when you sign up — the app's own account sends you a welcome message and becomes a contact; that thread is read and answered by staff. The operator's account is added as a contact as well. Both can be removed.
§3 If you signed up on somebody's personal invite link, we record who invited you, tell them you joined, and connect the two of you.

Security & Breach Notification · version 3

Private chats added: the server refuses to store readable text in one.

Security & Breach Notification · version 2

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.

Subprocessors & Transfers · version 3

The translation caveat no longer rests on a claim of end-to-end encryption — see the correction in Privacy.

30 August 2026

Billing, Renewals & Refunds · version 2

Refunds: added the case where staff issue one directly.

Marketplace & Seller Terms · version 3

Staff refunds and listing takedown, and what each one means for a seller who has already been paid out.

§4 Marketplace — staff may now refund a paid order without a formal dispute having been opened, and may remove a listing that is already live.
§2 Your account — an administrator may issue a temporary password; doing so signs the account out of every device.

29 August 2026

§3 What we collect — the app now reports JavaScript errors from your browser so faults can be found without waiting to be told. The report carries the error, the page and the build, never message content.
§6 Where it is held — photos and voice notes now live in private object storage rather than on the application server's own disk.

Subprocessors & Transfers · version 2

Added the object-storage provider now holding photos and voice notes.

26 August 2026

Marketplace & Seller Terms · version 2

Seller reserves: a slice of each payout is held back to answer a late refund.

7 August 2026

§11 added: US state privacy rights, split into its own notice.

§9 added: sanctions screening, and what a false match means for you.

5 August 2026

Child Safety · version 2

Reporting child sexual abuse material: preservation, and referral to NCMEC.

Whinchat · All documents · Open the app