Key Updates

What changed in these documents, newest first.

Version 1 · in force since 30 August 2026 · what changed. Drafted in good faith; not legal advice.

This document is incomplete.
The operator has not yet published: legal entity name, registered address, governing law / jurisdiction, legal contact address, privacy contact address. Each missing item is marked in the text below. Until they are published this service should not be taking money from the public.

Coming into effect on 29 September 2026.
The changes dated 30 August 2026 below are published now and become binding on existing accounts on 29 September 2026 — 30 days’ notice. Until then the previous version continues to apply to you. You do not need to do anything; if you would rather not accept them you can close your account at any time.

24 September 2026

Cookies & Local Storage · version 2

Your messages are now kept in the browser's IndexedDB rather than its local storage, which is far larger, so a long history no longer fills it up.
CORRECTION. This page said signing out clears the local copy of your messages. It does not, and did not before: the copy stays on the device, under your account, so it is there when you sign back in. Deleting your account removes it, and so do your browser's site-data controls.

Law Enforcement Guidelines · version 4

Call audio and video: a large meeting passes through LiveKit, which does not store it; we still hold no copy unless a cloud recording was made.

§3 Going live — to watch from a shared link you must be 18 or over; we use the date of birth you gave when you signed up and ask only accounts that have none. A reply to a comment shows a short quote of it; the host can pin a comment for everyone.

§3 Going live — everyone watching a live can see who else is watching. A viewer the host lets on stage is seen and heard by everyone watching (and is not in the host's recording). Comments are checked automatically before they are shown; one that is refused is not kept, and only the fact that it was refused is logged.

§3 Going live — the host can record their own live. Only the host is in the recording, never a viewer's name, face or words. Everyone watching is told. It is kept 2 days for the host to download. A live stopped by our staff or by a report is not handed to the host: its recording is held for as long as the law requires, then deleted.

§3 Feedback — a review can carry a rating of 0 to 5 stars, kept with the rest of what you sent. Now and then the app asks whether you would like to rate it: at most once a month and four times in all, and not for six months after you rate. We keep when we last asked.

§3 Whinchat Artists — if you add a song to the music library, the title, the artist name, the genre and language you give, and the recording are shown to everyone who uses the music sheet, and the artist name is credited on every update that uses it.

§3 Going live — anyone you send your live's link to can also watch it, and the people told you are live are told at most once every 10 minutes (it was once an hour).

§3 Going live — who can watch (your contacts and the people who follow your shop), who is notified, that a live goes through LiveKit and is not end-to-end encrypted, that nothing is recorded, that staff may watch any live to moderate it, and that comments and who watched are kept 30 days after it ends.

§3 Feedback — what you send from Settings → Send feedback is kept with your username, the kind you picked and your browser's name, read only by staff, included in your data export and deleted with your account.

§3 Large meetings and recordings — a Business host can make a meeting large (up to 50 people). Its audio and video then go through LiveKit's servers instead of directly between phones, so a large meeting is not end-to-end encrypted: LiveKit forwards it and could technically access it. Neither LiveKit nor we record it unless the host starts a cloud recording.
§4 How well it is protected — calls stay encrypted between the people on them, except large meetings, which are encrypted to LiveKit's servers.

§3 Meeting recordings — the host of a meeting on the Business plan can record it to the cloud. Everyone in the meeting is told, including anyone who joins later. The recording is stored privately, encrypted, can be downloaded only by the host and the people who were in the meeting, and is deleted after 2 days. See Recording & Consent.

§3 Updates and hashtags — music now plays from Whinchat's own storage. Previewing or playing a track no longer makes your phone contact the site that published it; our server fetches one copy of each track instead.

§3 Updates and hashtags — music may now also be licensed share-alike (CC BY-SA), where the artist asks that what is made with the track is shared under the same licence.

§3 Updates and hashtags — while you type a hashtag, the app suggests matching ones with how many public updates have used each. To suggest familiar names, the letters you have typed after # are sent from our server to Wikipedia — never from your phone, and never with your name. The count for each hashtag covers public updates only.

§3 Updates and hashtags — an update can now carry a feeling from a fixed list and a piece of free music. Music searches are sent from our server to Openverse, never from your phone and never with your name. Playing a track streams it from the site that hosts it (usually Jamendo), which sees your device's address the way any website you visit does.

Call Recording & Consent · version 3

Recording a live: who can, who is told, what is in it (only the host), who can download it, and when a recording is held instead.

Call Recording & Consent · version 2

Cloud recording of meetings: who can start one, who is told, where it is kept, who can download it, and that it is deleted after 2 days.
What we store — rewritten: a call recording still stays on the recorder's device; a cloud recording of a meeting is held by us for 2 days.

Data Retention · version 5

Recordings of lives: 2 days, like meetings; a live stopped by staff or a report: held 90 days, then deleted.

Data Retention · version 4

Whinchat Artists songs: until the artist withdraws them or deletes the account, or we remove them.

Data Retention · version 3

Lives: the comments, the hearts and who watched are kept 30 days after the live ends, then deleted. The video itself is never stored.

Data Retention · version 2

Cloud recordings of meetings: 2 days, then deleted.

Security & Breach Notification · version 4

Calls: a large meeting is encrypted to LiveKit's servers, not end to end.

Subprocessors & Transfers · version 5

LiveKit now also carries lives (one person broadcasting to their contacts and followers).

Subprocessors & Transfers · version 4

Added LiveKit, which carries the audio and video of large meetings.

§8 Calls and meetings — watching a live from a shared link is for people 18 or over. The host of a live can mute someone in its chat, pin a comment for everyone, and mute a guest's microphone or turn their camera off; the host cannot turn anyone's camera or microphone on, only ask.

§8 Calls and meetings — the host of a live can let viewers on stage to be seen and heard, and takes them off at will; guests must be 18 or over. Comments in a live are checked automatically: slurs, threats, sexual harassment and rude emoji are refused, everyday swearing is masked, and repeated refusals pause commenting for 10 minutes.

§8 Calls and meetings — the host of a live may record it, on any plan, to download and share; the recording carries the Whinchat name. The host is responsible for having the right to publish what is in it.

§8 Calls and meetings — going live: you must be 18 or over to host; your plan sets how many people may watch and for how long; you are responsible for what you show and sell; we may stop a live at once, and a live is stopped automatically if it is reported as child sexual abuse.

§8 Calls and meetings — on the Business plan a host can make a meeting large, for more people than a direct call can carry, through LiveKit's servers.

§8 Calls and meetings — the host of a meeting on the Business plan can record it to the cloud; it is kept for two days. Getting any consent the law requires is the responsibility of whoever records.

23 September 2026

§3 Updates and hashtags — updates you post last 24 hours and go to your contacts unless, for that one update, you choose Everyone. A public update can be seen by anyone signed in and found through its hashtags. Hashtag pages, suggestions and counts only ever include updates the person looking is allowed to see.

20 September 2026

Law Enforcement Guidelines · version 3

Private chats: content is ciphertext we cannot produce.

Law Enforcement Guidelines · version 2

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.
"What we cannot give you" is now "What we can and cannot give you", and says that message content on or after that date is obtainable on a warrant.

Marketplace & Seller Terms · version 4

Protected deals in a chat: two people can agree a sale in their own conversation on the same escrow — who may cancel, pay, send and confirm, what happens if either of them walks away, and how a frozen deal is settled.

§3 Shops you follow — following a shop or a category is recorded so that you can be told when something new is listed. At most one message a day, never one per item. What you follow is private: a seller is never told who follows them and never given a follower count.

§3 Measuring how the app performs — the app now reports load times, which screens were opened and which named buttons were pressed, so that what is slow or unreachable can be found. It never carries anything you typed. Before sign-in it uses an identifier that lasts one browser tab. It can be switched off in Settings, and Global Privacy Control and Do Not Track are honoured automatically.

§3 Private chats: either person can make a direct chat end-to-end encrypted. What it covers, and the five things it does not, are listed.

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.
§3 How well it is protected — rewritten to say what is really encrypted (calls, old messages, passwords) and what we can read (everything else).

§3 What happens when you sign up — the app's own account sends you a welcome message and becomes a contact; that thread is read and answered by staff. The operator's account is added as a contact as well. Both can be removed.
§3 If you signed up on somebody's personal invite link, we record who invited you, tell them you joined, and connect the two of you.

Security & Breach Notification · version 3

Private chats added: the server refuses to store readable text in one.

Security & Breach Notification · version 2

CORRECTION. This document said direct messages were end-to-end encrypted. They have not been since 26 July 2026: we can read message text sent on or after that date. Messages sent before it remain ciphertext we cannot open, and calls are still encrypted between the people on them.

Subprocessors & Transfers · version 3

The translation caveat no longer rests on a claim of end-to-end encryption — see the correction in Privacy.

30 August 2026

Billing, Renewals & Refunds · version 2

Refunds: added the case where staff issue one directly.

Marketplace & Seller Terms · version 3

Staff refunds and listing takedown, and what each one means for a seller who has already been paid out.

§4 Marketplace — staff may now refund a paid order without a formal dispute having been opened, and may remove a listing that is already live.
§2 Your account — an administrator may issue a temporary password; doing so signs the account out of every device.

29 August 2026

§3 What we collect — the app now reports JavaScript errors from your browser so faults can be found without waiting to be told. The report carries the error, the page and the build, never message content.
§6 Where it is held — photos and voice notes now live in private object storage rather than on the application server's own disk.

Subprocessors & Transfers · version 2

Added the object-storage provider now holding photos and voice notes.

26 August 2026

Marketplace & Seller Terms · version 2

Seller reserves: a slice of each payout is held back to answer a late refund.

7 August 2026

§11 added: US state privacy rights, split into its own notice.

§9 added: sanctions screening, and what a false match means for you.

5 August 2026

Child Safety · version 2

Reporting child sexual abuse material: preservation, and referral to NCMEC.

Whinchat · All documents · Open the app