Privacy Policy

What we hold about you, why, and what you can do about it.

Version 44 · in force since 6 November 2026 · what changed. Drafted in good faith; not legal advice.

Controller. Pontelon LLC, 306 W Redwood St, Ste 201, Baltimore, MD 21201 (United States) decides why and how your personal data is processed. Privacy contact: legal@whinchat.app.

EU representative (GDPR Art. 27). [not yet published: EU representative (GDPR Art. 27)]
UK representative. [not yet published: UK representative]

What we hold, and why

Updates and hashtags

An update is deleted 24 hours after you post it, with its file, its views and its reactions — unless it has been reported, in which case it is kept, hidden from everyone, until a moderator has dealt with the report.

Who sees it is chosen for each update. By default only your contacts do, within the limits you set under Who can see this. If you choose Everyone for an update, anyone signed in to the app can see that update and find it through its hashtags, and you will see them in its list of viewers. Choosing Everyone for one update changes nothing about your others. People who are not your contacts can view and react to a public update but cannot reply, because a reply is a direct message. Blocking works as it always does, in both directions, public or not.

Hashtags. We read the hashtags out of what you write so the update can be found by them. A hashtag page, a suggestion while typing, a trending list or a count only ever includes updates the person looking at it is allowed to see — so a hashtag on an update for your contacts is invisible to everyone else, including in counts.

Suggestions while you type. When you type a hashtag, the app suggests matching ones and shows how many public updates have used each. That count is kept per hashtag, with no names attached, and only public updates add to it. To suggest familiar names (people, places, teams), the letters you have typed after # are sent from our server to a public encyclopedia service — not from your phone, and without your name or account.

Feelings and music. A feeling you add ("feeling blessed") is one of a fixed list and is shown to whoever can see the update. Music is free music from independent artists, licensed so that anyone may use it, and each track is credited on the update. Some tracks are licensed "share-alike" (CC BY-SA): the artist asks that what is made with the track is shared under the same licence. When you search for music, the search words go from our server to an open-licence music search service — not from your phone, and without your name or account. Tracks play from Whinchat's own storage: the first time a track is chosen, our server fetches a copy from the site that published it (usually a free-music host), so your phone does not contact that site when you preview or play music.

Shops you follow

If you follow a shop or a category, we keep that choice so we can tell you when something new is listed. It is one message a day at most, never one per item, and it arrives in your chat with the app — with a notification only if you have them switched on and have not silenced that chat.

What you follow is private. A seller is never told who follows them and is never given a follower count, and no one else can see your list. Unfollow from the shop's page, or under Market, and the messages stop.

Business profiles

A shop can add a business profile: a category, opening hours, an address, a website and a phone number. Whatever it chooses to publish is public on its shop page, like the rest of the shop. It can switch on a greeting for new customers and an away message for when it is closed; these are sent from the shop's account, at most once (the away message at most once every 12 hours), are labelled "Automatic reply", and are never sent into a private chat. Saved replies — answers you keep to drop into a chat — are private to you.

To get the verified badge, a business on the Business plan sends us its legal name, address, and a website or phone number we can check, plus anything else it wants to add. Only our staff see it. We keep the application and our decision so the badge can be checked and, if needed, withdrawn; all of it is in your data export and deleted with your account.

Camera effects

Beauty and Fun effects find the shape of your face in the camera picture so the effect can follow it. That happens entirely on your device: no picture and no face measurement is sent to us or to anyone else, nothing is stored, and nothing is used to recognise who you are.

Updates seen by everyone

Only people 18 or over can post an update to Everyone. An update by someone under 18 is seen by their contacts only, and never appears on public hashtag pages.

Live captions on calls

Anyone on a call can turn on captions. Nothing you say is captioned until you tap Allow, and captioning stops whenever your microphone is muted. When you allow it, your own browser sends your speech to its speech-recognition service — provided by the browser's maker — under that company's terms, and the text it returns goes straight to the people on the call who asked for captions. We never receive your audio, and we do not keep captions. To show a finished line in the reader's language, the reader's app sends it through our translation service, which forwards it to an external translation provider. We count how many minutes of captions each account reads in a month, because the allowance depends on the plan; that count is in your data export.

Devices you're signed in on

Each time you sign in — with your password, or by scanning a code with your phone — we keep the browser's name (for example "Chrome on Windows"), a shortened network address with its last part removed, and when it was last used. You see this list under Security, and can log any device out. Signing in with your phone's code works once, for two minutes, and only after your phone approves it. A sign-in's entry is deleted about a month after the sign-in stops being able to work, and all of them are deleted with your account.

Searches in the marketplace

When you search the marketplace, our server answers the search. Searches are also counted so a seller can see what people look for in what they sell, and what they look for and don't find. We never keep who searched: for the count, you are a code worked out from the day and your account, so you count once a day and one day cannot be linked to the next or back to you. A search that looks like a phone number or an email address is never kept. A seller sees a search only once at least 3 different people made it, and every count is deleted after 30 days.

Which country you're connecting from

When you sign up, sign in and use the app, the network address your device connects from is matched to a country — only the country, never a city or anything more precise — using a table of address ranges kept on our own server, so the address is not sent anywhere for this. We do it so the app can be closed to a country where the law or our business requires it. The country is not stored unless it stops you signing up or using the app, when the refusal is logged. A VPN changes which country this sees, so two more checks sit beside it: the country code of the phone number on your account (only the country, from the code) is checked the same way, and creating an account or moving money is refused from the networks of cloud and VPN companies. For that we check whether the address belongs to one of a list of such networks; we keep nothing unless it stops you. IP to ASN data by DB-IP, licensed CC BY 4.0. IP Geolocation by DB-IP, licensed CC BY 4.0.

Shop and item views

A seller sees how many times their shop and each of their items were viewed in the last 30 days. We count each person once a day, never the seller, and never keep who looked — only the number. A visit to a public shop page from the web is counted the same way, using a code made from the visitor's network address that is held in memory for the day and never written down. The counts are deleted after about 13 months, or with the seller's account.

Channels and communities

A channel broadcasts to whoever follows it. What a channel posts is public; who follows it is never shown to anyone, including the channel. Posts are kept until the channel deletes them or the channel is deleted.

A community is joined by a link. Its admins see who its members are; other members see your name only in the groups you join there. Its announcements are a channel only members can read. If an admin removes you, you leave its groups too, and the link no longer lets you back in.

Voice-message transcripts

Writing out your voice messages is off until you turn it on. When it is on, your own browser sends your speech, while you record, to its speech-recognition service — provided by the browser's maker — under that company's terms. You see the text before sending and can leave it out. If you send it, it travels with the voice message, is kept like the message and is deleted with it. We never receive audio for this.

Large meetings and recordings

Calls and ordinary meetings go directly between the people on them; we do not see or keep them. A large meeting — one a Business host chose to make large, for more people than a direct call can carry — goes through our video provider's servers instead: they receive everyone's audio and video, encrypted, and forward it to the others. That makes a large meeting not end-to-end encrypted: our video provider could technically access it. It does not record it and neither do we. It also learns each person's username, display name and network address, as any server a call goes through must.

The one thing we do keep is a cloud recording, which the host of a meeting on the Business plan can choose to make. Everyone in the meeting is told while it runs. The host's device records everyone's video and voice and uploads it to us, and we keep it in private, encrypted storage for two days, then delete it. Only the host and the people who were in the meeting can download it. Details are in Recording & Consent.

Going live

Who can watch. When you go live, your contacts and the people who follow your shop can watch, and they are sent a notification (at most once every 10 minutes, however many times you go live). So can anyone you send your live's link to — and anyone they pass it on to, so share it with care. To watch from a link you must be 18 or over: we use the date of birth you gave when you signed up, and only ask an account that has none, once. No one else can find your live, and anyone you have blocked, or who has blocked you, cannot see it at all, even with the link.

How it travels. A live goes through our video provider's servers, which receive your audio and video, encrypted, and forward them to the people watching. That makes a live not end-to-end encrypted: our video provider could technically access it. Nothing is recorded, by us or by our video provider. It also learns each person's username, display name and network address, as any server a live goes through must.

What we keep. The title, the comments, the number of hearts and who watched, for 30 days after the live ends, then we delete them. We keep them that long so that a report about a live can still be looked into. Comments are shown to everyone watching.

Who you are seen by. Everyone watching a live can see the names of the others watching, and is told when someone joins. If you ask to join the host on stage and the host lets you, your camera and microphone are seen and heard by everyone watching, until you leave the stage or the host takes you off. Guests must be 18 or over. Guests are not in the host's recording.

Comments are checked. Before a comment is shown, it is checked automatically for slurs, threats, sexual harassment and rude emoji, which are refused, and for everyday swearing, which is masked (f•••). A refused comment is not kept — we log only that one was refused, not what it said. Three refusals in one live pause commenting for 10 minutes.

Recording. The host can record their own live, to download and share it. Everyone watching is told while it is being recorded. Only the host is in the recording — their picture and voice, the title and the Whinchat name — never a viewer's name, face or words. It is kept for 2 days for the host to download, then deleted. If our staff stop a live, or it is stopped by a report, its recording is not given to the host: it is held for as long as the law requires such material to be preserved (90 days), then deleted.

Moderation. Our staff can see which lives are running and may watch any of them to check a report, without being shown to the host or the audience. They can stop a live at once. A live reported as child sexual abuse is stopped automatically.

Measuring how the app performs

The app reports how long it took to load, which screens you opened, which named buttons you pressed, and when something took too long or failed. It is counted so we can see what is slow, what is broken, and which parts of the app people never reach.

What it never contains. Nothing you typed or wrote. A button reports the internal name it was given by us, never its contents, never the text of a message, search, listing or profile. No advertising identifier is created and nothing is shared with anyone else — there is no third-party analytics service in this app.

Before you sign in, these reports carry a random identifier that is created for that browser tab and destroyed when you close it. It is not a cookie, it is not kept between visits, and it cannot be used to recognise you on a later visit or anywhere else. Once you are signed in, they are recorded against your account, so that support can see what your app actually did when you ask for help.

How to switch it off. Settings → Privacy → Help improve the app. We also honour Global Privacy Control and Do Not Track automatically: if your browser sends either, nothing is measured and you do not need to change anything here.

How long it is kept. Reports that name you are deleted on the same schedule as the technical log — see Retention. What survives longer is a daily count with no account, identifier or device in it: how many people opened a screen, not which people.

What happens when you sign up

Two things are set up for you the moment your account is created, and you can undo both:

• The app's own account sends you a welcome message, and becomes one of your contacts. That thread is our support channel: what you write in it is read and answered by staff, so please do not put anything in it you would not want a member of staff to read. The operator's account is added as a contact too (not for anyone under 18), without a message, so that support can reach you. Remove either like any other contact if you would rather not have it; nothing else about your account changes.
• If you arrived on somebody's personal invite link, the two of you are connected immediately, they are told that you joined, and we record who invited you. That record is yours to see — it is in your data export — and it is deleted with your account.

Contacting support without signing in

If you can't sign up or can't sign in, you can write to us from the sign-in screen. We ask for an email address and send a 6-digit code to it, so nobody can write in your name; the code works for 10 minutes and once. We keep the address with your request so we can answer you by email, and we check whether it belongs to a Whinchat account so our staff can help with it. We never tell the person filling in the form whether it does. Our staff see the address only partly (like a***@example.com). Your request is kept like any other support request (see Retention), and our emails carry a private link to follow it, which works for 60 days.

Feedback

What you send from Settings → Rate & review Whinchat is kept with your username, the rating you gave (0 to 5 stars), if you gave one, the kind you picked (a review, an idea, a problem, praise or something else) and the name of the browser you sent it from, so we can tell which device a problem happened on. Only our staff can read it. If we reply, the reply arrives in your chat with the app. It is in your data export, and it is deleted with your account.

Now and then the app asks whether you would like to rate it: at most once a month and four times in all, never in your first few days, and not for six months after you have given a rating. To keep to that, we record when we last asked you and how many times. Answering is optional — "Not now" is always there.

What we do not hold

We do not sell personal data, and we do not use it for advertising profiles. We do not use advertising or tracking cookies. Ads — a promoted item, a featured shop, a boosted update — are always labelled Sponsored and are sold by placement: an advertiser may choose a category (shown to people browsing it) and a country (shown to people who gave that country when they signed up). Nothing about what you read, buy or say decides which ads you see. No ads are shown to anyone under 18, or to an account whose date of birth we do not hold.

To tell an advertiser how many people an ad reached, we record that you were shown it, once a day. Your name is removed from that record after 30 days; only the daily totals remain. It is in your data export.

If you use a seller's discount code, we keep which code you used on which order, so the seller's limits (once per person, a total number of uses) can be kept. The seller sees how often their code was used, not by whom.

Phone-number contact matching is opt-in and one-shot: the numbers you choose are hashed for the lookup and are not stored, and someone only appears if they separately chose to be findable by phone.

How well it is protected

Ordinary chats are not end-to-end encrypted, and we can read them. A private chat is, and we cannot. Which one you are in is shown in the conversation itself, and either person can switch a direct chat to private at any time.

A private chat

Open any direct conversation, tap the menu and choose Make this chat private. From that moment the two devices encrypt to each other and we hold only ciphertext: we cannot read it, cannot produce it for anyone who asks, and cannot recover it for you. Our server refuses to accept readable text in a private chat, so it cannot be quietly turned off by a modified app — and if anyone does turn it off, a line saying so appears in the conversation for both of you.

What a private chat does not cover, stated plainly because a padlock invites people to assume more than it means:

• Who you talked to, and when. We route the messages, so we see that.
• Photos, voice notes and files. These are not encrypted yet, so a private chat refuses them rather than sending them in the clear under a padlock.
• Reactions and read receipts. Small, but we can see them.
• Messages already sent before you turned it on. They stay as they were.
• Direct chats only. Group chats cannot be made private yet.
• The app itself. This is a web app: your browser runs code it downloads from us each time. End-to-end encryption protects your messages from us on our servers; it cannot, in any web app, protect you from us if we served you dishonest code. If that is part of your threat model, you need an app you can verify independently.

Nearby chat

Two phones on the same Wi-Fi, or on one phone's hotspot, can talk with no internet: each shows the other a code to scan, and from then on the messages go straight from one phone to the other, encrypted on the way by the connection itself (WebRTC). They never reach our servers. We cannot read them, keep them, recover them, or produce them for anyone who asks, because we never had them. They are kept only on the two phones, and deleting them on yours does not delete them on theirs.

Photos sent over Nearby go the same way, phone to phone, and are kept on the two phones.

A friend can carry your unsent messages. If you wrote messages with no internet, a nearby friend's phone can take them and send them when it gets online. They are sealed with a key only your account and our server hold, so your friend's phone cannot read or change them. Once they reach us they are ordinary messages, stored and readable by us like any other (see below), and we record which account carried them. Only text from ordinary chats is carried — never a private chat, and never photos. A sealed message that has not arrived within a week is refused, and changing your password or logging out everywhere voids any still out there.

The name a nearby person shows you is the name their phone says, not one we checked — there is no server in the middle to check it. You are standing next to them; trust your eyes. Nearby chat is not offered in some countries, and it is not a way around a network shutdown.

An ordinary chat

Your messages are not end-to-end encrypted, and we can read them. Message text is stored on our servers in a form we can open. It is protected by HTTPS in transit and by encrypted storage at rest, and access to production data is limited and logged — but the protection is our word and our controls, not mathematics. Please read that sentence as the plain warning it is: do not put anything in a message here that would harm you if the operator, a member of staff, or anyone who compelled or breached us could read it.

Earlier versions of this policy said the opposite. Until 26 July 2026 direct messages really were end-to-end encrypted, and the messages sent before that date are still stored as ciphertext we cannot read. Encryption was then switched off, because a key that lives on one device silently orphans your own history when that device changes, and people were losing their conversations. This document was not updated at the time. That was our mistake, and this is the correction.

What is encrypted, and what that is worth:

• Calls — audio and video — are encrypted between the participants by WebRTC (DTLS-SRTP), and we cannot listen to them. The exception is a large meeting: a large meeting's audio and video are encrypted to our video provider's servers, which forward them to everyone in it, so it is not end-to-end encrypted.
• Messages sent before 26 July 2026 remain ciphertext. We hold your wrapped private key but it is sealed with your password, which we do not have.
• Passwords are stored hashed, in a form nobody here can reverse.

Everything else, you should assume we can see:

• Message text you send from now on, as described above.
• Photos, videos and voice notes are stored on our servers as files. They are protected in transit and at rest, but staff with server access could open them.
• Metadata — who you talk to, when, and how often — is visible to us because routing a message requires it.
• That a call happened, and between whom. When your network forces the media through our relay, the relay forwards encrypted packets it cannot read — but it still sees the call took place.
• Marketplace listings and shop pages are public by design.

Who else processes it

See Subprocessors for the current list, what each one receives, and where it is. In summary: our hosting provider, the payment processor, a payment gateway for payments in Ethiopian birr, the push-notification services your own operating system uses (and Google Firebase for notifications in the iPhone and Android apps), an email delivery service (security codes, the welcome email, connection emails and order emails), a video provider for large meetings and lives, a shipping provider for postage labels and tracking, an optional translation service, and an AI provider for the listing assistant and for checking photos in listings, lives and shared places.

Where it goes

The Service is hosted in the United States. If you are in the European Economic Area or the United Kingdom, using it means your data is transferred there. Transfers rely on the Standard Contractual Clauses where an adequacy decision does not apply; the transfer machinery is described, honestly including what is not yet in place, in Subprocessors.

How long we keep it

See Data Retention. System logs are kept 14 days.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, and withdraw consent where consent is the basis. Export and deletion are both self-service, in Settings → Your data & privacy — you do not have to ask us and wait. Everything else: legal@whinchat.app.

If you are in the EEA or UK you may complain to your national supervisory authority. If you are in California, see US State Privacy Rights.

Children

The Service is not for children below the ages in Child Safety. We do not knowingly collect their data, and we delete an account when we learn it belongs to someone under the age limit.

Changes

Material changes are signalled in the app and the date at the top of this page changes.

What has changed

Whinchat · All documents · Open the app