Whisk Chat — Privacy Policy

This policy explains what data Whisk Chat collects, how it is used, and your rights. Whisk Chat is operated by Verdus Technologies Pte Ltd ("Verdus", "we", "us"), a company registered in Singapore.

1. Data we collect

1.1 Account data (retained while your account exists)

• Email address — the only identifier used to sign in (via magic link). Not shared with anyone.
• Display name — the name you choose to show other users.
• Device identifiers — one per browser or app install, used to route encrypted messages to your devices. Auto-evicted after 7 days of inactivity.
• Public encryption keys — the public half of each device's key, so others can encrypt messages to you.

1.2 Ephemeral routing data (auto-deleted within 30 days)

• Encrypted message blobs — held briefly when a recipient device is offline. Deleted the moment the recipient acknowledges receipt, or after 30 days maximum. We cannot read them; only the recipient's device can decrypt.
• Encrypted file blobs — same treatment for shared files (up to 100 MB per file).
• Routing metadata — sender device ID, recipient device ID, timestamp, blob size. This is envelope data, not content.

1.3 Operational data (kept while relevant)

• Contact list — who you have added as a contact and any nickname you gave them. Stored so we can route your messages.
• Session cookies — one authentication cookie per browser to keep you signed in.
• Diagnostic snapshots — only when you tap "Send to Whisk support" in Settings; auto-purged after 7 days.

1.4 Data we DO NOT collect

• Message content, file content, or voice/video call content — these travel end-to-end encrypted and Whisk's servers never see them in plaintext.
• Your phone contacts, address book, or SMS history.
• Your continuous location. We only access location when you explicitly request a location-based Whisk tile (weather, map, etc.), and only for the duration of that query.
• Analytics, ad IDs, tracking cookies, third-party trackers.
• Payment information (the app is free; no purchases).

2. How we use your data

• Sign you in — magic-link emails to your address, session cookie in your browser.
• Route messages to your devices — encrypted blob briefly held on our servers, delivered when the recipient device is online, then deleted.
• Enable cross-device sync — via your own cloud folder (Google Drive, Dropbox, iCloud, OneDrive) if you opt in. Files stored there are encrypted; Verdus never accesses them.
• Serve location-anchored widgets — when you ask "what's the weather here?", we send your coordinate to public data sources (see Section 4) and return the answer. Coordinate is not stored beyond the request.
• Answer support requests — if you email us, we use your message content only to respond.

3. Storage and location

All Verdus-held data is stored on servers operated by Hetzner Online GmbH in Germany (EU). No data is transferred to jurisdictions outside the European Economic Area by Verdus, though your own device may be located anywhere.

Your self-sync folder (Google Drive, etc.) is stored wherever your cloud provider stores it — that's their policy, not ours. Verdus has no visibility into that folder.

4. Third-party services

Whisk Chat uses a small number of third-party services to function. Each is used only for its stated purpose and receives no more data than necessary:

• OpenStreetMap Nominatim — for reverse geocoding (turning coordinates into place names in shared widgets). Receives your coordinate only when you trigger such a query.
• Cloudflare — CDN and DDoS protection in front of our servers. Cloudflare sees your IP address as an incidental part of routing your requests.
• Google Play Services / FCM — for push notifications on Android, if enabled. Google receives a notification token and delivery metadata but no message content.
• Public data APIs (Wikipedia, Wikimedia, Wikidata, Openverse, Open-Meteo, USGS, and similar) — invoked when you request location-anchored information. They receive the coordinate for your request.

Whisk does not use any advertising networks, analytics platforms, or user-tracking services.

5. Your rights

Under Singapore's Personal Data Protection Act (PDPA), the EU General Data Protection Regulation (GDPR), and other applicable frameworks, you have the right to:

• Access — see what data we hold about you.
• Rectify — correct anything wrong about your account.
• Delete — remove your account and everything Whisk holds on you.
• Export — receive a copy of your data in a portable format.
• Restrict / Object — limit how we process your data.
• Withdraw consent — sign out and stop using the app at any time.

5.1 Self-service — do it yourself in the app

Whisk Chat is built for you to exercise these rights yourself, without emailing anyone or waiting for us. Open Settings in the app and choose:

• Access + Export — Settings → Privacy & Data → Download export. Instantly downloads a JSON file with every message, chat, contact, and setting stored on that device.
• Rectify — Settings → Profile → Display name. Change your name any time; propagates to your contacts.
• Delete my account — Settings → Privacy & Data → Delete my account. One click deletes your user row, all your devices, contacts, ephemeral encrypted blobs, sessions, and magic tokens from Whisk's servers. Local backups in your own cloud folder are unaffected (only you can delete those). Requires typing your email as confirmation. Irrevocable.
• Reset local state (this device only) — Settings → Support → Reset local state. Wipes local messages, files, and settings from this device. Your account and other devices are unaffected.
• Revoke a device remotely — Settings → Devices → Revoke. Immediately signs out that device and deletes its outbox entries. Useful if a device is lost or stolen.
• Withdraw consent — Settings → Profile → Sign out, or simply uninstall the app.

5.2 When to email us

Please email [email protected] only if:

• The self-service tools above are not working for you.
• You need help interpreting or acting on your rights.
• You want to file a complaint about how we processed your data.
• You are lodging a formal PDPA / GDPR data-subject request that needs a written trail.
• You are reporting a security incident (use subject line SECURITY).

We respond within 30 days as required by law, and usually within 3 working days.

6. Age restriction

Whisk Chat is intended for users aged 18 or older. By using the app you confirm that you meet this age requirement. If we become aware that we hold data belonging to a person under 18, we will delete it immediately.

7. Security

Message and file content is encrypted end-to-end using AES-256-GCM with per-recipient ECDH-P256 key exchange. Keys are generated on your device and never leave it (except the public half, which is shared so others can encrypt messages to you). Verdus cannot decrypt your content even if compelled to do so.

Session cookies are transmitted only over HTTPS/TLS 1.3. Our servers apply industry-standard hardening (fail2ban, firewall, sandboxed services, encrypted backups).

No system is fully invulnerable. If a security incident affects your data, we will notify you and the appropriate authorities without undue delay, as required by law.

8. Cookies

Whisk Chat uses exactly one cookie: whisk_messages_session, an authentication cookie that keeps you signed in. It expires 7 days after last use. No advertising or analytics cookies are set.

9. Changes to this policy

If we materially change this policy, we will notify users through the app and update the "Last updated" date above. Continued use after the change constitutes acceptance.

10. Contact

Verdus Technologies Pte Ltd
Singapore
[email protected]

For urgent security disclosures, use the same email with subject line "SECURITY".