Privacy policy

Whispery ("we", "us", "the app") is a voice-first journaling app. We take your privacy seriously because the whole point of the app is being able to speak freely. This page explains in plain language what data we collect, why we collect it, and what we never do.

Sensitive data — explicit consent

Voice journals can contain information about your mental health, which is treated as sensitive personal data under EU and similar privacy laws. By recording a whisper in Whispery, you give us your explicit consent to process that content for the sole purpose of running the App's features (transcription, AI reflection, mood map, daily Capsule, crisis detection). You can withdraw this consent at any time by deleting your whispers or your account.

What we collect

We collect only what we need to make the app work. Specifically:

• Voice recordings — the audio of each whisper, stored on our servers so you can play it back later.
• Transcripts — automatically generated from your audio so the AI can understand what you said and so you can search your journal.
• Emotion labels & tags — generated from each whisper to power the mood map and time-decay search.
• Search data — a numeric fingerprint of each transcript that lets the App surface related past whispers (like the daily Capsule). Not human-readable.
• Display name and country — both optional. Country is used to localize the right crisis helpline; nothing else.
• Device identifier— an anonymous random ID generated on first launch, stored in your device's secure enclave. This is how we know your device on subsequent requests without ever asking for an email or password.
• Push notification token — only if you enable daily reminders.
• Diagnostic data — crash logs and performance metrics. These do not contain journal content.

What we do NOT collect

• Your real name, email, or phone number
• Your contacts or address book
• Your location (coarse or precise)
• Browsing history or activity in other apps
• Any third-party advertising identifiers
• Anything to train AI models. Your voice and transcripts are never used as training data for anyone.

Where your data lives

Audio files are stored in encrypted cloud storage. Transcripts, emotion labels, and the data Whispery uses to find related past whispers are stored in an encrypted database. All traffic between the app and our servers uses TLS.

We use a small number of third-party services to make the App work, by category:

• Speech-to-text + AI empathy provider— turns your audio into a transcript and generates the supportive reflection you see after each whisper.
• AI text-analysis provider— processes your transcripts so the App can surface related memories and power the daily Capsule.
• Cloud audio storage— holds the audio file itself.
• Managed database— stores transcripts, emotion labels, and your account record.
• Push notification service— delivers the daily reminder, only when you turn it on.

None of these providers retain or use your data to train AI models, per their published API terms. We can share the specific vendor names on request — email [email protected].

How long we keep your data

• Your whispers(audio, transcripts, emotion labels, search data) — until you delete them, or until you delete your account.
• Your profile(display name, country, device ID, push token) — until you delete your account.
• Database backups— rotated regularly by our database provider. Deleted whispers cannot be restored from backups after the rotation window passes.
• Diagnostics & security logs(crash data, IP/timestamp, abuse signals) — kept only as long as needed for the purpose, then purged. Never contain journal content.

International data transfers

Our processors run on global cloud infrastructure. Wherever you live, your data may be transferred to and processed in other countries to deliver the service. We rely on each provider's published safeguards (industry-standard contractual clauses, encryption in transit and at rest) to protect that data. By using the App, you consent to this cross-border processing.

How we use your data

• To run the AI pipeline that turns your audio into a transcript and validation
• To show you your past whispers and the mood heatmap
• To surface a relevant memory each day in the Capsule tab
• To detect crisis content and surface a localized helpline
• To send you the daily reminder (if you opted in)
• To debug crashes (anonymous, no journal content)

We do not sell or share your data with third parties for marketing or advertising purposes. Ever.

Your data is locked on your device too

The app supports an optional 6-digit PIN plus Face ID lock. When enabled, the app re-locks itself after 30 seconds in the background. The PIN is hashed with a per-device random salt before storage and never transmitted to our servers.

Crisis content

If our AI detects content suggesting imminent self-harm or suicidal intent, the whisper is flagged and the app surfaces a country-specific crisis helpline in the UI. We do not contact emergency services on your behalf, contact you outside the app, or share crisis flags with anyone outside our internal infrastructure. You remain in control.

Deleting your data

You can permanently delete your account at any time: Settings → Danger zone → Delete all my data. This:

• Removes every whisper from our database (cascade delete)
• Deletes every audio file from R2 storage
• Wipes the user record itself
• Clears all local state on the device, including the device ID and any cached data

There is no recovery once you delete. We do not retain backups of your journal content beyond standard database backups, which are rotated and purged within 30 days.

Your rights (EU / EEA / UK)

If you live in the European Economic Area, the United Kingdom, or another jurisdiction with similar data-protection law, you have the following rights regarding your personal data:

• Access — ask for a copy of what we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — delete your account in-app (Settings → Danger zone) or email us
• Portability — ask for your transcripts as a downloadable export; we'll send within 30 days
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — stop using the App or delete your account at any time
• Lodge a complaint — contact your local data protection authority

To exercise any of these rights, email [email protected]. We respond within 30 days as required by law.

Why we have the right to process your data

• Your explicit consent— for processing your voice and transcripts. You give it when you record a whisper, and withdraw it when you delete one.
• To provide the service— we need to process your data to actually run the App you signed up for.
• Legitimate interest— minimal processing for crash reporting, security, and abuse prevention.

California residents (CCPA / CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to knowwhat personal information we collect (see "What we collect" above)
• Right to delete your data (Settings → Danger zone, or email us)
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising your rights

We do not, and will not, sell or share your personal information for cross-context behavioral advertising or any other commercial purpose. There is no "Do Not Sell My Personal Information" toggle because there is nothing to opt out of.

To exercise California rights, email [email protected].

Other jurisdictions

We aim to comply with applicable data protection laws in the regions our users live in — including, but not limited to, the EU GDPR, the UK GDPR, the California CCPA/CPRA, and Indonesia's UU No. 27 of 2022 on Personal Data Protection. If your local law gives you additional rights to those listed above, please email us and we'll honor them.

Children

Whispery is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with information, please contact us so we can delete it.

Changes to this policy

If we make material changes, we'll update the effective date at the top of this page and notify users in-app at the next launch.

Contact

Questions about this policy or your data? Email [email protected].