LEGAL

Privacy Policy

Effective and last updated: September 10, 2026

This Privacy Policy explains how Whispaw (“Whispaw,” “we,” “us,” or “our”) handles information when you use the Whispaw iPhone application, its communications and optional paired connection, and this website (collectively, the “Services”). It covers iPhone experiences, including Whispers (voice messages), calling, spoken assistance, tours, trivia, study, and music playback.

Whisper recordings are stored on participants’ phones, not in a Whispaw server inbox. However, Whispaw does retain information needed to verify accounts, match saved contacts, connect devices, and provide live-session results. Local storage, encrypted transmission, and server retention are different; the details below explain each.

1. Information we process

Voice, text, trivia, and study activity

Whispaw processes requests you type or speak, speech transcriptions, responses, study material you provide, trivia answers, scores, and context needed to continue an experience. Speech recognition may run on the iPhone or use Apple Speech services. Supported Apple Foundation Models processing runs on the device. Requests to an optional paired model are encrypted in transit through the relay, but the paired endpoint must be able to read them to respond. Conversations and preferences may remain on your devices.

Gameplay and leaderboards

When you join live trivia with scoring or a leaderboard, the service stores session and participant identifiers, questions, submitted answers, scores, and recent session events. This gameplay information is used to run the game, calculate results, and show leaderboard standings—not for advertising. Leaderboard results may be shown to other participants. Ending or leaving a session does not immediately delete these records. This differs from trivia generated and played entirely on the iPhone.

Phone verification and your communications account

If you enable Whispaw calling or Whispers, you provide your phone number and request an SMS verification code. Whispaw and Telnyx process the number and verification information to confirm that you control it. Whispaw retains your verified phone number, account identifier, app-specific device identifier, public authentication key, verification time, and contact-matching preferences. Your own verified number is stored as a phone number, not only as a hash. The private device authentication key stays on your device. A replacement phone must verify again.

Saved contacts and contact pictures

You may type a contact’s number or select a contact using Apple’s contact picker. Whispaw does not upload your entire address book. When you enable contact matching, the numbers you saved in Whispaw and their block choices are sent securely to the service. Matching records are stored as keyed hashes associated with your account; hashing does not make these records anonymous. The service checks whether a saved number is registered and whether both people have saved one another and neither has blocked the other. A person who has your number may learn that it is registered with Whispaw.

Contact display names, ordering, selected pictures, picture alignment, and custom ignore recordings are stored in the local encrypted contact/message vault, not uploaded as part of contact matching. Pictures are selected by you and saved as resized copies without the original image metadata. Only the selected contact or image is imported; this does not give Whispaw a copy of your whole contacts list or photo library.

Whispers and custom ignore messages

When you record and send a Whisper, Whispaw stores an encrypted local recording and transfers it to the recipient over an encrypted WebRTC connection when both devices can connect. If the recipient is offline, the pending message stays on your phone and can retry later; there is no server audio inbox or automatic seven-day expiration for these pending clips. The recipient stores a local copy after delivery. Delivery signaling and status records are handled separately from the audio.

You can configure a contact’s automatic playback and whether their Whispers may interrupt other audio. Depending on your settings and the action you take, declining an unanswered call or leaving an unreplied Whisper can send that contact your saved ignore recording. This is a voice message to the other person, not just a sound played locally. A recipient can retain or record what you share; deleting your copy does not recall theirs.

Message abuse reports

If you choose Report Message on a received Whisper, the confirmation screen explains what will be sent. Whispaw receives your account identifier, the reported sender’s phone number, the message identifier, time, duration and audio fingerprint, plus your reason and any explanation you enter. The audio recording, contact names, contact photos and your other messages are not uploaded with a report. Reports are private from the reported sender and available to authorized reviewers. You can also choose to block the contact; submitting a report is not itself proof of abuse.

Reports and review notes are retained for up to 90 days, or deleted earlier when either related verified-number account is deleted. They are used for safety and support, not advertising or tracking. Review does not extend that retention period. If a report cannot be sent, the app shows an error rather than claiming it was received.

Location, directions, and audio tours

When you request directions, nearby information, neighborhood trivia, an audio tour, or music associated with your area, Whispaw processes precise or approximate location and the route or area context needed for that request. Background location is used only for an active experience you start or for low-power readiness you enable. Location is not sold or used for advertising.

Apple Music and playback

If you request location-based music, Whispaw uses MusicKit authorization and Apple Music catalog or playback information needed to find and play requested music. Whispaw may process track metadata and playback commands such as play, pause, save, and next. Apple handles your Apple Music account and subscription under Apple’s terms; Whispaw does not receive your Apple ID password.

AirPods motion and media controls

If enabled, compatible AirPods motion data is processed on the iPhone to recognize deliberate up-and-down or side-to-side gestures for trivia and playback controls. Raw head-motion samples are not uploaded for these controls. A resulting action, such as an answer in a live trivia session, may be sent to the service. AirPod presses and on-screen media controls may also be used for hands-free interaction.

Optional paired connection and recording transfers

If you choose to pair another device for enhanced assistance or supported audio experiences, Whispaw processes pairing identifiers, public encryption material, encrypted messages, push registrations, and connection status. Pairing records persist to support reconnection. Encrypted relay messages may be queued briefly when a device is unavailable; the relay does not have the paired devices’ content-decryption keys. Pairing is optional, and an unpaired iPhone can continue to use supported on-device experiences.

If you explicitly record audio for transfer to a paired device, the iPhone may upload encrypted temporary audio chunks and a transfer manifest to Cloudflare storage. Those chunks are separate from direct phone-to-phone Whispers. The receiving device decrypts the recording; temporary cloud chunks are deleted after verified ingestion or by expired-session cleanup. Pending recordings may remain on the phone for retry.

Collaborative audio

Whispaw processes caller and recipient identifiers, device and session identifiers, connection-negotiation information, status, and timing to connect calls. App-to-app calls and Whisper delivery between mutually saved, verified contacts try a direct WebRTC connection, with a TURN relay when needed to connect. Direct connections can expose your network IP address to the other participant. Connection services process network information even when they cannot read encrypted media.

Telnyx supports phone calling and associated communications services; LiveKit carries live audio rooms and streams. Ordinary calls and streams are not automatically saved as recordings by Whispaw. If you explicitly start a recording experience, that recording is retained and transferred as described above. Other participants can also record audio outside Whispaw’s control. Calls depend on network availability and are not an emergency service.

Device, notifications, and diagnostics

Whispaw and its providers process app-specific device identifiers, push tokens, network addresses, app and operating-system information, timestamps, connection state, performance measurements, and errors to deliver notifications, authenticate requests, troubleshoot failures, and prevent abuse. Local diagnostics, service logs, and provider telemetry have different storage and retention; not all diagnostics are transient. Identifiers and connection records may be linked to an account, device, or session.

When you visit this website, its hosting provider, Vercel, processes ordinary web-request information such as IP address, requested page, browser information, and request timing for delivery, security, and operation. If you email support, we receive your email address and the information you choose to send.

2. How information is used

• Provide requested spoken assistance, directions, tours, trivia, study, music, Whispers, and calls.
• Remember preferences and continue an experience the user started.
• Verify phone numbers, match saved contacts, enforce blocks, deliver messages, and secure connections.
• Detect abuse, diagnose failures, and maintain service reliability.
• Comply with law and enforce the Terms of Service.

3. When information is shared

Information is shared as needed for a feature you request, service operation, or legal requirements. This includes the recipient of a Whisper or call, other participants in a shared session, and a device you choose to pair. Providers include Apple for iOS, notifications, Speech, Maps, MusicKit, and Apple Music; public-information and search sources used for requested content; Cloudflare for account, signaling, relay, TURN, and temporary-transfer services; Telnyx for SMS verification and calling; LiveKit for live audio; and Vercel for this website. An optional model or transcription service receives the information needed for the request routed to it.

Telnyx may retain verification and communications records, including phone numbers, IP addresses, timestamps, duration, and completion status, for service operation, billing, security, and legal compliance. LiveKit may retain session, performance, and diagnostic metadata. These provider records are separate from Whisper audio stored on phones. Their retention depends on the service, configuration, contracts, and legal requirements; we do not promise that all provider records disappear when a session ends. See the Telnyx Privacy Policy, LiveKit Privacy Policy, and LiveKit Data Processing Addendum.

Further provider information is available in the Apple Privacy Policy, Cloudflare Privacy Policy, and Vercel Privacy Policy. A provider may act on our behalf or handle certain operational records under its own obligations.

Whispaw does not sell personal information and does not share personal information for cross-context behavioral advertising.

4. Storage, security, and retention

Protections include iOS Keychain and file protection, an encrypted local Whisper/contact vault, encrypted paired messages and recording chunks, and encrypted WebRTC transport. These protections do not make accounts anonymous or prevent a recipient from saving content. Different audio services have different encryption boundaries; we do not claim that every feature uses the same end-to-end encryption. No system is completely secure.

• Accounts and matching: verified numbers, account/device records, public keys, matching hashes, and block preferences remain to support the account. They currently have no automatic account-expiration period. Signing out revokes the current device’s access; it does not delete the account or its saved matching records.
• Verification and abuse prevention: verification challenges expire after five minutes. Short-lived security and rate-limit records expire according to their purpose, generally within a day; cleanup runs asynchronously. Telnyx keeps separate verification records under its policies.
• App-to-app call and Whisper-transfer signaling: active connection records support setup and delivery. Ended-session records are normally scheduled for cleanup after about 24 hours. Connection descriptions are removed on ending; transport-cleanup retries may retain other records longer.
• Paired relay: undelivered encrypted messages have a maximum ten-minute queue lifetime and are removed on delivery or expiry cleanup. Pairing and push-registration records are separate and may persist for reconnection.
• Temporary recording transfers: encrypted upload sessions expire within 24 hours. Deletion follows verified ingestion or scheduled expiry cleanup; expiry is not a guarantee of deletion at that exact instant.
• Gameplay and leaderboards: session, participant, answer, and score records can remain after a session ends. Recent events are capped, and replacing the broadcast session clears its stored session records. There is currently no automatic time-based deletion of an ended trivia session.
• On your devices: contacts, preferences, chat, Whisper recordings, and pending deliveries remain until removed or the relevant app data is deleted. Clearing chat does not necessarily erase the separate message vault. Supported device backups may preserve local data and vault keys; authentication keys tied to a particular device require new verification on a replacement phone.
• Operational records: service logs, provider telemetry, and support correspondence may remain for troubleshooting, security, service operation, or legal requirements. Retention varies by provider and configuration; these are not covered by the message-queue or call-signaling deadlines above.

Deleting the app does not delete server account records, another participant’s copy, device backups, or every Keychain entry. Location is used for requested experiences, not to build an advertising profile.

5. Your choices

You can decline optional permissions, turn Hands-Free off, disable gestures, stop a location or audio experience, change a contact’s playback settings, block a contact, or disconnect the optional relay. You can also manage microphone, location, motion, Apple Music, and notification access in iPhone Settings. Some features require their related permission.

In supported builds, Settings → Account → Delete Account removes your verified-number account and its related matching, connection and report records, then the Whisper vault and calling key on this phone. A confirmation explains the scope, and interrupted deletion can be retried. Sign-out is separate and does not delete the account. This account operation does not erase your iPhone address book, Apple Music, separate paired connection, guest gameplay records or unrelated settings. Removing an account cannot recall recordings already delivered to another person or backups outside our control. For other access, correction, or deletion requests, email whispawcat@gmail.com. We may need to verify that you control the account. Requests are subject to applicable law and necessary security or legal retention.

6. Children

Whispaw is not directed to children under 13. If you believe a child has provided personal information, contact us so the request can be reviewed.

7. International processing

Information may be processed in countries other than the one where you live. Availability depends on the regions supported by Apple and the other providers used for a requested feature.

8. Changes and contact

We may update this policy as the iPhone application changes. Material changes will be identified by a new effective date and, when appropriate, an in-app notice.

For privacy questions or requests, email whispawcat@gmail.com. Please include “Whispaw privacy request” and do not send passwords or private keys.