Cloud service policy

Release candidate: September 27, 2026

Pre-release draft, not an announcement that paid services are available. This policy needs operator and legal review before production checkout is enabled. Full chat recovery, Courier traffic allowances, and the deletion/metadata retention schedule are not yet approved launch benefits. Sandbox purchases are for testing.

What stays free and offline

Personas, local history, encryption, direct chats and calls, and linked-device sync do not require a Plus subscription. Local features do not depend on a billing API being available. Network communication and cloud services need connectivity.

One owner, one backup storage pool

The proposed Plus allowance is 50 GB: exactly 50,000,000,000 ciphertext bytes shared across one Whispurr owner's selected backups, personas, and authorized linked devices. Monthly and annual billing provide the same allowance; overlapping subscriptions do not multiply it. Each chat requires separate service consent. Buying Plus does not upload chats.

Stored ciphertext and retained history consume the pool. Repeated references to the same stored object within one attachment count once; separately stored copies in different attachments may count separately. In-flight upload reservations temporarily reduce available space. Internal replicas, fenced abandoned uploads, and deletion/quarantine cleanup overhead are operator costs, not extra customer storage.

Reaching the allowance stops new allocations; it does not authorize erasing the last valid backup to make room for an unfinished replacement. Retained version history shares this allowance. A final history-pruning policy is required before complete chat backup launches.

Courier is delivery, not backup

Courier temporarily stores encrypted changes and media for offline delivery. The current implementation has a 1 GiB (1,073,741,824-byte) per-mailbox queue limit, a 256 KiB (262,144-byte) envelope limit, and at most 64 envelopes per deposit. Request-size limits also apply. Retention is at most 30 days, may be shorter for a configured mailbox, and accepted deliveries may be removed earlier after acknowledgement or authorized pruning.

These are technical ceilings, not an unlimited delivery promise or a defined basic/Plus traffic allowance. Account-wide sponsorship, transfer/rate limits, and the free allowance must be validated and published before enhanced Courier is sold.

Payment, cancellation, and retention

The proposed US prices are $3.99 per month or $39.99 per year. The purchase sheet supplies the actual localized full price and billing period; no trial is promised. Apple subscriptions renew automatically unless canceled through Apple subscription settings. Use Restore Purchases or retry a pending activation rather than buying again. Management and refunds stay with the original payment provider; cancellation does not erase local data.

The proposed post-paid backup retrieval window is at least 30 days after confirmed paid access ends, and never shorter than a longer issued storage commitment. New paid uploads stop when verified paid access ends. Retrieval still requires valid Whispurr credentials and available encrypted resources. Verification outages are uncertainty, not proof of cancellation or permission to delete backups. Renewal cannot resurrect physically deleted data.

Pausing backup, leaving a chat, removing the app, deleting cloud data, and canceling a subscription are different actions. Wiping or uninstalling does not cancel payment or delete remote resources. Cloud deletion requires separate authorized confirmation; an offline request is not confirmation of remote deletion. A physical purge and billing metadata retention schedule must be approved before launch.

Recovery limits and privacy

Current media repair is not complete chat or all-devices-lost recovery. It depends on surviving chat information and credentials. Keep your recovery phrase safe, but do not assume the phrase alone can recover current media-only backups after every installation is lost. Complete recovery will require a verified discoverable checkpoint, compatible keys, and the documented provider location. Never discard your only usable copy based on a payment confirmation or a blob-upload receipt.

Payment history is not a decryption key or authority to read, move, or delete another owner's resources. The operator can associate pseudonymous billing records with encrypted resource sizes, reference relationships, timing, and retention. It cannot read encrypted chat content. See the Privacy Policy.

The Apple standard app license applies where applicable. This service policy describes the proposed cloud offering; it does not remove statutory consumer rights.

Questions: support@whispurr.app.