Privacy Policy

Last updated: October 22, 2026

Whispurr is a private, local-first communication and shared-memory app built and operated by WhispurrApp, LLC ("Whispurr", "we", "us", or "our"). Whispurr does not collect data from your use of the app. Your content stays on your devices and syncs directly with the devices you authorize. If you choose to enable an optional cloud service, its provider processes limited encrypted content and service metadata as described below. Contact cards and chat invites use a small, free inbox at the same provider that holds only end-to-end encrypted chat requests (section 2.7a). Whispurr does not receive your readable conversations or media.

We built Whispurr because private relationship data deserves to be treated with extraordinary care. Our guiding principle is simple: your conversations and memories stay encrypted on authorized devices and sync peer-to-peer with the devices you choose.

1. What we don't do

• You can use the core app without an email or password. If you enable an optional cloud service, its provider keeps records needed to run and bill that service, such as account IDs, access permissions, stored resources, and billing details. These records may use IDs instead of your name, but the provider may still be able to link them to your account.
• We do not sell your data.
• We do not use third-party advertising or tracking SDKs.
• We do not use analytics services to profile your behavior.
• We do not share your data with data brokers.
• By default, records, messages, and media remain encrypted on your devices and paired devices. Optional cloud services retain only the end-to-end encrypted ciphertext you explicitly authorize for Backup or Courier. Contact-card inboxes hold only end-to-end encrypted chat requests addressed to your cards (section 2.7a).

2. How Whispurr stores and syncs your data

2.1 Cryptographic identity, without email sign-in

Whispurr's core app does not require an email, password, or username. The first time you open the app, it generates a private cryptographic seed on your device and shows you a 24-word recovery phrase derived from that seed. Keep it safe; it is recovery authority, not an automatic copy of your chats or keys stored only on a lost device. A surviving authorized device can approve device linking without disclosing the phrase. We never receive your phrase or plaintext conversation keys.

2.2 Nearby Bluetooth discovery and invitations

When you open Nearby Whispurr Users, your selected persona's name, color, and a small avatar preview are broadcast over Bluetooth to nearby devices. Public profile sharing stops when you close that view or put the app in the background. Nearby invitations use encrypted messages between temporary sessions; accepting an invitation creates an ordinary encrypted chat.

2.3 Records (encounters, activities, notes, profiles)

Records are stored in encrypted documents on your device. Each set of records is encrypted with AES-256-GCM, using a key available only to devices admitted to that conversation. Changes sync directly between authorized devices. If you explicitly enable Courier, its provider may temporarily retain encrypted changes so an offline member can receive them later; the encryption key never leaves admitted devices.

2.4 Photos, videos, and other media

Photos and videos are encrypted on your device with AES-256-GCM and stored as content-addressed blobs. The hash advertised to the network is the hash of the ciphertext; only devices that hold the namespace seed can decrypt the bytes. Bytes replicate peer-to-peer by default. If you explicitly enable Courier, Courier may temporarily store an encrypted copy so a member who is offline can download it later.

2.5 Messages with your partner

Chat messages flow through the same encrypted conversation as your shared records. Message changes are encrypted end-to-end and signed by an admitted installation. Whispurr does not use any third-party chat backend.

When you paste a web link into a message, your device loads that page once to build a preview (its title and a small image) and sends the preview inside the encrypted message. The website sees an ordinary request from your device; the people you chat with never contact it to display the preview. You can turn this off under Settings → Chats → Generate link previews.

2.6 Multi-device sync (your own devices)

An authorized device can approve linking another installation through Whispurr's device-linking flow. Linking transfers authorized operational capabilities without exporting the recovery seed. Account and conversation security rules govern which devices can sync; restoring historical data does not revive a revoked device or ended conversation membership.

2.7 Pairing in person

Nearby invitations and invitations into an existing chat are completed while both devices are open. The QR code carries a network address and a one-time handshake token. After both sides confirm a shared fingerprint (shown as a sequence of emoji on both screens), each device agrees on the conversation key. From that point on, your records and chat replicate peer-to-peer between the paired devices.

2.7a Contact cards, chat invites, and chat requests

You can share a contact card for a persona (for example on a slide or badge), and Start a Chat shows a single-use invite card that expires after seven days. A card is a signed link or QR code containing the persona's display name, a network identifier for one of your devices, public keys, and the address of the card's inbox together with a key that lets holders add to it. It contains no avatar, recovery phrase, or chat key. Anyone who has a card can see that display name and can send you a chat request, so share cards only where you are comfortable doing so, and revoke a card in Share My Contact when you no longer want it used. A single-use invite stops working after its first use or expiry.

A chat request contains the sender's own contact card, an optional short note, and the key for a new conversation. It is encrypted end to end to your card and signed by the sender. Your device accepts or declines it; declining sends nothing back. Requests on your own single-use invites are accepted automatically, since you chose to show that invite. Chats started this way are not compared with emoji; you may verify in person later.

So that a request can arrive while you are offline, each card has a free inbox at the Whispurr-operated content-blind provider. Unlike Backup and Courier, it is opened automatically when you create a card, start a chat, or send your first chat request, and it involves no account or payment. The provider stores: an inbox identifier derived from a key, the inbox's public keys, encrypted requests (until your device reads them, and at most 30 days), and the push targets your devices registered for it. It never receives card keys, request contents, or the sender's identity. To limit abuse it processes request timing and size and counts requests per inbox and per sender network address; addresses are kept only as one-way hashes in hourly counters that are deleted within about two hours. An inbox is deleted when its card is revoked, used up, or expires, or after 90 days without your devices checking it.

If notifications are enabled, each installation registers one push target for its contact-card inboxes with the notification gateway (section 2.9), and a new request wakes your devices. The sender can include a lock-screen preview — their display name and the start of their note — encrypted to a key derived for your card; the provider, gateway, Apple, and Cloudflare cannot read it, and your device decrypts it only if "Show message previews" is on. Otherwise you see a generic alert.

2.8 Diagnostic information

Whispurr does not use Firebase Analytics, Crashlytics, or any third-party analytics or crash-reporting service. Apple may provide diagnostics under its standard "Share with App Developers" opt-in, which you control through iOS Settings → Privacy & Security → Analytics & Improvements. Optional cloud services also maintain limited operational records for delivery, billing reconciliation, abuse prevention and storage safety, as described below; these are not behavioral analytics.

2.9 Optional background notifications

If you enable device notifications for a chat that uses Courier, or for contact-card requests (section 2.7a), Whispurr sends that installation's Apple Push Notification service (APNs) token to a Whispurr-operated push gateway. The gateway stores the token encrypted at rest with a random target identifier, push platform and environment, expiration, and limited delivery/rate-limit history. It receives no chat identifier, sender, plaintext message text, media, Courier mailbox, or conversation key. A wake may carry a small message-preview ciphertext encrypted with a Conversation-epoch-derived key that is unavailable to Courier, the gateway, Apple, and Cloudflare. Courier receives only an unrelated random wake channel, that opaque ciphertext, and a capability that requests a “Whispurr — New message” fallback alert; it never receives the APNs token. Apple receives the device token, generic fallback, and opaque preview ciphertext in order to deliver the alert. If “Show message previews” is enabled on the receiving device, Whispurr's notification extension authenticates and decrypts the preview locally; otherwise the generic fallback remains. Request timing, volume, ciphertext size, network address, and delivery status may be processed for routing, reliability, and abuse prevention. Push targets expire after 30 days unless renewed and are revoked when notifications are disabled, the device token is rejected, or the target expires.

2.9a Voice calls

One-to-one voice calls travel directly between the two participants' devices over an end-to-end encrypted peer-to-peer connection. When no direct path exists, an iroh relay may forward the encrypted packets; it cannot decrypt them. Call audio is never recorded or stored, and the microphone is used only while a call is ringing out or connected. On iPhone and iPad, calls appear in the system call interface (CallKit) but are excluded from the system Recents list.

To ring a device whose app is not running, Whispurr uses the same optional notification path as messages (section 2.9) with a separate Apple VoIP push token and push target. The call invitation — a random call identifier, the caller's display name, and a ring deadline — is encrypted with a Conversation-epoch-derived key unavailable to Courier, the gateway, Apple, and Cloudflare. Courier and the gateway learn only that a call-type wake occurred, its timing, and the opaque ciphertext; Apple additionally learns that a call push was delivered to the device. Call rings expire at their deadline and are never delivered late.

2.10 Projecting media to a paired device

Whispurr can stream your photos to a paired "Whispurr Projector" app running on another device (typically a TV-connected computer in your home). The stream is point-to-point and ephemeral — nothing is stored at our end.

• The projector displays a QR code that encodes only a public network address. Your phone scans it to start the connection.
• Photos are decrypted only on your phone, then sent through an encrypted connection to the projector. If your devices cannot connect directly, relay servers operated by Number Zero (n0) may forward encrypted data. Those servers cannot read your photos.
• Once the projector window is closed (or the session is stopped from your phone), the connection ends. No images are persisted on the projector unless you explicitly save them there.

2.11 Optional cloud billing and resource metadata

When cloud services are used, Whispurr and its hosting provider can associate a pseudonymous owner and billing account with encrypted resources, sizes, reference relationships, request timing, quota, and retention deadlines. Apple subscription verification uses an opaque account-binding token, product and transaction records, signed payment evidence, and renewal or revocation status. This supports service admission, duplicate-payment prevention, reconciliation, support, and retention; it does not give Apple chat labels, storage catalogs, the recovery phrase, or content keys. These metadata associations are not anonymous payment and are not used for advertising.

Routine diagnostics exclude raw payment evidence, content labels, decryption keys and capability URLs. Bounded notification/reconciliation journals support retries and service monitoring. Billing records and encrypted resources have separate retention needs; uninstalling the app does not erase those records or cancel a subscription. See the cloud service policy for pre-release limits and remaining launch conditions. Additional payment channels would require updated disclosures before activation; Whispurr does not collect Apple passwords or raw card credentials.

3. How we use the data

We cannot read your content. The app uses your recovery phrase only to derive encryption keys on your own devices. Peer-to-peer relays, contact-card inboxes, and any optional Backup or Courier provider receive only encrypted bytes and the limited metadata required to route, retain, verify, and delete them.

We do not use your data to train machine-learning models, to advertise to you, or to make automated decisions about you.

4. Third-party processors

Whispurr's peer-to-peer architecture means we use very few third-party processors. None of them are used for advertising or tracking.

• Apple Inc. — distributes the app through the App Store, delivers optional remote notifications containing a generic fallback and, when present, opaque preview ciphertext through APNs, delivers optional incoming-call pushes containing only an opaque call invitation, and provides anonymous diagnostics if you opt in via iOS Settings. For Apple-billed subscriptions, Apple also processes payment, renewal and refund information and provides the verification evidence needed to operate cloud access. Apple privacy.
• Cloudflare, Inc. — hosts whispurr.app and the optional content-blind Backup and Courier provider, contact-card inboxes, and the separate notification gateway. When you use one of those services, Cloudflare processes its opaque ciphertext or encrypted APNs token and the metadata needed for storage, transfer, delivery, expiry, and abuse prevention. It may also log basic request metadata such as IP address and user agent. Cloudflare privacy.
• Number Zero (n0) — operates relay servers that help your devices connect when a direct connection is not possible. The servers forward encrypted traffic and see the network details needed to route it, but cannot read your records, messages, or media.

5. Data storage and security

Records, messages, and media are stored on your device under the iOS sandbox, with Data Protection set to "Complete until first user authentication" so the underlying files are inaccessible until you unlock the phone after a reboot. Your recovery phrase and conversation capabilities are held in the iOS Keychain. Stored records and changes are encrypted with AES-256-GCM; media is encrypted before it is sent or stored. Connections between devices and relay servers are encrypted in transit.

No system can be guaranteed perfectly secure. Compromise of an authorized unlocked device or its keys can expose content available to that device; the recovery phrase is not an additional password required for every read. Protect both your devices and recovery material. Hosted cloud storage does not hold plaintext content keys.

6. Data retention and deletion

Data persists on authorized devices. Local removal and operating-system secure-store behavior are distinct; uninstalling is not a verified wipe of every credential, paired-device copy, or cloud resource. If you explicitly attach an optional cloud service, it retains only the data for the service you select: Backup may retain opaque backup objects, while Courier may retain temporary encrypted changes and media. Enabling Courier does not enable Backup. Decryption happens on authorized devices, not at the provider. Current media-only backup also depends on surviving chat information and service credentials; a phrase or payment receipt alone is not a guarantee of recovery after losing all installations. Courier deliveries expire under their accepted retention policy. If you lose every copy of the necessary keys and content, we cannot reconstruct them. If you wish to remove your data from a paired partner's device, ask them to delete the relevant Connection from within the app.

For privacy-policy questions, email privacy@whispurr.app.

7. Children

The App Store assigns Whispurr an age rating based on its content. The rating varies by country or region; it is currently 4+ in most regions, with different ratings in some. This rating does not mean that Whispurr is designed specifically for children. Parents or guardians should decide whether the app is appropriate for a child.

8. Your rights

Most information you create in Whispurr is stored on your devices and the devices you authorize. It is end-to-end encrypted, so Whispurr cannot read, retrieve, correct, export, or delete that content for you. Use the app's controls to manage content on your devices; removing content from one device may not remove copies on other authorized devices.

Whispurr and its providers may process limited account and device identifiers and, if you use optional cloud services, service and billing metadata. We do not have a support tool for looking up or editing your encrypted content. For questions about information processed by Whispurr, email privacy@whispurr.app and include your account ID and the service, if known. We may not be able to locate information using only your name or email address. Do not send your recovery phrase, encryption keys, or private conversation content. We will respond as required by applicable law.

9. International transfers

WhispurrApp, LLC is based in the United States. If you enable optional cloud services, account and device IDs, billing and service metadata, and encrypted files may be processed by our service providers in the countries where they operate. Providers cannot decrypt your end-to-end encrypted conversations or media. Whispurr also syncs encrypted conversations, records, and media between the devices you authorize; if those devices are in different countries, that data may cross borders. When devices cannot connect directly, network relays may forward encrypted traffic and process the routing information needed to deliver it. You can choose not to enable optional cloud services, but that does not prevent cross-border syncing with authorized devices in other countries. Data-protection laws may differ between these countries. For questions about providers used by an optional service, contact privacy@whispurr.app.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify you in the app. Your continued use of Whispurr after a change indicates your acceptance of the updated policy.

11. Contact us

Questions, concerns, or requests related to this policy can be sent to:

WhispurrApp, LLC
Email: privacy@whispurr.app