Privacy Policy
Last updated: June 10, 2025
At whspr("we", "our", or "us"), your privacy is not an afterthought — it is foundational to everything we build. This Privacy Policy explains what data we collect, how we use it, and the choices you have.
1. Information We Collect
Account Information
When you register, we collect your username and optionally your email address and password hash. If you sign in via Google or GitHub OAuth, we receive your profile email, display name, and avatar URL from those providers. We never receive or store your OAuth provider password.
Messages
Messages sent through whspr are stored in our database and associated with the recipient's username. We do not collect the IP address, geographic location, device fingerprint, or any personally identifying information of message senders. Senders are never required to create an account or provide any information.
Usage Data
We use Google Analytics (via Google Tag Manager) to collect aggregated, anonymised metrics such as page views, session duration, and general geographic region. This data is used solely to improve whspr and does not identify individual users.
Cookies
We use a single secure, HttpOnly session cookie to keep you logged in. No third-party tracking cookies are set by whspr itself. Google Tag Manager may set analytics cookies as described in Google's own privacy policy.
2. How We Use Your Information
- To create and maintain your whspr account
- To deliver anonymous messages to the correct inbox
- To send transactional emails (welcome email, new message notifications) if you provide an email address and enable notifications
- To improve the product through aggregated analytics
- To respond to support requests or legal obligations
We never sell your personal data to any third party, and we do not use it for advertising purposes.
3. Data Sharing
We share data only in the following limited circumstances:
- Service Providers: Our infrastructure runs on MongoDB Atlas (database) and Vercel (hosting). These providers process data on our behalf under strict confidentiality obligations.
- Email Delivery: Transactional emails are sent via Gmail SMTP. Your email address is transmitted to Google solely to deliver those messages.
- Legal Requirements: We may disclose information if required by law, court order, or to protect the rights, property, or safety of whspr, its users, or the public.
4. Data Retention
Your account data and messages are retained for as long as your account is active. If you delete your account, all associated messages, profile links, and session data are permanently deleted within 30 days. You may request early deletion by contacting us.
5. Your Rights
Depending on your jurisdiction, you may have rights including:
- Access: Request a copy of your personal data
- Correction: Update inaccurate data through your account settings
- Deletion: Request permanent deletion of your account and all associated data
- Portability: Request your data in a machine-readable format
- Objection: Object to processing of your data
To exercise any of these rights, contact us at privacy@whspr.in.
6. Security
We employ industry-standard security practices including encrypted data transmission (TLS/HTTPS), hashed passwords (no plaintext storage), and access controls. For a full overview, please see our Security Policy.
7. Children's Privacy
whspr is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
8. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of whspr after changes constitutes acceptance of the revised policy.
9. Contact
Questions or concerns about this Privacy Policy? Reach us at privacy@whspr.in.