WhimziPrivacy
What we hold, and what we never will.
Last updated 27 August 2026.
Whimzi is built on one rule: a held answer is never revealed one-sidedly. Everything below follows from it. Every claim here is enforced in the database rather than promised in an app, and if one stops being true the code changed and this page changes with it.
Your own phone number
Your number is how you sign in, and there is no way around that being real data. When you enter it, it is sent to our SMS provider so they can deliver your code, and it is stored by our authentication provider so you can sign back in later. We do not use it to contact you for anything else, ever.
Separately, your phone turns your number into a matching code before anything about your circle is sent. That code, not your number, is what a friend’s phone recognises.
Your contacts
Your address book is never uploaded. When you pick someone, your phone converts their number into a matching code on the device and sends only that, together with the private name you use for them. Nothing at all is sent for people you skip. Their photo never leaves your phone. Every face you see in Whimzi is read from your own address book as you look at it.
Who you name
Every question tells you what will happen before you answer, never after.
- Private. The answer stays with you, and is never counted or shown to anyone.
- Delivered. Your name is shown to the person you chose. This is the only kind that reaches someone on its own.
- Held. Nothing is shown unless that person names you under the same question. If they never do, they never learn you did.
What other people can see of you
Your display name is shown to someone when you send them a delivered answer, when you reach out to them, when you choose to reveal yourself, and when you are in a match together. It never appears in a list, a search result, or to a stranger. There is no directory, so there is nothing to enumerate.
A profile photo is optional. If you add one it is stored privately, and it can only be loaded by people who can already see your name: a match, or someone you have told they were on your mind.
The count
You may be shown how many people have named you recently. It is never shown below three, because a count of one tells you exactly who. Private answers are never counted at all.
Messages
Once two people have matched they can talk. Messages are stored so they are there next time, readable by those two people and nobody else. A conversation cannot exist without a match, so nobody can message you out of the blue. Blocking closes the thread.
Notifications
One notification a day for the question, plus a notification when something actually arrives for you. We never send reminders to contact anyone, never mention how long it has been, and never count what you have not done.
How long we keep things
Your data is kept while your account exists. Matching codes and labels for people who never signed up are deleted after 18 months, because most of what this database holds describes people who are not our users, and keeping that indefinitely is not defensible.
Deleting everything
Delete your account from the You tab. Your circle, answers, matches, messages, photo and matching code are removed, and every one of those is enforced by the database rather than by a cleanup job. It cannot be recovered.
One thing is not ours to delete: the private name somebody else saved for you in their own circle belongs to them, not to you, and it is a label in their address book rather than anything you wrote. If they never join, it is deleted after 18 months under the retention rule above.
Who we share with
Nobody, for advertising or any other commercial purpose. We use service providers to run the product: hosting and database (Supabase), SMS delivery for your sign-in code (Twilio), and push notification delivery (Expo and the Apple and Google notification services). They process data on our instructions in order to provide those services.
Your rights
You can access, correct, export or delete your data. Deletion is in the app; for anything else write to [email protected] and we will respond within 30 days. If you are in South Africa you may complain to the Information Regulator; in the EU or UK, to your local data protection authority.
One honest limitation
Turning a phone number into a matching code protects it from being read directly, but there are not many possible phone numbers. Somebody who obtained our database and knew how the codes are made could work out which numbers are in it. We are working on closing that. We would rather tell you than let you assume otherwise.