Privacy Policy

Last updated: November 2, 2026

Whispurr is a private, local-first communication and shared-memory app built and operated by WhispurrApp, LLC ("Whispurr", "we", "us", or "our"). Whispurr does not collect data from your use of the app. Your content stays on your devices and syncs directly with the devices you authorize. If you choose to enable an optional cloud service, its provider processes limited encrypted content and service metadata as described below. Contact cards and chat invites use a small, free inbox at the same provider that holds only end-to-end encrypted chat requests (section 2.7a). Whispurr does not receive your readable conversations or media.

We built Whispurr because private relationship data deserves to be treated with extraordinary care. Our guiding principle is simple: your conversations and memories stay encrypted on authorized devices and sync peer-to-peer with the devices you choose.

1. What we don't do

• You can use the core app without an email or password. If you enable an optional cloud service, its provider keeps records needed to run that service, such as account IDs, access permissions, and stored resources. These records may use IDs instead of your name, but the provider may still be able to link them to your account.
• We do not sell your data.
• We do not use third-party advertising or tracking SDKs.
• We do not use analytics services to profile your behavior.
• We do not share your data with data brokers.
• By default, records, messages, and media remain encrypted on your devices and paired devices. Optional cloud services retain only the end-to-end encrypted ciphertext you explicitly authorize for Courier. Contact-card inboxes hold only end-to-end encrypted chat requests addressed to your cards (section 2.7a).

2. How Whispurr stores and syncs your data

2.1 Cryptographic identity, without email sign-in

Whispurr's core app does not require an email, password, or username. The first time you open the app, it generates a private cryptographic seed on your device and shows you a 24-word recovery phrase derived from that seed. Keep it safe; it is recovery authority, not an automatic copy of your chats or keys stored only on a lost device. A surviving authorized device can approve device linking without disclosing the phrase. We never receive your phrase or plaintext conversation keys.

2.2 Nearby Bluetooth discovery and invitations

When you open Nearby Whispurr Users, your selected persona's name, color, and a small avatar preview are broadcast over Bluetooth to nearby devices. Public profile sharing stops when you close that view or put the app in the background. Nearby invitations use encrypted messages between temporary sessions; accepting an invitation creates an ordinary encrypted chat.

While that view is open, Whispurr also reads your phone's motion sensors on the device to recognise when you bump phones with someone. Raw motion data never leaves your device. When a bump is felt, only a short signature of it (its timing, strength, and shape) is sent, encrypted, to the nearby Whispurr users in that session, so the two phones that bumped can recognise each other. Motion readings are not stored, and the sensors stop when you close the view.

2.3 Records (encounters, activities, notes, profiles)

Records are stored in encrypted documents on your device. Each set of records is encrypted with AES-256-GCM, using a key available only to devices admitted to that conversation. Changes sync directly between authorized devices. If you explicitly enable Courier, its provider may temporarily retain encrypted changes so an offline member can receive them later; the encryption key never leaves admitted devices.

2.4 Photos, videos, and other media

Photos and videos are encrypted on your device with AES-256-GCM and stored as content-addressed blobs. The hash advertised to the network is the hash of the ciphertext; only devices that hold the namespace seed can decrypt the bytes. Bytes replicate peer-to-peer by default. If you explicitly enable Courier, Courier may temporarily store an encrypted copy so a member who is offline can download it later.

2.5 Messages with your partner

Chat messages flow through the same encrypted conversation as your shared records. Message changes are encrypted end-to-end and signed by an admitted installation. Whispurr does not use any third-party chat backend.

When you paste a web link into a message, your device loads that page once to build a preview (its title and a small image) and sends the preview inside the encrypted message. The website sees an ordinary request from your device; the people you chat with never contact it to display the preview. You can turn this off under Settings → Chats → Generate link previews.

2.5a Activity routes and location

Whispurr uses your device's location only for routes you choose to record. Nothing about your location is collected by us or shared automatically.

• Location access is requested "While Using the App". When you open the route recorder, the map shows where you are; recording starts only when you press Start, and location stops when you pause, finish, or close the recorder. If a recording continues while the app is in the background, iOS shows its location indicator. The compass on the recording map uses your device's heading only while that screen is open and is not saved.
• Until you finish, the recording stays on your device, encrypted with AES-256-GCM using a key derived from your account. It is deleted once the route is saved, or when you discard it.
• Privacy zones. You can mark places such as home or work. Before a route is shared, every point inside a zone, and any line passing through one, is removed, and the distance, times, and preview image are calculated only from what remains. Zones are kept in your encrypted account data and sync only to your own devices. A gap in a shared route can still show that you paused somewhere nearby.
• A finished route is shared only when you save it to an event or your entry on an event in a chat (or, for a route shared live, to that ride's event). It travels end-to-end encrypted like other media (section 2.4), and members of that chat can see where and when it was recorded. If you trim a route, the trimmed copy replaces the shared one.
• Live sharing. Sharing a route live is off unless you turn it on when you start recording (your choice is remembered for that chat), and you can turn it off at any time while recording. While it is on:
  • Members of that chat see your route and current position as you record. Other members can join your ride and share theirs the same way, and everyone on the ride sees each other.
  • Points are end-to-end encrypted and travel between chat members' devices, directly or through a relay server (section 2.11). Nothing is sent while nobody in the chat is watching. Points are never stored in the chat or on any server; a member's device holds them only while showing them, but anyone watching sees them.
  • The chat keeps the ride's event (its title, activity and start time) and each rider's status (live, paused, finished), but no location. A notification tells members that a ride started.
  • Privacy zones apply as they do to a saved route: nothing appears until you leave every zone, and inside one you show as paused. The pause, and when it happens, can still show that you are nearby. A zone you add while recording applies from then on; points already shared can't be recalled.
  • What you record while live sharing is off is never shared live, even if you turn it back on.
  • Live points are encrypted with a key every member of the chat holds, so someone who has left the chat may still be able to receive them if their copy of Whispurr keeps that key. Share live only in chats whose members, past and present, you trust with your location.
• Maps. Maps under routes are drawn by Apple Maps. To show a map, a device requests map images for the area on screen from Apple, so when anyone views a route on a map, Apple can learn the general area being viewed, but not the route line, its times, or who recorded it. When you finish a route, your device draws its preview image once, so the people you share it with see the preview without loading a map. Turn off Settings → Routes → Show map under routes to draw routes on a plain background without requesting maps from that device.
• Exporting a route as a GPX file happens only when you choose Export GPX, and the file goes wherever you send it.

2.5b Online status and connections

If a persona shares its online status (Persona Settings → Share online status, on by default), your devices tell the members of each of its chats when you are online and when you are typing. They also tell them how your device is connected to each other member of that chat: the kind of connection (direct, relay, nearby Wi-Fi or Bluetooth) and who runs the relay (Whispurr, n0 or another operator), never an IP address or any other network address. Members' devices use this to show who is online, when each person was last seen (worked out on the receiving device from when it last heard from them), and how members are connected in the chat's member list.

These updates are encrypted with a key derived from the chat, signed by the sending device, sent live between devices, and never stored in the chat. Someone who has left a chat may still be able to receive them if their copy of Whispurr keeps that key. Turning off Share online status stops your devices from sending them for that persona, and from receiving other members' updates.

2.6 Multi-device sync (your own devices)

An authorized device can approve linking another installation through Whispurr's device-linking flow. Linking transfers authorized operational capabilities without exporting the recovery seed. Account and conversation security rules govern which devices can sync; restoring historical data does not revive a revoked device or ended conversation membership.

2.7 Pairing in person

Nearby invitations and invitations into an existing chat are completed while both devices are open. The QR code carries your device's identifier, its relay address, and a one-time handshake token, plus its local network address unless Hide IP Address is on; it never contains your public IP address (section 2.11). After both sides confirm a shared fingerprint (shown as a sequence of emoji on both screens), each device agrees on the conversation key. From that point on, your records and chat replicate peer-to-peer between the paired devices.

2.7a Contact cards, chat invites, and chat requests

You can share a contact card for a persona (for example on a slide or badge), and Start a Chat shows a single-use invite card that expires after seven days. A card is a signed link or QR code containing the persona's display name, a network identifier for one of your devices (its device identifier and relay address, never its IP address), public keys, and the address of the card's inbox together with a key that lets holders add to it. It contains no avatar, recovery phrase, or chat key. Anyone who has a card can see that display name and can send you a chat request, so share cards only where you are comfortable doing so, and revoke a card in Share My Contact when you no longer want it used. A single-use invite stops working after its first use or expiry.

A chat request contains the sender's own contact card, an optional short note, and the key for a new conversation. It is encrypted end to end to your card and signed by the sender. Your device accepts or declines it; declining sends nothing back. Requests on your own single-use invites are accepted automatically, since you chose to show that invite. Chats started this way are not compared with emoji; you may verify in person later.

So that a request can arrive while you are offline, each card has a free inbox at the Whispurr-operated content-blind provider. Unlike Courier, it is opened automatically when you create a card, start a chat, or send your first chat request, and it involves no account or payment. The provider stores: an inbox identifier derived from a key, the inbox's public keys, encrypted requests (until your device reads them, and at most 30 days), and the push targets your devices registered for it. It never receives card keys, request contents, or the sender's identity. To limit abuse it processes request timing and size and counts requests per inbox and per sender network address; addresses are kept only as one-way hashes in hourly counters that are deleted within about two hours. An inbox is deleted when its card is revoked, used up, or expires, or after 90 days without your devices checking it.

If notifications are enabled, each installation registers one push target for its contact-card inboxes with the notification gateway (section 2.9), and a new request wakes your devices. The sender can include a lock-screen preview — their display name and the start of their note — encrypted to a key derived for your card; the provider, gateway, Apple, and Cloudflare cannot read it, and your device decrypts it only if "Show message previews" is on. Otherwise you see a generic alert.

2.8 Diagnostic information

Whispurr does not use Firebase Analytics, Crashlytics, or any third-party analytics or crash-reporting service. Apple may provide diagnostics under its standard "Share with App Developers" opt-in, which you control through iOS Settings → Privacy & Security → Analytics & Improvements. Optional cloud services also maintain limited operational records for delivery, abuse prevention and storage safety, as described below; these are not behavioral analytics.

2.9 Optional background notifications

If you enable device notifications for a chat that uses Courier, or for contact-card requests (section 2.7a), Whispurr sends that installation's Apple Push Notification service (APNs) token to a Whispurr-operated push gateway. The gateway stores the token encrypted at rest with a random target identifier, push platform and environment, expiration, and limited delivery/rate-limit history. It receives no chat identifier, sender, plaintext message text, media, Courier mailbox, or conversation key. A wake may carry a small message-preview ciphertext encrypted with a Conversation-epoch-derived key that is unavailable to Courier, the gateway, Apple, and Cloudflare. Courier receives only an unrelated random wake channel, that opaque ciphertext, and a capability that requests a “Whispurr — New message” fallback alert; it never receives the APNs token. Apple receives the device token, generic fallback, and opaque preview ciphertext in order to deliver the alert. If “Show message previews” is enabled on the receiving device, Whispurr's notification extension authenticates and decrypts the preview locally; otherwise the generic fallback remains. Request timing, volume, ciphertext size, network address, and delivery status may be processed for routing, reliability, and abuse prevention. Push targets expire after 30 days unless renewed and are revoked when notifications are disabled, the device token is rejected, or the target expires.

2.9a Voice calls

One-to-one voice calls travel between the two participants' devices over an end-to-end encrypted peer-to-peer connection: directly when possible, or through a relay that forwards the encrypted packets and cannot decrypt them (section 2.11). With Hide IP Address on, calls over the internet always go through Whispurr's relay. Call audio is never recorded or stored, and the microphone is used only while a call is ringing out or connected. On iPhone and iPad, calls appear in the system call interface (CallKit) but are excluded from the system Recents list.

To ring a device whose app is not running, Whispurr uses the same optional notification path as messages (section 2.9) with a separate Apple VoIP push token and push target. The call invitation — a random call identifier, the caller's display name, and a ring deadline — is encrypted with a Conversation-epoch-derived key unavailable to Courier, the gateway, Apple, and Cloudflare. Courier and the gateway learn only that a call-type wake occurred, its timing, and the opaque ciphertext; Apple additionally learns that a call push was delivered to the device. Call rings expire at their deadline and are never delivered late.

2.10 Cloud resource metadata and payments

When Courier is used, Whispurr and its hosting provider can associate a pseudonymous owner with encrypted resources, sizes, request timing, and retention deadlines. These associations support delivery, expiry, and abuse prevention and are not used for advertising. Routine diagnostics exclude content labels, decryption keys and capability URLs. See the cloud service policy for Courier limits.

Whispurr does not currently sell subscriptions or hosted cloud backup, and its services do not process payment information. If paid services are offered later, this policy will be updated before they are activated. Whispurr never collects Apple passwords or raw card credentials.

2.11 Connections and your IP address

Your devices reach the devices you chat with over the internet, over a shared local network, or over Bluetooth. Any internet connection shows your device's IP address, which can reveal your approximate location, to whatever is at the other end of it. Whispurr never includes your public IP address in profiles, contact cards, invites, or anything else it shares or syncs. QR codes and links for pairing and device linking may include your device's local network address (for example 192.168.1.20), so that devices on the same Wi-Fi network can connect without the internet. Members who share their online status also tell each other what kind of connection they have, but never an address (section 2.5b).

Under Settings → Transports you choose how your devices use the internet:

• Network (the default). Your devices connect to other devices through a relay server, then try to connect directly. A direct connection is faster, but the device at the other end, and so the person you are chatting with, can see your IP address. The relays are operated by Whispurr. Your devices also use relays operated by Number Zero (n0) while Whispurr's relays are unreachable, and to reach devices that use n0's relays, such as devices running older versions of Whispurr. So that other devices can find yours, each device also publishes its device identifier and relay address, but not its IP address, to an address lookup service operated by n0, and looks other devices up there. n0's servers see the IP address that these requests come from.
• Hide IP Address. Your devices make no direct internet connections to other devices: every internet connection to the people you chat with goes through Whispurr's relay, so they never see your IP address. Your devices do not use n0's relays or address lookup, even when Whispurr's relays are unreachable; until they are back, your devices connect only to nearby devices over Bluetooth and Wi-Fi. Nearby devices may see your local network address. Other services that you use, such as Courier, contact-card inboxes, notifications, Apple Maps, and websites loaded for link previews, see your IP address as described in their sections.
• Network off. Your devices connect only to nearby devices over Bluetooth and Wi-Fi.

Whispurr's relays currently run on a server we operate in the United States. A relay forwards end-to-end encrypted traffic between devices. To do that it processes your IP address, your device identifiers, and the timing and size of that traffic, but it cannot read your records, messages, calls, or media. Whispurr's relays do not log IP addresses or device identifiers, and hold connection details only in memory while a connection is open.

3. How we use the data

We cannot read your content. The app uses your recovery phrase only to derive encryption keys on your own devices. Peer-to-peer relays, contact-card inboxes, and the optional Courier provider receive only encrypted bytes and the limited metadata required to route, retain, verify, and delete them.

We do not use your data to train machine-learning models, to advertise to you, or to make automated decisions about you.

4. Third-party processors

Whispurr's peer-to-peer architecture means we use very few third-party processors. None of them are used for advertising or tracking.

• Apple Inc. — distributes the app through the App Store, delivers optional remote notifications containing a generic fallback and, when present, opaque preview ciphertext through APNs, delivers optional incoming-call pushes containing only an opaque call invitation, provides map images through Apple Maps when you view maps under routes (section 2.5a), and provides anonymous diagnostics if you opt in via iOS Settings. Apple privacy.
• Cloudflare, Inc. — hosts whispurr.app and the optional content-blind Courier provider, contact-card inboxes, and the separate notification gateway. When you use one of those services, Cloudflare processes its opaque ciphertext or encrypted APNs token and the metadata needed for storage, transfer, delivery, expiry, and abuse prevention. It may also log basic request metadata such as IP address and user agent. Cloudflare privacy.
• Number Zero (n0) — operates public relay servers, which your devices use while Whispurr's relays are unreachable or to reach devices that use n0's relays, and the address lookup service that your devices use to find each other in the default network mode (section 2.11). The relays forward encrypted traffic and cannot read your records, messages, or media; the lookup service receives device identifiers and relay addresses. Both see the IP address of the devices that connect to them. Neither is used while Hide IP Address is on.

5. Data storage and security

Records, messages, and media are stored on your device under the iOS sandbox, with Data Protection set to "Complete until first user authentication" so the underlying files are inaccessible until you unlock the phone after a reboot. Your recovery phrase and conversation capabilities are held in the iOS Keychain. Stored records and changes are encrypted with AES-256-GCM; media is encrypted before it is sent or stored. Connections between devices and relay servers are encrypted in transit.

No system can be guaranteed perfectly secure. Compromise of an authorized unlocked device or its keys can expose content available to that device; the recovery phrase is not an additional password required for every read. Protect both your devices and recovery material. Hosted cloud storage does not hold plaintext content keys.

6. Data retention and deletion

Data persists on authorized devices. Local removal and operating-system secure-store behavior are distinct; uninstalling is not a verified wipe of every credential, paired-device copy, or cloud resource. If you explicitly attach Courier to a chat, it may retain temporary encrypted changes and media, which expire under their accepted retention policy. Decryption happens on authorized devices, not at the provider. Whispurr does not offer hosted cloud backup: backups are kept on backup devices you link to your account. If you lose every copy of the necessary keys and content, we cannot reconstruct them. If you wish to remove your data from a paired partner's device, ask them to delete the relevant Connection from within the app.

For privacy-policy questions, email privacy@whispurr.app.

7. Children

The App Store assigns Whispurr an age rating based on its content. The rating varies by country or region; it is currently 4+ in most regions, with different ratings in some. This rating does not mean that Whispurr is designed specifically for children. Parents or guardians should decide whether the app is appropriate for a child.

8. Your rights

Most information you create in Whispurr is stored on your devices and the devices you authorize. It is end-to-end encrypted, so Whispurr cannot read, retrieve, correct, export, or delete that content for you. Use the app's controls to manage content on your devices; removing content from one device may not remove copies on other authorized devices.

Whispurr and its providers may process limited account and device identifiers and, if you use optional cloud services, service metadata. We do not have a support tool for looking up or editing your encrypted content. For questions about information processed by Whispurr, email privacy@whispurr.app and include your account ID and the service, if known. We may not be able to locate information using only your name or email address. Do not send your recovery phrase, encryption keys, or private conversation content. We will respond as required by applicable law.

9. International transfers

WhispurrApp, LLC is based in the United States. If you enable optional cloud services, account and device IDs, service metadata, and encrypted files may be processed by our service providers in the countries where they operate. Providers cannot decrypt your end-to-end encrypted conversations or media. Whispurr also syncs encrypted conversations, records, and media between the devices you authorize; if those devices are in different countries, that data may cross borders. Relays forward encrypted traffic between devices and process the routing information needed to deliver it (section 2.11); Whispurr's relays are currently in the United States, and n0's are in several countries. You can choose not to enable optional cloud services, but that does not prevent cross-border syncing with authorized devices in other countries. Data-protection laws may differ between these countries. For questions about providers used by an optional service, contact privacy@whispurr.app.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify you in the app. Your continued use of Whispurr after a change indicates your acceptance of the updated policy.

11. Contact us

Questions, concerns, or requests related to this policy can be sent to:

WhispurrApp, LLC
Email: privacy@whispurr.app