Privacy Policy

Last updated: August 19, 2026

Whispurr is a private, local-first communication and shared-memory app built and operated by WhispurrApp, LLC ("Whispurr", "we", "us", or "our"). This policy explains what data Whispurr collects when you use the app, why we collect it, and what we do — and don't — do with it.

We built Whispurr because private relationship data deserves to be treated with extraordinary care. Our guiding principle is simple: your conversations and memories stay encrypted on authorized devices and sync peer-to-peer with the devices you choose.

1. What we don't do

• We do not have user accounts, email addresses, or passwords.
• We do not sell your data.
• We do not use third-party advertising or tracking SDKs.
• We do not use analytics services to profile your behavior.
• We do not share your data with data brokers.
• By default, records, messages, and media remain encrypted on your devices and paired devices. Optional cloud services retain only the end-to-end encrypted ciphertext you explicitly authorize for Backup or Courier.

2. How Whispurr stores and syncs your data

2.1 No accounts, no sign-in

Whispurr does not have user accounts. There is no email, password, or username. The first time you open the app, it generates a private cryptographic seed on your device and shows you a 24-word recovery phrase derived from that seed. Write it down somewhere safe — it is the only way to access your data from another device or recover it if you lose this one. We never see it.

2.2 Records (encounters, activities, notes, profiles)

Records are stored in encrypted Automerge documents on your device. Each repository is encrypted with AES-256-GCM using a key derived from its conversation capability. Changes replicate over authenticated iroh gossip, with direct peer synchronization used for bootstrap and repair. The capability lives only on admitted devices. If you explicitly enable Courier, its content-blind provider may temporarily retain encrypted changes so an offline member can receive them later; the conversation capability never leaves admitted devices.

2.3 Photos, videos, and other media

Photos and videos are encrypted on your device with AES-256-GCM and stored as content-addressed blobs using iroh-blobs. The hash advertised to the network is the hash of the ciphertext; only devices that hold the namespace seed can decrypt the bytes. Bytes replicate peer-to-peer by default. If you explicitly enable Courier, the exact encrypted iroh blob may also be retained temporarily in Courier's scoped object-storage lane so an offline member can retrieve it later.

2.4 Messages with your partner

Chat messages flow through the same encrypted Automerge conversation as your shared records. Message changes are encrypted end-to-end and signed by an admitted installation. Whispurr does not use Stream Chat, Sendbird, or any other third-party chat backend.

2.5 Multi-device sync (your own devices)

To add a second device to your account (e.g. an iPad alongside your iPhone), open the new device, choose Settings → Add this device, and type the 24-word recovery phrase from your primary device. The second device derives the same seed and joins your peer-to-peer sync. Your partner's device is not involved in this step. We cannot link or unlink your devices — that authority belongs entirely to whoever holds the recovery phrase.

2.6 Pairing with a partner

Pairing is initiated by scanning a QR code shown by one device with the other. The QR code carries an iroh network address and a one-time handshake token. After both sides confirm a shared fingerprint (shown as a sequence of emoji on both screens), each device agrees on the partner-shared namespace seed. From that point on, your records and chat replicate peer-to-peer between the paired devices.

2.7 Diagnostic information

Whispurr does not use Firebase Analytics, Crashlytics, or any third-party analytics or crash-reporting service. The only diagnostics you may see are those provided by Apple's standard "Share with App Developers" opt-in, which you control through iOS Settings → Privacy & Security → Analytics & Improvements.

2.8 Optional background notifications

If you enable device notifications for a chat that uses Courier, Whispurr sends that installation's Apple Push Notification service (APNs) token to a Whispurr-operated push gateway. The gateway stores the token encrypted at rest with a random target identifier, push platform and environment, expiration, and limited delivery/rate-limit history. It receives no chat identifier, sender, plaintext message text, media, Courier mailbox, or conversation key. A wake may carry a small message-preview ciphertext encrypted with a Conversation-epoch-derived key that is unavailable to Courier, the gateway, Apple, and Cloudflare. Courier receives only an unrelated random wake channel, that opaque ciphertext, and a capability that requests a “Whispurr — New message” fallback alert; it never receives the APNs token. Apple receives the device token, generic fallback, and opaque preview ciphertext in order to deliver the alert. If “Show message previews” is enabled on the receiving device, Whispurr's notification extension authenticates and decrypts the preview locally; otherwise the generic fallback remains. Request timing, volume, ciphertext size, network address, and delivery status may be processed for routing, reliability, and abuse prevention. Push targets expire after 30 days unless renewed and are revoked when notifications are disabled, the device token is rejected, or the target expires.

2.9 Projecting media to a paired device

Whispurr can stream your photos to a paired "Whispurr Projector" app running on another device (typically a TV-connected computer in your home). The stream is point-to-point and ephemeral — nothing is stored at our end.

• The projector displays a QR code that encodes only a public network address. Your phone scans it to start the connection.
• Photos are decrypted only on your phone, then transmitted over an iroh QUIC session (TLS 1.3) directly to the projector. The iroh relay servers operated by Number Zero (n0) are used to bootstrap the connection and, when direct hole-punching across NAT is not possible, to forward already-encrypted bytes that they cannot read.
• Once the projector window is closed (or the session is stopped from your phone), the connection ends. No images are persisted on the projector unless you explicitly save them there.

3. How we use the data

We cannot read your content. The app uses your recovery phrase only to derive encryption keys on your own devices. Peer-to-peer relays and any optional Backup or Courier provider receive only encrypted bytes and the limited metadata required to route, retain, verify, and delete them.

We do not use your data to train machine-learning models, to advertise to you, or to make automated decisions about you.

4. Third-party processors

Whispurr's peer-to-peer architecture means we use very few third-party processors. None of them are used for advertising or tracking.

• Apple Inc. — distributes the app through the App Store, delivers optional remote notifications containing a generic fallback and, when present, opaque preview ciphertext through APNs, and provides anonymous diagnostics if you opt in via iOS Settings. Apple privacy.
• Cloudflare, Inc. — hosts whispurr.app and the optional content-blind Backup and Courier provider and the separate notification gateway. If you enable one of those services, Cloudflare processes its opaque ciphertext or encrypted APNs token and the metadata needed for storage, transfer, delivery, expiry, and abuse prevention. It may also log basic request metadata such as IP address and user agent. Cloudflare privacy.
• Number Zero (n0) — operates the public iroh relay network used to bootstrap peer-to-peer connections and, when direct connectivity across NAT cannot be established, to forward already-encrypted traffic between you and your partner or projector. n0 sees the network metadata required to route traffic; it cannot read your records, messages, or media. See the iroh project.

Whispurr no longer uses Google Firebase Authentication or GetStream Chat. Default synchronization uses encrypted Automerge-over-iroh-gossip state and iroh-blobs media transfer. Cloudflare R2 is used only when you explicitly enable Backup or Courier's temporary encrypted-media relay.

5. Data storage and security

Records, messages, and media are stored on your device under the iOS sandbox, with Data Protection set to "Complete until first user authentication" so the underlying files are inaccessible until you unlock the phone after a reboot. Your recovery phrase and conversation capabilities are held in the iOS Keychain. Automerge repository bytes and changes are encrypted with AES-256-GCM; every media byte sent to iroh-blobs is encrypted before the hash is computed. Network traffic between peers and the iroh relays uses QUIC with TLS 1.3.

No system can be guaranteed perfectly secure. Whispurr is designed so that an attacker would need both physical access to one of your unlocked devices and the recovery phrase to read your intimate content — there is no server-side trove of readable content to compromise.

6. Data retention and deletion

Data persists on the devices that hold the namespace seed. Deleting Whispurr from a device deletes the local copy. If you explicitly attach an optional cloud service, it retains only the data for the service you select: Backup may retain opaque backup objects, while Courier may retain temporary encrypted changes and media. Enabling Courier does not enable Backup. Neither Whispurr nor the provider can read or restore this ciphertext without your recovery credentials. Courier deliveries expire under the provider retention policy. If you lose every authorized device and your recovery phrase, the data is unrecoverable. If you wish to remove your data from a paired partner's device, ask them to delete the relevant Connection from within the app.

For privacy-policy questions, email privacy@whispurr.app.

7. Children

Whispurr is not directed at children. The app is rated 17+/18+ and is not intended for use by anyone under the age of 18 (or the equivalent age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact privacy@whispurr.app and we will delete it.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your account and associated personal information.
• Object to or restrict certain processing of your data.
• Receive a copy of your personal information in a portable format.
• Lodge a complaint with a data protection authority.

To exercise any of these rights, email privacy@whispurr.app. We will respond within 30 days.

9. International transfers

Whispurr is operated from the United States. By using Whispurr, you understand that your information may be processed in the United States and other countries that may have different data-protection laws than your country of residence.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify you in the app. Your continued use of Whispurr after a change indicates your acceptance of the updated policy.

11. Contact us

Questions, concerns, or requests related to this policy can be sent to:

WhispurrApp, LLC
Email: privacy@whispurr.app