WhimziPrivacy
What we hold, and what we never will.
Last updated 30 August 2026.
Whimzi is built on one rule: a held answer never reveals who is behind it without a mutual match or that person choosing to reveal. Everything below follows from it. Every claim here is enforced in the database rather than promised in an app, and if one stops being true the code changed and this page changes with it.
Your own phone number
Your number is how you sign in, and there is no way around that being real data. When you enter it, it is sent to our SMS provider so they can deliver your code, and it is stored by our authentication provider so you can sign back in later. We do not use it to contact you for anything else, ever.
Separately, your phone turns your number into a matching code before anything about your circle is sent. That code, not your number, is what a friend’s phone recognises.
Your contacts
Your address book is never uploaded. When you pick someone, your phone converts their number into a matching code on the device and sends only that, together with the private name you use for them. Nothing at all is sent for people you skip. Their photo never leaves your phone. Every face you see in Whimzi is read from your own address book as you look at it.
If you choose Select all, you are choosing to let your circle follow your address book. While contact permission remains available, new contacts are periodically added using the same matching code process. You can untick anyone to stop following your address book. Contacts are never removed automatically.
Who you name
Every question tells you what will happen before you answer, never after.
- Gift. Your name is shown to the person you chose. A gift may come from a one way daily question or a card you deliberately send. Nothing is expected back.
- Mystery. Your identity stays hidden unless that person names you under the same question, or asks who and you choose to reveal yourself. You can always stay a mystery.
What other people can see of you
Your display name is shown to someone when you send them a gift, when you choose to reveal yourself, and when you are in a match together. It never appears in a list, a search result, or to a stranger. There is no directory, so there is nothing to enumerate.
A profile photo is optional. If you add one it is stored privately. It can be loaded only through an established connection: you both have each other in your circles, you matched, or you sent that person a gift. It is never available through a public profile or search.
The count
Mystery may show unresolved anonymous answers addressed to you. Nothing is shown until at least three different people are behind the anonymous answers, because one anonymous card can still identify its sender. Gifts are never included in that anonymous count.
Messages
Once two people have matched they can talk. Messages are stored so they are there next time, readable by those two people and nobody else. A conversation cannot exist without a match, so nobody can message you out of the blue. Blocking closes the thread.
Notifications
You can receive the daily question and notifications for gifts, acknowledgements, matches, messages, Mystery becoming safe to show, and requests asking whether you want to reveal yourself. We never send reminders to contact anyone or mention how long it has been.
How long we keep things
Your account data and the answers you create are kept while your account exists. Matching codes, private labels and unanswered signals linked to a number with no account are deleted after 18 months. Most of what this database holds describes people who may not use Whimzi, and keeping that indefinitely is not defensible.
Deleting everything
Delete your account from the You tab. Your circle, the answers you wrote, matches, messages, profile, photo and matching code are removed. The account cannot be recovered.
Things another person created remain theirs: the private label they use for your number and an answer they addressed to it. Once no account is linked to that number, those records fall under the 18 month retention rule above.
Who we share with
Nobody, for advertising or any other commercial purpose. We use service providers to run the product: hosting and database (Supabase), SMS delivery for your sign-in code (Twilio), and push notification delivery (Expo and the Apple and Google notification services). They process data on our instructions in order to provide those services.
Your rights
You can access, correct, export or delete your data. Deletion is in the app; for anything else write to hello@whimzi.live and we will respond within 30 days. If you are in South Africa you may complain to the Information Regulator; in the EU or UK, to your local data protection authority.
One honest limitation
Turning a phone number into a matching code protects it from being read directly, but there are not many possible phone numbers. Somebody who obtained our database and knew how the codes are made could work out which numbers are in it. We are working on closing that. We would rather tell you than let you assume otherwise.