Privacy policy
We keep your email address, what you ask us to make, and the apps made from it, so we can make, check and host them. A few companies help us run WishWhip and get what they need for that. We don't sell anything about you, we show no ads, and neither WishWhip nor the apps it makes use analytics or tracking cookies. The people who use your apps never need an account, and what they save in an app stays in their browser.
What this page covers
This page says what WishWhip keeps, why, who helps us run it, and how long things are kept. It covers you when you make apps with WishWhip, and the people who use the apps it makes. Questions or requests: email us (help@wishwhip.app).
What we keep about you
- Your account. Your email address, and when you signed in. Clerk holds your account for us. If you sign in with Google, Clerk also holds the name and picture Google shares; we show them to you, but we don't store them ourselves. If you joined the waitlist, Clerk holds that email address until we invite you.
- What you ask us to make. Your descriptions, your answers to the questions we ask, the changes you ask for, your apps' names, a record of how each one was made (including the conversation with the AI models that made it), pictures of each version, and the code itself. Each app's record carries your email address, so we know whose it is.
- How much you've used. What you've used of this month's limit, the daily counts we use to stop abuse, and how much each of your apps' AI features is used each day.
- Emails. The emails we send you about your apps. When you write to us or reply to one, your message reaches our email inbox; it is not stored in WishWhip.
- Technical logs. Our hosting providers record requests to WishWhip, including IP addresses, for security and to fix problems, and keep them for their usual short periods.
- On your device. WishWhip remembers small choices, such as light or dark mode, in your browser's storage. They never leave your device.
About the people who use your apps
Your apps need no account. What people save in an app stays in their own browser; we don't see it. Three things go through us:
- Visit counts. When someone opens your app, their browser tells us once per visit. We keep only the number of visits per app per day: no cookie, no identifier, no page address. The visitor's IP address is held briefly in memory, so one person reopening the app isn't counted twice, and is never stored. Browsers that send Global Privacy Control are not counted.
- In-app AI. If an app has an AI feature, what the visitor types is sent through WishWhip to an AI model to get the answer. We don't store or log the messages; we only count how much each app uses.
- Move to another device. If someone moves an app's data to another device, their browser encrypts it with a one-time code before sending it, so we can't read it. We delete it as soon as the other device fetches it, or after 24 hours.
Why we keep it
To make, check, host and change your apps; to email you about them; to review apps before they go public and act on reports; to stop abuse and keep WishWhip running; and to answer you when you write to us. Where a law asks for a legal basis: we use your data to provide the service you asked for, and for our legitimate interest in keeping WishWhip safe.
Who helps us run WishWhip
These companies process data only to provide their service to us:
- Clerk. sign-in, accounts, the waitlist, sign-in codes and invitation emails.
- Vercel. hosts WishWhip and the apps it makes (at addresses ending in 4bitloop.com).
- Vercel AI Gateway, and the AI model providers it routes to. your descriptions, your apps' code and pictures of them are sent to AI models to make and check apps, and visitors' messages to in-app AI features are sent to answer them. The gateway chooses among several model providers.
- E2B. the computers where apps are made and checked, and where the pictures of each version are kept.
- GitHub. stores each app's code in a private repository under our account.
- Turso. our database, in the United States (AWS us-east-1).
- Resend. sends our emails.
Most of these are in the United States, so your data is stored and processed there.
How long we keep things
- Your account. until you delete it.
- Your apps and their records. while your account exists. If you delete an app, its link stops working at once; we keep its record and code so you can still download it.
- After you delete your account. every app goes offline and its code is archived. We keep the records of what you asked us to make, with your email address on them, and the archived code, so we can answer abuse reports and legal requests about apps that were public. Ask us and we'll erase them within 30 days, unless an open report or legal request means we must keep them for now.
- Visit and AI use counts. with the app's records.
- Data moved between devices. until it is fetched, and never more than 24 hours.
- Database backups. replaced on a rolling basis, within about ten days.
Your choices
You can download the code of any of your apps, delete apps, and ask us for a copy of what we hold about you, to correct it, or to erase it: email us (help@wishwhip.app) from your account's address. We answer within 30 days. If you're in the EU or UK and unhappy with our answer, you can complain to your data protection authority.
Children
WishWhip is not for anyone under 16.
Changes
If we change this policy in a way that matters, we'll email you before it applies. The date at the end of this page says when it last changed.