Privacy

Last updated 2026-05-01.

This notice explains what Whisp collects, why, and how you can control it. Whisp is operated from Australia and is bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

What we collect

• Telegram identity: your Telegram user id, username (if set), and chat id. This is the minimum required to send you reminders.
• Reminders you create: name, optional note, schedule, timezone. You enter these; we store them so they fire when you ask.
• Plan and billing identifiers: if you upgrade, we store a Stripe customer id and subscription id. We do not see, store, or process your card details — Stripe does that.
• Server logs: standard request logs (path, status, IP) for ~14 days for operational debugging. No tracking cookies.

What we don't collect

• Card numbers, CVC, or any payment instrument data.
• Your phone number, email address, or real name (unless you put one in a reminder note yourself).
• Behavioural / advertising data. There are no third-party analytics, no Facebook pixel, no Google tags.

How we use it

• To deliver your reminders to your Telegram chat at the times you scheduled.
• To enforce plan limits (free vs paid).
• To process subscription billing (Stripe).
• To debug and operate the service.

We do not sell or share your data. We only disclose data when required by law (e.g. a valid Australian court order) or to keep the service running (e.g. Stripe for billing, Cloudflare for serving the site, Telegram for delivery).

Where it lives

The Whisp database is hosted in Australia. Stripe and Telegram operate globally; their privacy notices apply to data they hold.

Your rights

• Access & export: download everything we hold on you as JSON from your account page, any time. (APP 12.)
• Correction: edit any reminder, note, name, or timezone yourself in the app. (APP 13.)
• Deletion: delete your account and all associated reminders from your account page. This is permanent and immediate. (APP 11.)
• Complaints: if you think we've handled your data badly, you can complain to the Office of the Australian Information Commissioner.

Retention

• Reminders and account data: kept until you delete them or close the account.
• Server logs: ~14 days.
• Stripe payment records: as long as Stripe and Australian tax law require.

Cookies

One cookie: a signed session cookie set after you log in via Telegram. It's HttpOnly, Secure, SameSite=Lax, and stores only your Telegram user id and an expiry. No tracking cookies. No advertising cookies.

Children

Whisp is intended for adults. If you're under 16, please don't sign up.

Changes

We'll update the date at the top when this changes. Material changes will also appear in a Telegram message to active users.

Contact

Questions: reply to any Whisp Telegram message and the team will see it.