Privacy Policy

1. Information you give us

• Account details: your name, email address, and password. We store passwords only as a salted hash; we never see the password itself.
• Basic profile: your birth year and, if you choose to give it, your sex. Sex is optional and “prefer not to say” is a real answer that costs you nothing in how whiff treats you. Your phone number, if you give one.
• Where you are: your city and time zone, which are required because circles are local. If you allow it, approximate coordinates, used to judge how far an activity is from you. whiff does not track your location in the background and does not follow you between activities.
• Your onboarding answers: free-text answers, in your own words, to questions about how you spend your time and what you are like. This is the most personal thing whiff holds, and it is the material section 5 is about.
• What happens at activities: whether you said you would come, whether you came, and the feedback and reflections you write afterward.
• Corrections: when you tell whiff it has got something wrong about you, we keep the correction.
• How you use the app: which screens you opened, which invitations you answered, how far you got through onboarding, and when. Apple’s privacy label calls this Product Interaction. It is tied to your account rather than anonymous, because the engine needs to know whether you answered, not whether somebody did.
• Reports and blocks: if you report or block another member, we keep a record of it, including who reported whom and why.
• Anything else you send us, such as an email to support.

2. Information we receive from others

• From Apple: when you subscribe, Apple gives us a transaction identifier and tells us about renewals, cancellations, refunds, and billing failures. whiff never receives your card number, billing address, or Apple Account credentials. Payment is handled entirely by Apple.
• Technical data that any app or website receives: device type, operating system version, app version, IP address, and approximate region derived from it. We use this to keep the service working and secure.
• Diagnostics: crashes, freezes, slow screens, and failed requests, collected through Sentry. A report carries an opaque account identifier (the User ID on Apple’s label) so we can tell whether one person hit a bug ten times or ten people hit it once, and it says which screen and which onboarding question you were on when it happened. It never carries what you typed, your name, your email, a screenshot, or a session recording. Those are switched off deliberately, not by default.

3. What we do with it

• To place you in a circle: the core of the service. This is described in section 5.
• To plan activities that suit the four people in your circle, in your city, at a time you can reach.
• To run your subscription: starting your trial, reminding you before the first charge, and knowing whether your access is active.
• To email you about your circle, upcoming activities, your trial, and account and security matters.
• To keep people safe: reviewing reports, enforcing our Terms, and making sure blocked members are never placed together.
• To improve whiff: understanding, in aggregate, what makes circles work.
• To find and fix what is broken: reading crash and performance reports, and counting how often a fault happens and to how many people. Apple’s label calls this purpose Analytics; it means product analytics for us, and never advertising measurement.
• To meet legal obligations and to establish, exercise, or defend legal claims.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not build advertising profiles. We have never done so and have no plans to.

4. Our legal bases (if you are in the EEA or UK)

• Performance of a contract: running your account, your subscription, and your circle.
• Legitimate interests: safety, fraud prevention, security, and improving the service, balanced against your rights.
• Consent: for optional things such as approximate location and any marketing email. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or disclose something.

5. Automated profiling and how placement decisions are made

This is how whiff works, so please read it.

When you answer whiff’s onboarding questions, your answers are sent to a third-party large language model provider (Anthropic) and read automatically. The result is a structured profile of you: interests, traits, an inferred personality type, and a set of statements whiff holds as beliefs about you, each with a confidence attached. Your attendance and your feedback after activities update those beliefs over time.

That profile drives automated decisions about you. It determines which circle you are placed in, which three people are placed with you, how long you wait for a seat, and which activities are planned. These decisions are made by software, without a human reviewing each one.

Some things we want to be explicit about:

• Your raw answers are not shown to other members. Neither are your beliefs, your confidence scores, or your personality type.
• While a circle is forming, the other seats are sealed. Names, personality types, shared interests, and identities are not revealed until all four seats are filled.
• Anthropic does not train its models on your answers. Its Commercial Terms, the ones that govern our use of it, state that Anthropic may not train models on customer content. It processes your answers to return a result to us and deletes them within 30 days. If its automated safety systems flag something as violating its usage policy, that content may be reviewed by a person and kept for up to two years.
• whiff’s inferences are guesses and will sometimes be wrong. They are not an assessment of your character, health, or worth.

Your rights over this. You can see much of what whiff believes about you in the app, under You → What whiff believes, and correct it there. If you are in a jurisdiction that grants rights over automated decision-making, including Article 22 of the UK/EU GDPR, you have the right to ask for human review of a decision, to express your point of view, and to contest it. Email admin@whi-ff.com and a person will look at it.

6. What other members can see

Once a circle is complete, the other three people see your display name and whatever you choose to tell them in person. They do not see your email address, your phone number, your exact location, your birth year, your onboarding answers, your feedback, or anything whiff has inferred about you.

Feedback you give after an activity is used by whiff and is not shown to the people it is about.

7. Who we share it with

We share personal information only with service providers who help us run whiff, and only as much as they need. Each is contractually required to protect your data to at least the standard set out in this policy and to use it only on our instructions. They currently are:

• Anthropic: the language model that reads your onboarding answers (section 5).
• Railway: application hosting and database infrastructure.
• Resend: sending transactional email.
• Apple: subscription billing and App Store distribution.
• Vercel: website hosting and privacy-friendly, cookieless analytics.
• Formspree: processing the invite form on this website.
• Sentry: crash and performance diagnostics (section 2).

We may also disclose information if the law requires it, in response to a valid legal request, to enforce our Terms, or where we believe in good faith that it is necessary to prevent serious harm to someone. If whiff is ever acquired or merged, your information may transfer as part of that, and we will tell you before it becomes subject to a different policy.

8. Cookies and tracking

The whiff app contains no advertising SDKs and no cross-app tracking, and does not ask for permission to track you, because it does not. The website uses no advertising or cross-site tracking cookies; our analytics are aggregate and cookieless.

In Apple’s specific sense of the word, whiff does not track you: we do not link what you do in whiff with data from other companies’ apps or websites for advertising or measurement, and we do not share anything with a data broker. That is why the app never shows the “Allow whiff to track you?” prompt: there is nothing for it to ask about. Everything on our App Store privacy label is listed under “Data Linked to You” and nothing under “Data Used to Track You”. See section 16, which goes through the label item by item.

9. How long we keep it

We keep your information for as long as your account is open, and after that only as long as we need it for the purposes in this policy, typically to resolve disputes, meet legal and tax obligations, and keep safety records such as blocks and reports.

Some records are kept in an internal audit log that we do not rewrite, so that decisions whiff made in the past can be explained. Where we keep such a record after you delete your account, we strip or pseudonymise the personal details in it so that it no longer identifies you.

10. Deleting your account and your data

You can delete your account from inside the app: You → Account → Delete account. You can also email admin@whi-ff.com and we will do it for you.

Deleting your account:

• removes you from any circle you are in and stops any future placement;
• deletes your profile, your onboarding answers, and everything whiff inferred about you, within 30 days;
• keeps only what we are required to keep (safety records relating to reports about you, and financial records) for as long as the law requires;
• does not cancel your Apple subscription. You must cancel that separately in Settings → your name → Subscriptions, or we will keep charging you.

11. Your rights

Wherever you live, you can ask us to access, correct, export, or delete your personal information, and to stop sending you non-essential email. Email admin@whi-ff.com. We answer within 30 days and we will not treat you differently for asking.

If you are in the EEA, UK, or Switzerland, you also have rights to restrict or object to processing, to data portability, to withdraw consent, to the human review described in section 5, and to complain to your local data protection authority.

If you are in California or another US state with a privacy law (including Colorado, Connecticut, Virginia, Texas, and others), you have rights to know, delete, correct, and obtain a portable copy of your information, and to opt out of sale or targeted advertising, although we do not sell your information or use it for targeted advertising, so there is nothing to opt out of. You may designate an authorised agent to make a request for you.

12. Where your data is held

whiff is operated from the United States and your information is stored and processed there. If you use whiff from outside the US, you understand that your information will be transferred to the US, where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

13. Security

We use encryption in transit, hashed passwords, access controls, and keep credentials on your device in the iOS Keychain, marked so they never leave it in a backup. No system is perfectly secure and we cannot guarantee absolute security. If a breach affects you, we will notify you as the law requires.

14. Children

whiff is for adults 18 and over. It is not directed to children and we do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email admin@whi-ff.com and we will delete it.

15. Changes to this policy

We may update this policy. When we make a material change we will revise the date at the top and tell you in the app or by email before it takes effect.

16. Apple’s App Store privacy label, item by item

The App Store shows a privacy label on whiff’s product page. It is deliberately terse (ten data types and a purpose or two each), so this section says what each line of it actually refers to, and where in this policy the detail lives. Every item below is listed as “Data Linked to You”, because whiff has no anonymous mode: the whole product is a service that knows who you are in order to seat you with three specific people.

Nothing on the label is used for advertising, and nothing is used to track you in the sense Apple defines. See section 8. whiff has no advertising SDK, no data broker, and no third-party analytics that follows you anywhere else.

If the label and this policy ever disagree, this policy is the one we will correct the label to, and you can hold us to it at admin@whi-ff.com.

17. Contact

Whiff LLC
Email: admin@whi-ff.com