Whim — Privacy Policy

Effective date: 9 September 2026

Whim ("Whim", "we", "us") is a small decision-helper app: you create pockets (collections), tuck items inside, and draw one at random when you can't decide. This policy explains what we collect, why, and the choices you have. We've kept it plain on purpose.

Whim is operated by Tevlix LLC. If you have questions, reach us at support@tevlix.com.

The short version

You can use Whim without giving us your name or email. By default you're signed in anonymously — an identifier for your device, nothing personal.
We store the content you create (your pockets and their items) so the app can show it back to you and sync it across your devices.
We only ask for an email if you choose to save your pockets across devices.
If you share a pocket, the people you share it with can see everything in it.
We don't sell your data and we don't run ads.
Whim can share anonymous usage counts with us — but only if you turn that on. It is off unless you say so, and it never includes anything you typed.
If you turn on notifications, we store a delivery address for your device so we can tell you when someone adds to a pocket you share. Only about shared pockets — never to nudge you back into the app.
You can delete your account, and everything in it, from inside the app.
If nobody opens Whim on an account for 18 months, we delete that account and everything in it. Anonymous accounts have no email, so we cannot warn you first.

What we collect

1. An anonymous device identity. When you first open Whim, we create an anonymous account so your pockets have somewhere to live. This is a random identifier — it does not include your name, email, or any personal detail.

2. Your email — only if you choose to. If you choose to save your pockets across devices, we collect your email address and send you a one-time sign-in email. It contains a link you can tap and a short code you can type instead; either one signs you in, and both stop working shortly after.

2a. A password — only if you set one. You can also choose to set a password, so you can sign back in on another device without waiting for an email. You never have to: the one-time email works on its own, and an account without a password is a complete account. If you do set one, we never store the password itself. It is turned into a hash — a one-way scramble that cannot be turned back into what you typed — by our authentication provider, Supabase, and only the hash is kept. Nobody at Whim can read, recover, or tell you your password; if you forget it, we can only help you set a new one. If your device offers to save it to a password manager or keychain, that copy lives on your device under your own account, not with us.

3. Content you create. The pockets and items you make, including their names, any notes you add, and any links you paste into an item. Please note: a link you paste points to a third-party website that we don't operate or control (see "Links you add", below).

4. Basic usage records tied to your account. When you accept a draw, we record that pick (what you drew and when) so features like your draw history and "go-tos" work. We also record the date your account last opened the app — a single date, and nothing about what you did while you were there — so we can tell an account still in use from one that has been abandoned. See "Retention and deletion".

5. Sharing records. If you share a pocket or join one, we store who is in that pocket and when they joined, along with the invite codes you create. See "Pockets you share".

6. A notification address — only if you turn notifications on. If you allow notifications, your device is issued a registration token by Google's Firebase Cloud Messaging, and we store it against your account so a message can be routed to your phone. A token identifies an installation of the app, not you: it changes if you reinstall Whim, and it carries no name, email, or contact detail. We also store your device's time-zone offset — a single number, so that we don't send you something in the middle of the night.

We only ever notify you about a pocket you share with someone else: that another member added items, or that someone accepted your invite. We do not send notifications to bring you back to the app, and we do not send marketing. You can turn this off at any time in Whim's settings, or in your phone's own settings; turning it off in the app deletes the stored token.

5. Anonymous usage counts — only if you turn them on. Off by default. See the next section for exactly what this is.

What we do not collect

No readable passwords — if you set one, only a one-way hash is stored, and nobody at Whim can read it. Setting one is optional; sign-in also works by a one-time email link or code.
No advertising or third-party ad tracking.
Nothing you typed is ever sent for analytics — not pocket names, not item names, not your notes, and not your links. See the next section.
The last-opened date described above is not analytics: it is one date, used only to run the retention rule below, and it records nothing about what you looked at or did. It is kept whether or not you turn usage counts on, because deleting abandoned accounts depends on it.

Analytics and your choice

Whim asks once, on the welcome screen, whether you'd like to share anonymous usage counts. The switch starts off. Ignoring it is a complete answer and it means no. You can change your mind at any time in settings → "what we learn", and turning it off also discards the anonymous identifier the analytics service was using.

We added this to answer one question: what kinds of pockets do people actually make? That tells us what to build next. It is scoped to that question and stops there.

If you turn it on, we send

Counts and fixed labels describing what happened — never what you wrote:

when the app is opened
when a pocket is created or deleted, and when an item is added, edited, or thrown out
when a draw starts, and each time you say maybe, pass, or yes to a card
when a draw runs out of cards
when you change a preference, open your history, or tap a link
when you make an invite, copy it, try a code someone sent you, or leave a shared pocket
roughly how many items were involved, as a range (like "10-24") rather than an exact number
for a new pocket, one category label describing the kind of pocket it is, and, if you started from one of our suggested pockets, which suggestion it was

About that category label

To learn what kinds of pockets people make, your pocket's name is sorted on your device into one of ten fixed categories, and only that word is sent:

movies, shows, food, games, books, music, activities, places, chores, or other.

The name you typed never leaves your device. A pocket called "movie night with Alex" is sent to us as the single word movies — the rest is simply gone, and we never see it.

What is never sent, even when it's on

The names of your pockets or items, and anything you wrote in a note.
Any link you pasted — including which site it points to. We record only that a link was tapped, never where it went.
Your email address, or your password.
Who you share a pocket with, which pocket it is, or the invite code itself. We record that an invite was made, copied, or answered, and whether the answer worked — never anything that says which pocket or which person.
Any identifier that would let us connect this usage data back to your Whim account. The analytics data is not linked to your account, and we do not build a profile of you.
Recordings or screenshots of your screen. Whim does not use session replay.

Who processes it

PostHog (posthog.com) processes this analytics data on our behalf, on servers in the United States. If you are outside the United States, turning usage counts on means those counts are transferred there. They are never linked to your account or your email, so this transfer carries no information that identifies you.

How we use what we collect

To run the core app — hold your pockets and let you draw.
To sync your pockets across your devices, if you've added an email.
To send you a one-time sign-in link or code when you ask for one.
To let the people you share a pocket with see and use it.
To provide history and preference features you opt into.
If you turned it on, to understand in aggregate how Whim is used, so we know what to build next.

We do not use your content to build advertising profiles, and we do not sell or rent your personal information.

Whim lets you share a pocket with someone else, so you can both draw from it. Sharing is always something you choose, and it works by handing over an invite — a single-use code, or a link carrying that code. Anyone holding a live code can join that pocket, so only send it to someone you mean to share with. You can call an unused invite off at any time.

What the other people in a pocket can see: its name, every item in it, any notes and links on those items, the pocket's shared history of what has been drawn — including draws you made — and the date you joined.

What they cannot see: your email address, your name, or anything about your other pockets. Whim does not show one user's account details to another.

What happens when someone leaves. Leaving a shared pocket removes it from your dashboard. It does not withdraw what you put in: items you added stay in the pocket for the people still in it, no longer attributed to you. The same is true if the pocket's owner removes you.

What the owner can do. The person who created a pocket can remove anyone from it, and can delete the pocket entirely — which deletes it for everyone in it, along with everything inside. Only the owner can invite people or delete the pocket; everyone else can add, edit, and cross off items.

Please treat a shared pocket as a shared space, and don't put anything in one that you wouldn't want the other people in it to read.

Where your data lives (service providers)

Supabase hosts our database and authentication. Your data is stored there, protected by row-level security so that each account can only reach its own rows and the pockets it has been let into.
Cloudflare serves this website and the app's web version.
Plunk sends our email. When you request a sign-in code, your email address is passed to Plunk, which delivers the message through Amazon Web Services (Amazon SES) from servers in Sweden. If you buy Whimsy, Plunk also delivers the messages about your subscription described below. We don't send newsletters or marketing.
Google (Firebase Cloud Messaging) delivers notifications, if you turn them on. We send Google your device's registration token together with the message to be shown — the pocket's name and a line like "someone tucked 2 new things in". It never contains another person's name or email, because Whim has none to give. If notifications are off, nothing is ever sent to Google.
RevenueCat processes purchases of Whimsy. When you buy, the app store confirms the purchase to RevenueCat, which tells us that an account paid, for what, and when. RevenueCat receives your Whim account identifier and a device identifier; it does not receive your name, your email address, or anything you have put in a pocket. Your payment details go to Google or Apple and never reach RevenueCat or us.
PostHog receives the anonymous usage counts described above, on servers in the United States — and only if you turned them on. It receives no account identifier, so it cannot tell us which account any of those counts came from. If usage counts are off, nothing is ever sent to PostHog.

If you buy Whimsy

We keep a record of what was purchased and when — enough to answer "does this account have Whimsy, and how much has it paid toward owning it". We keep the store's confirmation messages so we can settle a question about a charge later; those are kept for as long as the account exists.

Because Whimsy converts to a permanent unlock after twelve paid months, we will email you about it — when a cheaper price becomes available, when you're close, when it becomes yours, and if you're still being billed for something you already own. These are messages about money you are spending, not marketing, so they aren't something you can opt out of while a subscription is running. Cancelling the subscription ends them.

These providers process data on our instructions to operate Whim, and may store or process it outside the country you live in. If you are in the United States, note that requesting a sign-in email means your address is handled in the European Union.

Links you add

Items can hold a link you paste (for example, a movie or restaurant page). Opening a link takes you to a third-party site that Whim does not control and is not responsible for. Their privacy practices are their own — review their policies before sharing anything there.

Retention and deletion

We keep your account and content for as long as the account is in use. You can delete individual pockets and items in the app at any time; deleting a pocket removes everything inside it.

Inactive accounts. Whim signs you in anonymously, which means there is usually no email address attached to your account and no way for us to warn you before this happens. If an account is not used for 18 months, we delete it and everything in it — the same things, in the same way, as the "delete my account" action described below. If an account has never had anything put in it — no pockets, no items, nothing — we clear it after 30 days instead, since there is nothing in it to lose.

Opening the app counts as use. So does making, editing, drawing from, or joining anything. The clock only runs on an account nobody opens.

One thing this deliberately does not do: it does not quietly destroy a pocket that other people are still using. If an inactive account created a pocket that is shared with someone else, we do not delete that account at all, however long it stays quiet — deleting it would take the pocket off the other person's dashboard too, and one person going quiet must never do that to somebody else. Where an inactive account was only a member of someone else's pocket, the account does go, but only its membership goes with it — the pocket, and anything that account added to it, stay with the people still there.

Please treat this as a real limit. If the only copy of something lives in Whim on a device you have stopped using, that copy will not last forever.

Deleting your account. Whim has a "delete my account" action in its settings. It removes your account and the content attached to it, and it cannot be undone. Specifically:

Pockets you created are deleted, along with every item, note, link, and pick record in them. If you shared a pocket, deleting your account deletes it for the other people in it too — the app tells you how many shared pockets that affects before you confirm.
Your memberships of pockets other people created are removed, so those pockets disappear from your dashboard. The pockets themselves carry on without you.
Items you added to someone else's pocket stay in that pocket, no longer connected to you or to any account.
Your settings, any pending invites you created, and your sign-in identity are deleted.
Any notification tokens for your devices are deleted, along with anything queued to be sent to them.

Deleted content may persist briefly in routine encrypted backups before being overwritten.

Anonymous usage counts are the one thing here that deleting your account does not reach, because they were never attached to it. They carry no account identifier, so there is nothing to look them up by — not for you, and not for us. Turning the setting off stops any further collection and discards the anonymous identifier used up to that point.

To request deletion or a copy of your data another way, contact support@tevlix.com. There is also a standalone page that explains deletion on its own, without needing the app: https://whim.tevlix.com/delete.

Your rights

Depending on where you live (for example under GDPR or the CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact support@tevlix.com. We will respond as required by the law that applies to you in Utah, United States.

Where we rely on your consent — the anonymous usage counts described above — you can withdraw it at any time in Whim's settings, with no effect on the rest of the app.

One limit worth stating plainly: content you put into a shared pocket has already been shown to the other people in it, and leaving that pocket does not take it back. Delete the items themselves if you want them gone.

Children

Whim is not directed to children, and you must be at least 13 to use it. We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact support@tevlix.com and we will delete it.

Changes to this policy

We may update this policy as Whim grows. When we make a material change, we'll revise the effective date above and, inside the app, ask you to review and accept the updated terms again before you continue.

Contact

Questions or requests: support@tevlix.com, Tevlix LLC.