Privacy Policy
Last updated: 8 October 2026
WhisperLite is a private, low-data messenger made by StratPollen Studio ("we", "us"). This policy explains what information the app handles, why, and the choices you have. It applies to the WhisperLite web app at whisperlite.netlify.app and whisperlite.stratpollen.com, and to the WhisperLite app in app stores.
The short version
- Your messages, photos, files, voice messages, calls, names and profile pictures are end-to-end encrypted. We can't read, see or hear them.
- We don't ask for your phone number, email address or contacts.
- No ads, no advertising trackers, no analytics, and we never sell your data.
- We only handle the small amount of technical information needed to deliver your messages and keep the service safe.
- You can delete your account in the app at any time.
1. End-to-end encrypted content
Everything you send in a chat is encrypted on your device before it leaves it. Only the people in that chat have the keys to unlock it. That includes:
- text messages, reactions and replies;
- photos, videos, files and voice messages;
- voice and video calls;
- your display name, profile picture, chat names and chat photos.
Our servers only store and pass along the encrypted (scrambled) version, so the people in your chat can receive it. We cannot read it, and we cannot hand over readable copies to anyone.
2. Information we do handle
To run the service we process a limited amount of technical information that is not end-to-end encrypted:
Anonymous account ID
When you start using WhisperLite, the app creates a random, anonymous account ID. It isn't linked to your name, phone number or email. It's used to deliver messages and to apply security rules (for example, that only members of a chat can post in it).
Chat delivery information
Chats are identified by random codes. To deliver messages we store which anonymous IDs belong to which chat, when messages were sent, their size, and delivery and read receipts. If you turn on active status or seen status, the people in your chats can see when you are online or have read their messages. You can turn these off in Settings.
Notifications
If you allow notifications, your device gives us a push token so we can alert you about new messages and calls. The alert we send contains no message text: only a code that tells your device which chat to check. Your device then shows the sender's name using information it has already decrypted.
Calls
Calls connect directly between devices where possible. As with any internet call, the devices on a call can see each other's IP addresses. When a direct connection isn't possible, the call is passed through a relay server run by Cloudflare. The relay sees IP addresses and how much data is sent, but not the content of the call, which stays encrypted.
Security and abuse protection
We use Firebase App Check with Google reCAPTCHA Enterprise to make sure requests come from the real WhisperLite app and not from bots. reCAPTCHA collects hardware and software information, such as device and app data, and sends it to Google for analysis. Google's Privacy Policy and Terms of Service apply to that.
Problem reports and reports about other people
If you report another person, we receive the reason you pick, what you type, their display name and anonymous ID, the chat's random code, and only the messages you choose to include. They are not told who reported them. If you send a report from Settings → Report a problem, we receive what you type. If you tick the option to include technical details, we also receive your device and browser type, app version and language. We use this only to fix problems.
Purchases and tips
Premium is optional. If you buy it in an app store, the payment is handled by that store (for example, Google Play). We receive confirmation that a purchase is active, but not your card details. Voluntary tips on the website are handled by PayPal. PayPal shares the payment amount and the details you choose to give PayPal with us, under PayPal's privacy statement.
Website hosting
The app's files are served by Netlify. Like any web host, Netlify processes standard connection information (such as IP address and browser type) to deliver the files and protect the service.
3. Information stored only on your device
Your encryption keys, your PIN, your list of chats, saved messages and media you've opened, and your settings are kept on your own device. If you set a PIN, this data is locked with it. We never receive your PIN, and we can't recover it or your recovery code for you.
4. What we don't do
- We don't collect your phone number, email address, contacts, location or advertising ID.
- We don't show ads or use advertising or analytics trackers.
- We don't sell or rent personal information, and we don't share it for advertising.
- We don't scan or analyse your messages. Because they're end-to-end encrypted, we can't.
5. Service providers
We use these companies to run WhisperLite. They process information only to provide their service to us:
| Provider | What for |
|---|---|
| Google Firebase (Google Cloud) | Anonymous sign-in, storing and relaying encrypted messages and files, push notifications, App Check. Chat data is stored in Google's Singapore region (asia-southeast1). |
| Cloudflare | Call relay when a direct connection isn't possible. |
| Netlify | Hosting the app's files. |
| Google Play / app stores | App distribution and Premium purchases. |
| PayPal | Voluntary tips on the website. |
These providers may process information in countries other than your own. They protect it under their own security and data-protection commitments.
6. How long we keep information
| Information | Kept for |
|---|---|
| Encrypted photos, videos, files and voice messages | 30 days after sending (free) or 1 year (Premium), then deleted automatically. |
| Encrypted text messages | Until they're deleted: by the sender ("Delete for everyone"), by a disappearing-message timer (1 hour, 24 hours or 7 days), or automatically when a chat has had no new messages for 6 months. Messages already saved on your phone stay there. |
| Invite links | Expire after 24 hours. |
| Your profile in each chat and your push registrations | Until you leave the chat or delete your account. |
| Encrypted backups (Premium) | Until you delete them or ask us to. |
| Problem reports and reports about other people | Up to 1 year. |
7. Deleting your account and data
In the app: open Settings → Delete account and confirm. This removes your name and picture from all your chats, your notification registrations and your anonymous account, and erases all WhisperLite data on that device. Messages you already sent may remain in encrypted form, which no one can read without the chat key, until they expire or are deleted as described above.
By email: you can also ask us to delete data by writing to support@stratpollen.com. Because accounts are anonymous, please send the request from the app if you can. If you can't, tell us roughly when you used the app and we'll do our best to help.
8. Security
We use end-to-end encryption, encrypted connections (HTTPS/TLS), strict server security rules and App Check to protect the service. No system is perfectly secure, but we design WhisperLite so that even we can't read your conversations.
9. Children
WhisperLite is not intended for children under 13, or under the minimum age for online services in your country. We don't knowingly collect information from children. If you believe a child is using WhisperLite, contact us and we'll help.
10. Your rights
Depending on where you live (for example, under the GDPR, the Philippine Data Privacy Act or California law), you may have the right to access, correct, delete or object to the processing of your personal information. Because WhisperLite is anonymous and end-to-end encrypted, we hold very little that can be linked to you. To make a request, email support@stratpollen.com.
11. Changes to this policy
If we change this policy, we'll update the date above and, for important changes, let you know in the app.
12. Contact
StratPollen Studio
Email: support@stratpollen.com