Privacy: what our servers hold
Dates are retention after the last event. Nothing on this page is a promise we cannot keep: files, messages, cards, voice messages, calls, room contents, bookings and reviews travel device to device and never touch our servers.
Last updated October 29, 2026
What our servers hold
| What | Where | Kept | Why | Export |
|---|---|---|---|---|
| Account e-mail, sign-in events | Cognito | until the account is deleted | sign-in by code; invitations | yes |
| Profile: name, picture, word slug or handle, the identity key (ipk) or vk, the signed device list (per-device public bundles, labels, the epoch public key and per-device epoch wraps — ciphertext only), inbox-key generations | Accounts | until deleted or rotated (a superseded device-list version is not kept; a previous inbox generation 24 h) | the link page; sealing knocks and slots to whichever device is present | yes |
| Controls (policy): reach, pause, what I accept, hours and their mode, direct only, inbox policy | Accounts | until changed | enforcing the user's controls | yes |
| Devices: name, platform, form, signing and sealing public keys, push subscription, notify and its kinds, quiet hours, duty, the salted hash and expiry of the device token | Accounts | until the device is removed (its token with it) | registration, the wordless push, availability, joining when sign-in is down | yes |
| Rooms: the registry row (kind, owner, payer, member profile ids, delegates, entry, generation, the chosen expiry; never a name or content) | Rooms | 30 idle days or the chosen expiry | letting members find and pay for the room | yes |
| Calls: a lease and relayed minutes/bytes like any session | Usage | as the usage rows | metering when relayed | yes (in usage) — never media, never who called whom |
| Plan, Stripe customer and subscription ids, spend cap, seats | Accounts, Stripe | until deleted; Stripe keeps invoices per its own retention | billing | yes |
| Usage counters per month and per lease (relayed minutes and bytes, provider, payer, issued and reported time) | Usage | period rows 13 months; lease rows 48 h | pay as you go, the cap, reconciliation | yes |
| Session metadata (link, template, state, who accepted, when, sizes and kinds reported by the host) | Sessions 24 h; business audit# rows 90 days | as the sessions rows | the business inbox and its audit | yes (business export) |
| Organisation membership, roles, invitations (e-mail hash and code hash) | Accounts | until removed; invitations 7 days | the team | yes |
| API keys (name, scopes, salted hash), webhooks (URL, encrypted secret), deliveries (status) | Accounts, Webhooks | until deleted; deliveries 14 days | the enterprise API | yes (names and URLs) |
| The sealed slot (ciphertext only) | Slots | 7 days or pickup | the one message while the receiver is away | listed, not readable |
| Live connection rows (connection id, room, device, keyed IP hash) | Connections | 2 hours | signaling | no |
| Rate-limit counters (keyed hashes, no address) | RateLimits | the window, at most 24 h | abuse limits | no |
| Server logs (ids, codes, durations; never bodies, tokens, addresses, names) | CloudWatch | 14 days | operations | no |
| Conversations, files, voice messages, the usage ledger, contact decisions, keys | the device only | the device's history setting | the app | from the device |
Never on our servers, by construction: files, messages, cards, voice messages, calls, room content, bookings, reviews, private keys, pair or room secrets, the plaintext of a slot, who talks to whom in a pair room, the address of a visitor (hash only, 2 h), the content of a push.
The one exception
One sealed short text per sender to receiver pair, up to 280 characters of plain text and 2 KiB sealed, may wait up to 7 days for a receiver who is away and is deleted on pickup. It is encrypted to the receiver's key: our servers keep ciphertext only and cannot read it. Everything else passes live while both ends are connected or waits in the sender's own outbox.
Your choices
The account export is built from this same table: every row marked "yes" above is in it. Deleting the account deletes the rows kept "until the account is deleted". Your content, kept on the device only, exports and deletes from the device.
Who is responsible
WhispShare is operated by LED TECHNO FUSION S.R.L., Str. Petre Andrei nr. 4C, parter, Iași, Romania, CUI 40378030, Trade Register J2019000036229. For privacy questions write to support@whispshare.com.