Privacy Policy
Last updated 15 September 2026
Whipup has no sign-in. We never ask for your name, your email address or your phone number, and we do not have them. This page says exactly what we do hold, where it goes, and how to remove it.
The short version. Two things you send us are published for everyone: the whips you make and the comments you write. One thing you send us is not published: a photo you attach, which only shapes what the model draws. The app also uses pseudonymous identifiers, activity counts, crash reports and advertising data as explained below.
Who we are
Whipup is operated by Raphael Yazdi. For anything on this page, write to raphael.yazdi@gmail.com. If you are in the EEA or the UK, that address is also the contact for data-protection requests.
What we collect
| What | Why | Who can see it |
|---|---|---|
| A pseudonymous account identifier | To attach your whips, likes and comments to the same person across launches | Us and people viewing your published content. Public content can include a pseudonymous author identifier. |
A handle, like @lantern3802 |
To label what you make | Everyone. It is generated from your pseudonymous account identifier, not your name. |
| The sentence you type | To generate the whip, and as the whip's caption once you publish it | Our model providers, and — if you publish — everyone. |
| A photo you attach | To shape what the model draws | Our model providers only. It is never published and never stored after the whip is made. |
| A sound you record or attach | To play inside the whip | Everyone, if you publish. The recording is stored and served as part of the whip. |
| Whips you publish | To show them in the feed | Everyone, including people without the app, through a share link. |
| Likes and comments | To show them | Everyone. |
| Which whips you saw, and for how long | To rank the feed | Us. Only the totals per whip are public, never who watched. |
| Your IP address | To rate-limit abuse | Our hosting provider receives it when handling requests. Application rate limits use it temporarily; infrastructure request logs may also retain network information. |
What stays on your phone
Your mute setting, whether you have seen the introduction, and the lists of people and whips you have blocked or hidden are stored on the device and never sent to us. Blocking is a preference on your phone: it hides that person from you, and it does not remove anything for anyone else. It does not survive reinstalling the app.
When the app crashes
If Whipup crashes, a report is sent to Firebase Crashlytics (Google Ireland Limited), so we can find out what broke. The report describes the crash, not you: the line of code that failed, the version of the app, the model of phone, and how much memory was free. It carries an installation identifier that Firebase generates for the app on your phone, and it is not joined to your account identifier, your handle, or anything you published. We cannot look up a person's crashes, and we do not try to.
It is switched off entirely in the builds we develop against, so it reports real phones only.
Ads in the feed
Every few whips the feed shows one ad. It is a page like any other: swipe past it. Ads are what keep making whips free, and they are the only thing in Whipup anybody pays for.
The ads come from Google AdMob (Google Ireland Limited). We do not choose which ad you see and we never hand Google anything you typed, made, liked or published — not your prompt, not your whip, not your handle, not your account identifier. To fetch an ad, Google's software on your phone sends Google the kind of device you have, your approximate location from your network address, your language and country, and, only if you allowed it, Apple's advertising identifier.
If you are in the EEA, the UK or Switzerland, you are asked before any of that happens, on a form Google provides. You can refuse and still use the feed and creation tools. Depending on consent and ad availability, you may see non-personalized ads or a Whipup notice. To change your answer later, open Settings → Privacy choices.
Apple tracking permission is separate. Where eligible, iOS asks whether Whipup may track using the advertising identifier. Declining does not restrict viewing or creating whips. Tracking-related network requests may be blocked, so an ad may be replaced by a Whipup notice.
Google's own account of what it receives is in the Google Business Data Responsibility pages, and the companies it may share an ad request with are listed in its advertising partner policies.
Tapping ⋯ → Hide this ad on an ad page replaces it with our own notice for as long as you stay on that page. It is a preference on your phone, like blocking.
What we deliberately do not collect
No analytics SDK, and no tracker of our own. We do not follow you across other apps or websites: third-party services receive the data described in the advertising, crash reporting and AI sections on this page. Photos you attach are re-encoded before they are sent, which removes location and camera metadata.
How your identity works
When you first open Whipup, your phone proves to us that it is a genuine iPhone running a genuine copy of the app, using Apple's App Attest. We turn the result into a one-way identifier. That identifier cannot be reversed into your Apple ID, your device, or you.
The key behind it is stored in your device keychain, which survives deleting the app. If you reinstall within thirty days, Whipup recognises the same person and your whips are still yours. To break that link, use Delete everything in Settings before deleting the app.
Who else sees your data
Whips are made by language models we do not run ourselves. When you request a creation or edit, our server sends the prompt and content needed for that request to these providers:
- Google Cloud Vertex AI, which runs Gemini models to plan and generate whips and process attached photos.
- DeepSeek, which can generate or edit the whip's code for text-only requests.
Photos attached to a creation are processed through Google Vertex AI. An initial creation sends the name of an attached sound to the model, rather than its audio bytes. An edit sends the current whip document and your requested change. We do not add your account identifier or handle to these model requests. Provider processing is governed by the applicable service terms and privacy policies. Version 1.1.0 (build 11) and later ask for permission before the first creation or edit; permission can be withdrawn in Settings. Earlier builds start processing when you request generation.
Our backend runs on Google Cloud (Firestore, Cloud Storage and Cloud Run). The Cloud Run service is in europe-west1, Belgium; AI and advertising services may process requests in other locations. We sell nothing to anybody, and nothing you make or write is shared for advertising — see Ads in the feed for what an ad request does carry.
How long we keep things
- Published whips, likes and comments — until you delete them, or until you delete your account.
- Attached photos — not kept. They are passed to the model and discarded.
- Which whips you watched — three days, then automatically deleted. The anonymous totals on each whip stay as long as the whip does.
- Your account identifier — until you delete everything.
- Your session token — thirty days, then reissued.
- Crash reports — ninety days, then automatically deleted by Firebase.
- Your consent answer — kept by Google's consent software on your phone, and changed at any time from Settings → Privacy choices.
Deleting everything
Open Settings → Delete everything & start over. It removes, from our servers:
- every whip you published, with its image, its sound and its shared state;
- every like you gave;
- every comment you wrote;
- everything you contributed to somebody else's shared whip;
- your viewing history and your account record.
It also wipes the app's data on your phone and destroys the key in your keychain, so the next launch is a genuinely new person. This cannot be undone, and we cannot restore it for you. Copies may remain in encrypted backups for up to thirty days before they age out.
Crash reports are the one thing it cannot reach, for the same reason we cannot read them per person: nothing joins them to your account. They hold no published content and no account identifier, and they age out on their own within ninety days.
Your rights
If you are in the EEA or the UK you have the right to access, correct, export, restrict or erase your personal data, and to object to how we use it. Delete everything performs the erasure right immediately and without asking us. For anything else — including a copy of your data — write to raphael.yazdi@gmail.com and we will answer within thirty days.
Our legal basis is the contract between us for the whips, comments and likes you ask us to publish, and our legitimate interest in a working, ranked, abuse-resistant feed for the rest. You may also complain to your national data-protection authority.
Advertising partners may process identifiers for personalized advertising when permitted. Use the advertising privacy choices described above to control that processing.
Children
Whipup is not for people under 13, and we do not knowingly collect anything from them. Whips are generated by a language model and are not reviewed by a person before they appear, which is why the App Store listing carries the rating it does. If you believe a child has used the app, write to us and we will remove the account.
Security
Everything travels over HTTPS. Each whip runs in an isolated sandbox on your phone with no access to your files, your other whips, or the network beyond the small set of things Whipup provides it. No system is perfect; if you find a problem, please tell us at raphael.yazdi@gmail.com before telling anyone else.
Changes
If we change this policy in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current version.