Privacy Policy

Last updated 25 September 2026 · Version 1.1

The short version

You can browse Whimzi without an account, and without telling us who you are. To film something you sign in with Apple or Google, and we learn an anonymous id from them, plus whatever name and email address you choose to put on your profile.

Clips are deleted after about a day. Not hidden — the video file is deleted from storage by a job that runs every fifteen minutes, whether or not anybody opens the app.

While a clip is fresh we never publish exactly where it was filmed. The map pin is snapped to a 200-metre square, the distance is rounded to the nearest 250 metres, and the street name is withheld unless it is a major road.

There is no advertising, no analytics, no tracking across apps or websites, and nothing here is sold to anybody. You can delete your account from inside the app in about four taps, and it takes your videos with it.

This summary is here because a policy nobody reads protects nobody. It is not a substitute for what follows, and where the two ever disagree, what follows is what applies.

This document is complete but not yet signed off. The italicised details below must be replaced with the real ones before the app is submitted to any app store, and the mailboxes must actually exist and be read by somebody.

1. Who we are

Whimzi is a mobile app that shows short clips of what is happening near you right now, filmed inside the app in the last few hours.

The app is operated by Whimzi, registered in [jurisdiction] under registration number [number], with its registered address at [address].

In South African law we are the responsible party for this information; in European law we are the controller. Our Information Officer, registered with the Information Regulator, is [name], reachable at privacy@whimzi.live.

Throughout this document, we means that company and you means the person using the app.

Whimzi is one product of Whimzi Group. Whimzi Connect is a separate app with a separate policy and a separate database. Nothing you do in one is visible in the other, and no account is shared between them.

2. What this policy covers

The Whimzi mobile app, this website, and the servers behind them.

It does not cover Apple, Google, or anywhere you go after tapping Take me there. Tapping that button hands a destination to your phone's own maps app, which then has its own policy and its own relationship with you. We are not told whether you went.

3. What we collect

If you only browse

Browsing needs no account, and we do not create one for you. To answer "what is happening near me", the app sends us your approximate coordinates and how far you want to look. We use them to run the query and to work out how far away each clip is.

Those coordinates are not written to our database and not written to our logs. Our request logs record a request id, the path, the status code and how long the request took — never the query string a location travels in, never a request body, and never a token.

When you sign in

Before any of it, we ask when you were born. Once, on a screen of its own, before the sign-in buttons — so that being turned away does not leave an account behind. We keep the date: it is what tells us whether you are under 18, and it is never shown to anybody, never on your profile, and never in any response the app can ask for.

Signing in is required to post, and to nothing else. We also receive:

An opaque account id from Apple or Google. A string that identifies you to that provider and means nothing anywhere else.
A name and an email address, if the provider sends them. Apple only sends these the very first time you authorise the app, and Apple's Hide My Email means the address may be a relay that forwards to you. Both are a starting point rather than the truth: they are yours to change or clear at any time, and nothing in the app reads them to decide what you are allowed to do.
A profile picture, if you add one. Chosen from your photo library. This is the only time the app touches your photos, and a photo can never become a clip: everything posted is filmed in the app, which is how posting works.

We never receive your Apple or Google password, and we never receive your contacts, your calendar, or anything else from those accounts.

When you film

Tapping stop publishes the clip. With it we store:

The video, with its sound — up to 30 seconds.
Where you were standing — latitude, longitude, and how accurate your phone said that fix was. See section 5, which is the important one.
When. Stamped by our server when your bytes arrive, not by your phone. That is the whole product: a timestamp a modified app cannot move is what makes "this was really filmed four minutes ago" mean anything.
How long it is, and how large. Both checked against the file that actually arrived rather than believed from the app.

There is no caption, no title, no category and no tag, because the app has nowhere to type one.

Your device

A push token, if you allow notifications. An identifier issued by Apple or Google for that one phone. It is not an advertising id and cannot be used to follow you anywhere else.
Your time zone, as a name like Africa/Johannesburg. Used for one thing: not notifying you at 3am. An offset captured in June is wrong in December for half the world, which is why it is the zone and not a number.
Whether you are on iOS or Android, to format a notification correctly.

What you do in the app

The places you follow.
The moments you loved.
Reports you make. A report records who made it and why — including "I'm in this", which a person at Whimzi sees first. That is deliberate: it is what makes one voice per person per clip, and what lets a report be believed. A report does not take a clip down by itself; a person at Whimzi decides.
People you blocked. When you choose not to see moments from whoever filmed one, we keep that you blocked that account. We never tell you who it was, and we never tell them.
That you accepted the community rules, and which version, the first time you film.

Watching a moment

When a moment has played for three seconds full screen, a counter on that clip goes up by one. That is the entire record — no row, no account, no device, no time — and it is shown to one person only: whoever filmed it, as "38 watched", along with a single notification a few hours after they filmed. Your phone keeps a list of the moments it has already counted, so watching twice does not count twice. That list never leaves the phone.

There is no record of what you watched, how long you watched it, or what you scrolled past.

Asking to be told when Whimzi is live near you

Whimzi opens one neighbourhood at a time. If you tap Tell me when it's live here, we keep:

The 200-metre square you asked from — never the point itself. Most people ask from home, which is why.
A one-way code made from a random id your phone generated, so asking twice counts once. It is not your account and is not linked to it.
Your phone's notification address and time zone, if you allowed notifications — used once, to tell you, and then deleted. If it is never used, it is deleted after a year.

You are told how many people in your suburb are waiting. That count is taken over the whole suburb, so it cannot be used to work out where anybody asked from.

A link somebody shared

A shared moment opens a page on whimzi.live. It shows the same thing the app would — the area, never the exact spot, while the moment is fresh — and plays the clip from our storage. It loads nothing from anybody else, is never indexed by search engines, and once the moment has expired it shows only which place it was at.

Saving data

To decide whether you are on mobile data, the app asks your phone what kind of connection it has. That answer is used on the phone and never sent to us.

Tapping Take me there

This one is worth being precise about, because it is the only number in the product that exists for our sake rather than yours.

When you tap Take me there, a counter on that clip and on that place goes up by one. That is the entire record. There is no row created, no account attached, no device, no coordinates, and no time — nothing in it could say that you tapped, and there is nothing in it that could be turned back into a person.

It exists for two reasons. It is the number that tells whoever filmed something that they changed what a stranger did with their evening, and it is how a venue can eventually be told "fourteen people tapped Take me there after your clip" — which is how this app is meant to pay for itself, instead of by advertising.

We are not told whether you actually went, and we have no way to find out. Knowing that would need location in the background, which this app never asks for. Everything we write says "tapped Take me there" and never "went", and that is not a turn of phrase — it is the limit of what is knowable here.

4. What we never collect

Your phone number. The app has nowhere to enter one.
Your location in the background. The app never asks for the permission that would allow it, so it cannot follow you around when it is closed. We are never told whether you arrived anywhere.
Your photo library. Only the single picture you pick for your profile, if you pick one.
Your contacts, calendar, microphone outside of filming, or anything you type outside the app.
An advertising identifier. There is no ad network and no analytics kit in the app. Nothing tracks you across other apps or websites, which is why the app never shows you Apple's tracking request — it would have nothing to ask for.
Anything about you as a person that could become a score. By design there is no follower count, no per-person clip total, and no query that could produce one. You follow places, never people.

5. Location, in detail

Everything about this product is where you are standing, so this is the section worth reading twice.

When it is asked for

On the screen that needs it, never at launch. Refusing is a real answer: you get a screen explaining what it was for and a link to your settings, not an empty list pretending to be a result.

How precise

Browsing uses a balanced fix — roughly a hundred metres. It is enough to sort a list and it costs noticeably less battery.
Filming uses a precise fix. This is deliberate and it is the only place we ask for it: deciding which building you are in needs about fifty metres, and a hundred-metre fix would regularly put your clip in the bar next door.

What other people are shown

A face is fine. A face, plus exact coordinates, plus "4 minutes ago" is not. So for as long as a clip is current — about an hour — everybody else sees a deliberately blunt version:

What we store	What is published while a clip is current
Exact coordinates	A point snapped to a 200-metre grid square
Exact distance from the viewer	Rounded to the nearest 250 metres
The street, if the map knows one	Withheld — unless it is a motorway, trunk, primary or secondary road, which is long enough that naming it discloses nothing. A road whose class the map never told us is withheld too: an absent answer and a cautious answer have to be the same answer.
The venue or suburb	Shown. It is the point of the app.

This is enforced on our servers, in the query that builds the response, rather than in the app. A modified app has nothing exact to reveal because nothing exact was ever sent to it.

Places, which outlive clips

A place in Whimzi is a spot that keeps being filmed. When a clip expires, the record that something was filmed at that spot stays, along with a count of how many times. That record holds coordinates and a name; it holds nothing about who filmed there.

This is what lets a corner become a place at all, and it is also why deleting your account does not erase a place's history — see section 13.

6. Being filmed by somebody else

If you are in a clip somebody else filmed, you did not agree to any of this, and that deserves a straight answer rather than a paragraph of law.

Our position is that ephemerality is the argument. What makes filming strangers in public harmful is permanence and searchability — a clip that can be found in three years, attached to a name, by anybody who looks. Neither applies here. Clips are deleted after about a day, there is no search, there are no profiles to browse, there is no way to look up a person, and nothing is indexed anywhere.

Three further things hold that position up:

If you are in a clip, you can say so from the clip itself. Choose "I'm in this" when you report it. A person at Whimzi is alerted and sees those reports first, and decides — taking the clip down deletes the video from storage. Reports for other reasons are decided the same way, and a clip several people report is hidden while somebody looks. We do not let a single report take a clip down on its own, because the same button would let any stranger delete anybody's moment.
No precise pin on a fresh clip, as above.
"Film the place, not the person" is an enforced rule, not a suggestion. See the Terms of Use.

If you are in a clip and you do not have the app, write to the address in section 17 with roughly where and when it was filmed. You do not need an account and you do not need to explain yourself. In all likelihood the clip has already expired by the time anybody reads the message, and we will tell you if it has.

7. Why we are allowed to

Under European law this needs a lawful basis and under South African law a justification. Ours, item by item:

What	Why we may
Your account, your clips, showing you what is nearby	Performance of the contract you enter into by using the app — it is the service itself
Precise location while filming, camera, microphone, notifications	Your consent, given through your phone's permission prompts and withdrawable in your phone's settings at any time
Taking clips down, keeping the record of a report	Our legitimate interest, and yours, in an app where something can be removed at once and abuse of that power can be traced
Keeping a place's history after clips expire	Our legitimate interest in the product existing at all. The record contains no person.
Security, rate limits, preventing abuse	Our legitimate interest in the service staying up and usable

We have not listed consent for anything we do not actually ask consent for, and we do not rely on legitimate interests to do anything you would be surprised by. If you disagree that an interest is legitimate, you can object — see section 12.

Nothing is sold, ever, to anybody. There are no advertisers, no data brokers, and no analytics companies involved in this product. The only third parties are the ones that run the infrastructure, and each one is listed here with exactly what reaches it.

Who	What reaches them	What for
Cloudflare	Every request; the video files themselves	Runs our servers and stores the video
Neon	Everything in our database	The database. Hosted in Frankfurt, Germany.
Apple and Google	A sign-in token they issued, handed back to them to verify	Confirming you are who their sign-in says you are. They already know you signed in — that is what their button does.
Expo	Your push token and the text of a notification	Delivering notifications. A notification only ever says something happened at a place you follow; it never mentions a person.
OpenStreetMap Foundation	The coordinates of a pin, once, with nothing attached that identifies you	Turning a point into a street and a suburb. No account id, no clip id, no device id and no name is sent — only the point. The answer is cached, so the same corner is never asked about twice.

Venue names come from Overture Maps data that we downloaded once and query on our own servers, so looking up what a place is called sends nothing to anybody.

We would also hand something over if a court with jurisdiction over us ordered it. We will say so publicly where we are legally permitted to. In practice there is remarkably little to hand over: a clip more than a day old no longer exists.

9. Where it is kept

Our database is hosted in Frankfurt, Germany. Video is stored on Cloudflare's network and served from wherever is closest to the person watching.

If you are in South Africa, that means your information is processed outside the country. POPIA allows this where the receiving country's law provides comparable protection; the EU's does, and our agreements with these providers include the standard contractual protections for transfers.

10. How long we keep it

What	How long
The video file	About a day. A scheduled job runs every fifteen minutes and deletes the file from storage — a clip taken down, a clip that has aged out, or an upload that was never finished. After that the bytes are gone and no link will play them.
The row describing a clip	Kept, with the video deleted and the row marked as expired. It is what stops the same upload being retried into a second post, and it is how a place counts.
A place	Indefinitely. It holds coordinates, a name and a count, and nothing that points at a person.
Your account and profile	Until you delete it
Sign-in sessions	Sixty days, renewed while you keep using the app, and revoked the moment you sign out or delete your account
A request to be told when Whimzi is live near you	The phone's notification address until it is used, or a year — whichever comes first. The request itself, a 200-metre square and a one-way code, is kept as a count of demand. Requests still carrying one of your phones' notification addresses are deleted with your account; the rest carry nothing that links them to it.
View counts	A number on a clip, kept with the clip's row. Nothing records who watched.
Reports	Kept, including after the reporter deletes their account — with the identity severed at that point, so the report survives and the person does not
Server logs	Short-term, by Cloudflare, for running the service. They carry a request id, a path, a status code and a duration.

11. How it is protected

Everything travels over HTTPS. There is no unencrypted route into the app.
Sign-in tokens are held in your phone's keychain or keystore, which is hardware-backed, rather than in ordinary app storage.
Sessions are short-lived and rotate. A refresh token that is used twice is treated as stolen and the whole family of sessions it belongs to is revoked immediately.
Uploads go straight from your phone to storage using a signed URL that expires in fifteen minutes, so video never passes through our application servers.
Your profile is served only to you. There is no route in our API that reads somebody else's profile, because there is nowhere in the product a person is shown.
Every secret lives on the server. Nothing in the app you download contains a credential that could read anybody's data.

No system is perfectly secure and anybody who tells you otherwise is selling something. If there is a breach that puts you at real risk, we will tell you and the relevant regulator, as both POPIA and the GDPR require.

12. Your rights

Whether you are covered by South Africa's POPIA, the EU or UK GDPR, or similar law somewhere else, you can ask us to:

Tell you what we hold about you, and where it came from.
Correct anything wrong — though your name and email are editable in the app, so that one is usually faster yourself.
Delete it — see the next section, which you can do without asking us.
Give you a copy in a portable format.
Stop or restrict a particular use, including objecting to anything we do on the basis of legitimate interests.
Withdraw a consent, at any time, in your phone's settings — location, camera, microphone and notifications are all switches you control and we do not.

Write to the address in section 17. We will reply within 30 days. There is no charge unless a request is repetitive or excessive, and if we ever decline a request we will say why and tell you who to complain to.

13. Deleting your account

In the app: You → the menu → Delete account. You are shown a screen that says exactly what will happen, and then asked once more. There is no grace period and no way to undo it.

What goes, immediately:

Every video you have filmed, deleted from storage — not hidden.
Your name, your email address and your profile picture.
The places you follow and the moments you loved.
Every device signed in to the account, and every sign-in session.
The link to your Apple or Google account. This is the one that matters: the identifier that connects the account to a real person is overwritten. Signing in again with the same Apple or Google account creates a brand new, empty account, because there is no longer anything to match you to.

What stays, and why:

That a place has been filmed at, and how often. A place exists because things keep happening there, and that history belongs to the corner rather than to you. It contains nothing that points at a person.
Reports you made about other people's clips. A report whose reporter has evaporated is not evidence of anything, and "delete your account to erase your reporting history" would be a hole in the one moderation mechanism this product has.

Neither one can be traced back to you afterwards. What is left of your account is an identifier with no name, no address, no email and no sign-in behind it — there is no way, from anything that remains, to get back to a person.

If you would rather we did it, write to us and we will, but the app is faster.

14. Children

You must be at least 13 to use Whimzi.

If you are under 18, a parent or guardian has to agree to you using it. That is not a formality we have borrowed from somebody else's policy: South Africa's POPIA treats anyone under 18 as a child and does not allow us to process their information without a competent person's consent, and this app asks for precise location, a camera and a microphone.

The app asks your date of birth before it will make an account, and keeps the answer — so it knows which side of 18 you are on, and so that changing your mind about the answer later does not work.

Knowing is not the same as having consent. The age gate records that somebody is under 18; nothing in the app then asks a parent anything. That is the ordinary state of most apps and it is not the same thing as complying with section 34 of POPIA.

Closing it properly means a verifiable parental consent flow, or advice from a South African privacy lawyer that another section applies. This box should not survive to launch.

What is different for somebody under 18

Nothing in the app profiles anybody, recommends anything, or ranks what you see — order belongs to the clock, and the only filter is a distance you chose and can see. There is no advertising, no engagement optimisation and nothing designed to keep you scrolling. Those are the defaults the UK's Children's Code asks for, and they are here because of what this product is rather than because a child might open it.

Two things are worth a parent reading directly. Filming puts your rough location in front of strangers nearby — coarsened to a 200-metre square while the clip is fresh, and gone within a day, but it is still the street you are on. And Take me there hands anybody watching a route to that place. That is the product working as intended, and it is the thing to talk about before somebody young starts posting.

We do not knowingly collect information from anybody under 13. If you believe a child under 13 has created an account, write to us and we will delete it and everything attached to it.

15. Automated decisions

There are none. Nothing about you is scored, profiled, or decided by a machine. What you see is sorted by one thing — how recently somebody stood there — and filtered by a distance you choose and can see. There is no ranking algorithm, and there will not be one.

16. Changes to this policy

We will update this page when the app changes, and the date at the top will change with it. If a change materially affects how we use your information, we will tell you in the app before it takes effect rather than quietly editing this page.

Previous versions are kept, and we will send you one if you ask.

17. Contact and complaints

Privacy questions, requests about your information, and takedown requests: privacy@whimzi.live

Everything else: support@whimzi.live

Postal address: [address]

If we have not resolved something to your satisfaction, you are entitled to complain to a regulator. In South Africa that is the Information Regulator (inforegulator.org.za). In the EU or UK it is the supervisory authority for the country you live in. We would rather you told us first, but you do not have to.