Privacy Policy

Last updated 11 October 2026

Whysp AI, Inc., a Delaware corporation · shaurya.jain@whyspai.com

Whysp AI is a unified inbox with AI-assisted reply drafting, operated by Whysp AI, Inc.. This policy describes what the service actually does with your data, including the parts that are less flattering. It is written to match the software as deployed. It is not a statement of compliance with any particular law.

The short version

When you connect a messaging account, our servers sign in to it on your behalf and store copies of your chats so we can show them to you.
Your messages on our servers are not end-to-end encrypted. People who administer our servers could technically access them.
Messages go to an AI provider only when you press “Draft reply” or “Catch up”, and only from the conversation you are in.
Tone Memory analyses the messages you send only if you switch learning on. It runs on our own servers, not at an AI provider.
Nothing is sent from your accounts unless you press Send.
We do not sell data, show ads, or use analytics or tracking cookies.
You can disconnect accounts, delete your Tone Memory, and delete your whole account from inside the app.

What we store

Data	Why	Kept until
Name, email address, password if you set one (stored only as an Argon2id hash), your Google account identifier if you sign in with Google, the time you accepted the terms	To run your account	You delete your account
Sign-in sessions (a hash of your session token, creation and last-used times)	To keep you signed in	You sign out, or 30 days
A private Matrix identity created for you on our own Matrix server, with its credentials encrypted (AES-256-GCM)	To isolate your messages from other users	You delete your account
Connected-account details: platform, the bridge's session identifier, the account label the bridge reports (such as a phone number or username), connection status	To show and manage your connections	You disconnect that account
The session credentials for your messaging account, held by the bridge software in its own database	So the bridge can stay signed in for you	You disconnect that account
Conversations and messages from connected accounts: text, sender names, timestamps, read state. Attachments are copied to our Matrix server by the bridge even though the app currently shows them only as placeholders	To display your inbox, search it, and draft replies	You disconnect that account or delete your account
Tone Memory, if you turn learning on: statistics about the messages you sent (for example average length, punctuation and emoji habits, common greetings), counted per platform and per conversation tone; up to 8 short messages you sent, copied as examples; and counts of how you edit AI drafts. These statistics are kept even if you later disconnect the account they came from	To make drafts sound like you	You reset Tone Memory or delete your account. Individual examples can be removed at any time
Tone Memory settings you enter yourself: style preferences, examples you add, draft ratings	To personalise drafts	You remove them, reset Tone Memory, or delete your account
AI drafts: the generated text, the model used, whether you sent, edited, or discarded it	To attach feedback and mark AI-drafted messages	30 days if unsent; otherwise until you reset Tone Memory or delete your account
Security events (for example sign-in, password change, account connected). These never contain message content	To investigate abuse and security problems	You delete your account
Rate-limit counters, which include your IP address and, for sign-in attempts, the email address tried	To block brute-force and abuse	About one day

Our web server also processes your IP address and browser user-agent to deliver pages, as every website does.

Connected messaging accounts

Whysp AI connects to messaging networks through open-source Matrix bridges that we run ourselves. The integrations enabled on this deployment are: Telegram, WhatsApp, Instagram.

The bridge signs in as an additional device on your account. Your sign-in code or password is passed to the bridge to complete the login and is not stored by the Whysp AI application.
For Instagram, if you choose to sign in with your username and password, our server sends them to Instagram once to obtain a session, which is then given to the bridge. We do not store or log the password. The resulting session is held by the bridge until you disconnect.
The bridge relays your chats, including messages from the people you talk to, into rooms on our private Matrix server that only your Matrix identity can access.
While an account is connected, our servers keep fetching its new messages in the background, whether or not you have Whysp AI open.
Marking a conversation read in Whysp AI may send a read receipt on the original network.
End-to-end encrypted chat types that the bridge cannot access (for example Telegram secret chats) are not available in Whysp AI.
These bridges are independent open-source projects. Whysp AI is not affiliated with, endorsed by, or partnered with the messaging platforms.
For WhatsApp and Instagram, where enabled, the connection is unofficial and is not permitted by those platforms' terms. The platform may log out, restrict, or ban an account that uses it. You are shown this warning and must accept it before connecting.

Other people's messages. Your inbox contains messages written by the people you talk to. We process those only to provide the service to you.

AI drafting and Tone Memory

AI drafting is not currently configured on this deployment, so no data is sent to any AI provider. When you press “Draft reply”, we send that provider the items below. “Catch up” sends up to the 40 most recent text messages of that conversation and your name, and returns a short summary that is shown to you and not stored.

up to the 20 most recent text messages from that one conversation, with the participants' display names;
your name, and any instruction you type for that draft;
if Tone Memory is on: the learned description of your style, any preferences you set, up to six example messages, and a summary of your feedback and editing habits.

We do not send anything from your other conversations, and we do not send anything when you are not asking for a draft. The AI provider processes this under its own terms and privacy policy, which govern whether and how long it retains requests.

How Tone Memory learns

Learning is off until you turn it on, and you can pause it, rebuild it, or delete it at any time under Tone Memory.
When it is on, our servers measure messages you sent on accounts you connected, including earlier messages that the bridge has synced. Messages written by other people are never analysed for it.
The analysis is rule-based counting done on our servers. No AI provider is involved in learning, and we do not train or fine-tune any model on your data.
AI drafts you send without changing are not counted as your writing. If you repeatedly edit drafts in the same way, that pattern is recorded as an instruction for later drafts.
While learning is paused, messages you send are skipped permanently, not queued for later.
To give it history to learn from, we fetch a limited amount of older messages from your connected chats (up to roughly 120 messages per chat).

AI drafts can be wrong or inappropriate. They are suggestions for you to review, and are never sent automatically.

Who else processes your data

The cloud provider that hosts our servers and database.
The messaging platforms you connect, which see the bridge as a device on your account.
Google, if you choose “Continue with Google”. Google tells us your name, email address, and a stable account identifier. We do not receive your Google password and do not access your Gmail, contacts, or files.

We do not sell personal data or share it for advertising. We may disclose data if a valid legal request requires it.

Where data is processed

The service runs on Render (application hosting, Singapore region) with its database hosted by Aiven. The AI provider and Google sign-in process data in the United States. Your data may therefore be processed outside the country where you live. Where data protection law requires it, we rely on our providers' standard contractual terms for these transfers.

Security

Connections to Whysp AI use HTTPS.
Passwords are hashed with Argon2id. Session tokens are stored only as hashes. Matrix credentials are encrypted at rest by the application.
Each user has a separate Matrix identity; the Matrix server and bridge are not reachable from the public internet, and every request is authorised against your account on the server.
Message content in our databases is not encrypted at the application level, and is not end-to-end encrypted. Server administrators can technically access it.

No system is perfectly secure. We hold no security certifications.

Backups

We do not currently keep automated backups of the production databases. If that changes, this policy will be updated to say how long backups are kept and how deletion applies to them.

Your choices

Disconnect an account under Accounts: the bridge signs out and we delete the cached conversations and messages for it.
Pause learning, stop using it in drafts, remove examples, or delete Tone Memory entirely under Tone Memory.
Delete your account under Settings. See Data deletion for exactly what happens.
For access, correction, or other requests, contact us at shaurya.jain@whyspai.com.

Why we are allowed to use your data

To provide the service you signed up for: your account, your inbox, sending what you choose to send, and drafts you request.
Your consent: connecting each messaging account, and switching on Tone Memory learning. You can withdraw either at any time in the app.
Legitimate interests: keeping the service secure, preventing abuse (for example rate limits and security logs), and fixing faults.
Legal obligations, where the law requires us to keep or disclose something.

Your rights

Depending on where you live, you may have the right to access, correct, download, or delete your data, to object to or restrict some uses, and to withdraw consent. Most of this you can do yourself in the app (Settings → Download my data, Tone Memory, Accounts, Delete account). For anything else, contact us at shaurya.jain@whyspai.com and we will respond within 30 days. You can also complain to your local data protection authority.

Children

Whysp AI is not intended for children. You must be at least 13 years old to use it, or 16 in the European Economic Area and the United Kingdom. If you believe a child has created an account, contact us and we will delete it.

Cookies

We set one strictly necessary cookie to keep you signed in. See the Cookie notice.

Changes

If we change what the service does with your data, we will update this page and the date at the top before the change takes effect.

Contact

Privacy questions and requests: shaurya.jain@whyspai.com.