Privacy policy

Version française

Effective 2026-11-03. Version 2. What changed is listed at the end.

Last updated 2026-10-31.

Version 1 applied until 2026-09-27: /privacy/v1

This policy covers the Whim app and Whim’s website, whim.anycognition.ca, including the app-link pages that open when someone taps a link to a Whim app.

The short version

• Nobody at Whim can read what you save inside your apps. Whim doesn’t send it anywhere, and anything Whim ever syncs or backs up for you is encrypted on your phone with a key Whim never has.
• When you ask Whim to make or change an app, it sends your request to our server, and AI companies that work for us write the code.
• No ads. We don’t sell your information or share it for advertising, and we don’t track you across other apps or websites.
• If we ever want to collect a new kind of information, use it for a new purpose, keep it longer, or give it to a new kind of company, the app will ask you first.

Who we are

Whim is made by AnyCognition Inc., 575 Borbridge Avenue, Ottawa, Ontario, Canada, phone +1 613 862 9687. In this policy, “we” and “us” mean AnyCognition.

Our Privacy Officer is responsible for how Whim handles personal information. Write to support@whim.anycognition.ca with any question or request.

What you save in your apps

Nobody at Whim can read it. The apps Whim makes for you run on your phone, and what you save in them is stored there. Whim doesn’t send it anywhere: not in requests to make or change apps, error details or reports, unless you type it into a report’s note yourself.

If Whim ever offers to sync or back up your apps for you, it will be a choice you turn on, and what it sends will be encrypted on your phone with a key Whim never has, so we still can’t read it.

If your phone backs itself up, for example to iCloud, the backup can include your apps and what’s in them. That backup is between you and your phone’s maker, and Whim can’t read it. A backup also carries this phone’s Whim ID to any phone you restore it onto. Make a new ID in Settings if you want a fresh one.

What leaves your phone

Whim sends nothing until you tap “Agree to send descriptions” on the “Before Whim makes apps for you” screen. The one exception is a report, which you send yourself.

That screen says:

To make or change an app, Whim sends what you ask for to our server. AI companies that work for us write the code.

What gets sent

• What you ask for: your description, your answers and the plan you approve
• When you change an app: its name, code and description, and the layout of its data, never the data itself
• An ID Whim makes for this phone, used for daily limits and usage totals.
• Error details when something goes wrong. They’re technical only, not what you typed or saved.

Why

To make your apps and run Whim: daily limits, stopping abuse, keeping costs in check, and finding and fixing problems.

Who gets it

AnyCognition, the company that makes Whim, and companies that do work for us, like cloud hosting and AI providers. Some of them are outside Canada. They can’t train AI on it or use it for their own products, though some may keep it for a short time for security and legal reasons. Apple or Google may also check that requests come from the real Whim app. We give information to authorities when the law requires it.

What you save in your apps

Nobody at Whim can read it. Whim doesn’t send it anywhere, and anything Whim ever syncs or backs up for you is encrypted on your phone with a key Whim never has.

What we never do

Show ads, sell your data or share it for advertising, or track you across other apps and websites.

If we ever want to collect a new kind of information, use it for a new purpose, keep it longer, or give it to a new kind of company, we’ll ask you first.

You can turn AI features and error details off in Settings. Apps you already have keep working either way.

From these, we keep usage records tied to your phone’s ID: for each request, the kind of request, when it started and ended, how it ended (including any error code), its size, what it cost us, and reference numbers. Usage records never contain what you asked for. We also keep security and operational logs of how our servers are running.

App stores list this information as “linked to you” because it’s tied to your phone’s Whim ID. Whim doesn’t use it to track you across other companies’ apps or websites.

If you speak instead of typing, your keyboard turns your speech into text before Whim sees it. Apple, Google or your keyboard’s maker does that under their own terms. Whim gets only the text.

The beta waitlist on our website

This section applies from 2026-09-24, the day the waitlist opened. It changed on 2026-11-03: news emails now need you to tick a box, stopping them is for good, and we keep a fingerprint of an address removed from the list.

If you join the beta waitlist at whim.anycognition.ca/beta, we keep the email address you give, the kind of phone you pick (iOS, Android or Other), whether you agreed to news about Whim and, if you did, when and under which wording, which version of the sign-up wording you saw, and when you signed up and last changed your answers. If you leave the list, we keep a fingerprint of your address. This comes only from that web page and from what you write to us. The app never sends it, and it isn’t tied to your phone’s Whim ID.

We use it to invite you to test Whim. For Android, we give your address to Google so that Google Play can send you a tester invite. For iOS, we email you the TestFlight link ourselves, and we never give your address to Apple. Each invitation names us, says why you got it and how to leave the list. We never use your address for ads, and we don’t sell it.

We email you news about Whim only if you tick “Email me news about Whim”. Every news email says how to stop. If you sign up again without ticking the box, or ask us to stop, we stop for good: ticking the box again on the web page won’t turn news back on. To get news again, write to us from that address. We act on a request to stop, or to leave the list, within 10 business days.

Signing up again with the same address updates your phone type and keeps the date you first signed up. To leave the list, write to support@whim.anycognition.ca from the address you signed up with. We delete your entry and keep only a one-way fingerprint of your address, made with a secret key, so that signing up again with it adds nothing. The fingerprint can’t be turned back into your address. If you want to be able to sign up again, write to us from that address and we’ll delete the fingerprint.

How the AI part works

Our server sends your request, and app material when you change an app, to AI model providers that write or change the code. First, an automated safety check, also run by an AI provider, decides whether the request is allowed. If it refuses something you think is fine, write to us and a person will look at it.

AI providers work for us. They may not train AI models on what we send or use it for their own products. Some keep requests for a limited time to check for abuse and meet legal duties, under their own published retention periods.

We may change which companies do this work. The current ones are listed under “Who handles it right now”. If a change would let any company use your information for its own purposes, we’ll ask you first.

Why we use it, and the legal basis

Some privacy laws, including the EU’s and the UK’s, ask us to name a legal basis for each use.

In Canada, and anywhere else the law asks for consent, we rely on the consent you give on the “Before Whim makes apps for you” screen, on your choice to send a report, on your choice to join the beta waitlist, and, for news about Whim, on your ticking the box that asks for it. In the EU, that same tap is also your consent to Whim storing the phone ID on your phone and reading it. Error details rely on our legitimate interest, as the table above says, and you can turn them off in Settings. You can take back your consent at any time in Settings, or, for the beta waitlist, by writing to us.

Who we share it with

• AI providers, which get your request and app material to write or change the code and to run the safety check, as “How the AI part works” says.
• Companies that run our servers, logs and email: cloud hosting, logging and monitoring, and email. They handle what reaches our servers, including your requests, the phone ID, usage records, error details, connection data, logs, reports and the beta waitlist, anything you write to us, and the beta emails we send you.
• Both kinds of company handle information only on our instructions, and each must protect it at least as well as this policy does.
• Apple or Google, when they check that a request comes from a genuine Whim app, and when we confirm a purchase you made with them. Google also gets the email address of each Android tester we invite from the beta waitlist. They handle that under their own terms.
• When the law requires it: a valid law, court order or government demand. We may also share what’s needed to deal with fraud, security or safety problems.
• If Whim changes hands. If AnyCognition or Whim is sold or merged, the records we hold go to the new owner, who must follow this policy or ask you first.

Nobody else. We don’t sell or rent your information, and we don’t give it to advertisers or data brokers.

Where it’s handled

We and the companies that work for us handle information in Canada and the United States. An AI request may also be handled in another country, wherever the AI model provider picked for it runs, as “Who handles it right now” says. When the law requires safeguards for sending personal information out of your country or province, for example from Quebec, the EU or the UK, we put them in place. For the EU and UK: Canada has an adequacy decision for businesses covered by its federal privacy law. For the United States, we rely on the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, and otherwise on standard data-protection contract clauses. Write to us if you want details.

How long we keep it

Reports and usage records made before 2026-09-27 are deleted within 90 days, as the earlier version of this policy said.

We keep something longer only when the law requires it, or while we deal with a specific security or legal problem.

Deleted records can remain in encrypted disk backups for up to 14 days before those backups expire.

Keeping it safe

Everything the app sends to our server is encrypted in transit. We don’t store what you ask for, except inside a report you send, and we keep as little else as we can. Only the people who run Whim can reach our servers and the records on them.

If a breach creates a real risk of significant harm, we’ll tell the regulators the law requires and the people affected. We don’t know who you are, so we may tell you in the app or publicly.

Your choices

• Don’t agree. Tap “Not now” and nothing is sent. The example apps and any apps already on your phone keep working.
• Turn off AI features in Settings at any time. That stops everything the app sends except reports you choose to send. Your apps keep working.
• Turn off error details in Settings, and keep everything else.
• Make a new phone ID in Settings. Records tied to the old one are kept for up to 12 months, then deleted. Write to us if you want them deleted sooner.
• Reports are up to you. You see what’s in one before you send it, and you choose whether to include the prompt.

If you point Whim at your own server

Whim is open source, so anyone can run its server. In Settings, under Advanced, you can tell the app to use a server you choose instead of ours. The app asks you to confirm first.

While that address is set, everything the app would send us goes to that server instead: your requests and app material, the phone ID, error details and reports. That server also writes the code of the apps you make there, and those apps run in the same sandbox on your phone as apps made by ours.

AnyCognition receives none of it from the app while the address is set, and this policy doesn’t cover it. Whoever runs that server decides what it keeps, for how long and who gets it, under their own rules. A plain http:// address on your own network isn’t encrypted.

To switch back, tap “Whim’s server” in Settings, under Advanced. From then on the app sends to our server again, and this policy applies.

Your rights

Depending on where you live, you can ask us to tell you what we hold about you and give you a copy, correct it, delete it, limit how we use it, or take back your consent.

You can object at any time to our use of your information based on legitimate interests (see the legal-basis table). Write to us, or turn off AI features or error details in Settings, which stops it at once.

To ask, write to support@whim.anycognition.ca. Include your phone’s ID from Settings. We don’t know who you are, so without it we can’t tell which records are yours. For the beta waitlist, write from the address you signed up with instead. We answer within 30 days, and there’s no charge.

If you’re unhappy with how we handle your information, complain to us first at the same address. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it. You can also complain to a privacy regulator at any time, such as the Office of the Privacy Commissioner of Canada, Quebec’s Commission d’accès à l’information, the UK Information Commissioner’s Office, or the data protection authority where you live in the EU.

Do Not Track, and tracking by others

We don’t track you across other apps or websites, so a browser’s Do Not Track signal has nothing to switch off. We don’t let other companies collect information about your activity over time or across other apps and websites through Whim.

US state privacy laws

We don’t sell or share personal information as California and other US states define those words, and we don’t use it for targeted advertising.

Children

Whim is for people 13 and older. It isn’t meant for children under 13, and we don’t knowingly collect information from them. If you think a child under 13 has sent us something, tell us and we’ll delete it.

The first time you use Whim’s AI features, and again every 30 days, Whim asks your app store for an age signal. It keeps only the outcome, allowed or not, and the date it asked, on your phone. Nothing about your age leaves your phone. On an iPhone, Apple may ask you to share your age range, but only where an age law applies. If the store says you’re under 13, or that you’re a minor without a parent’s approval, the AI features stay off. The apps you already have keep working.

Changes to this policy

If we want to collect a new kind of information, use it for a new purpose, keep it longer than this page says, or give it to a new kind of recipient, the app will ask you first, and it won’t send anything new until you agree. A new feature you choose to turn on asks for itself when you first use it.

For other changes, like clearer wording, a different company doing the same job, or keeping something for less time, we update this page, change the “Last updated” date at the top and add a line below.

• 2026-11-03: the beta waitlist. News emails about Whim now need you to tick a box, and stopping them is for good unless you write to us. We keep a fingerprint of an address removed from the list, for 730 days. The provider list now says that Google Cloud receives what you give on the beta sign-up page and that Zoho carries the beta emails we send. The app’s consent doesn’t change.
• 2026-10-03: adds “If you point Whim at your own server”. What Whim collects, why, how long it keeps it and who gets it don’t change.
• 2026-09-27, version 2: rewritten in plainer words. Adds error details, app-integrity checks by Apple or Google, connection data and logs, the list of companies that handle information for us, the beta waitlist on our website, the Privacy Officer, your rights, legal bases, and where information is handled. Reports may now be kept for up to 12 months, and usage records for up to 12 months after last use, instead of 90 days; those made before this version still go within 90 days. Also published in French.
• 2026-09-22, version 1: first version.

Contact

Write to support@whim.anycognition.ca, or by mail to Privacy Officer, AnyCognition Inc., 575 Borbridge Avenue, Ottawa, Ontario, Canada, or call +1 613 862 9687.