Privacy policy

Version française

Effective 2026-09-27. Version 2. What changed is listed at the end.

The previous version applies until 2026-09-27: /privacy/v1

This policy covers the Whim app and Whim’s website, whim.anycognition.ca, including the app-link pages that open when someone taps a link to a Whim app.

The short version

• Nobody at Whim can read what you save inside your apps. Whim doesn’t send it anywhere, and anything Whim ever syncs or backs up for you is encrypted on your phone with a key Whim never has.
• When you ask Whim to build or change an app, it sends your request to our server, and AI companies that work for us write the code.
• No ads. We don’t sell your information or share it for advertising, and we don’t track you across other apps or websites.
• If we ever want to collect a new kind of information, use it for a new purpose, keep it longer, or give it to a new kind of company, the app will ask you first.

Who we are

Whim is made by AnyCognition Inc., 575 Borbridge Avenue, Ottawa, Ontario, Canada, phone +1 613 862 9687. In this policy, “we” and “us” mean AnyCognition.

Our Privacy Officer is responsible for how Whim handles personal information. Write to support@whim.anycognition.ca with any question or request.

What you save in your apps

Nobody at Whim can read it. The apps Whim builds for you run on your phone, and what you save in them is stored there. Whim doesn’t send it anywhere: not in build requests, error details or reports, unless you type it into a report’s note yourself.

If Whim ever offers to sync or back up your apps for you, it will be a choice you turn on, and what it sends will be encrypted on your phone with a key Whim never has, so we still can’t read it.

If your phone backs itself up, for example to iCloud, the backup can include your apps and what’s in them. That backup is between you and your phone’s maker, and Whim can’t read it. A backup also carries this phone’s Whim ID to any phone you restore it onto. Make a new ID in Settings if you want a fresh one.

What leaves your phone

Whim sends nothing until you tap “Agree and continue” on the “Before Whim builds apps for you” screen. The one exception is a report, which you send yourself.

That screen says:

To build or change an app, Whim sends what you ask for to our server. AI companies that work for us write the code.

What gets sent

• What you ask for: your description, your answers and the plan you approve
• When you change an app: its name, code and description, and the layout of its data, never the data itself
• An ID Whim makes for this phone, used for daily limits and usage totals.
• Error details when something goes wrong. They’re technical only, not what you typed or saved.

Why

To build your apps and run Whim: daily limits, stopping abuse, keeping costs in check, and finding and fixing problems.

Who gets it

AnyCognition, the company that makes Whim, and companies that do work for us, like cloud hosting and AI providers. Some of them are outside Canada. They can’t train AI on it or use it for their own products, though some may keep it for a short time for security and legal reasons. Apple or Google may also check that requests come from the real Whim app. We give information to authorities when the law requires it.

What you save in your apps

Nobody at Whim can read it. Whim doesn’t send it anywhere, and anything Whim ever syncs or backs up for you is encrypted on your phone with a key Whim never has.

What we never do

Show ads, sell your data or share it for advertising, or track you across other apps and websites.

If we ever want to collect a new kind of information, use it for a new purpose, keep it longer, or give it to a new kind of company, we’ll ask you first.

You can turn AI features and error details off in Settings. Apps you already have keep working either way.

From these, we keep usage records tied to your phone’s ID: for each request, the kind of request, when it started and ended, how it ended (including any error code), its size, what it cost us, and reference numbers. Usage records never contain what you asked for. We also keep security and operational logs of how our servers are running.

App stores list this information as “linked to you” because it’s tied to your phone’s Whim ID. Whim doesn’t use it to track you across other companies’ apps or websites.

If you speak instead of typing, your keyboard turns your speech into text before Whim sees it. Apple, Google or your keyboard’s maker does that under their own terms. Whim gets only the text.

The beta waitlist on our website

This section applies from 2026-09-24, the day the waitlist opened.

If you join the beta waitlist at whim.anycognition.ca/beta, we keep the email address you give, the kind of phone you pick (iOS, Android or Other), whether you ticked “Don’t email me about Whim updates”, which version of the sign-up wording you saw, and when you signed up and last changed your answers. This comes only from that web page. The app never sends it, and it isn’t tied to your phone’s Whim ID.

We use it to invite you to test Whim. For Android, we give your address to Google so that Google Play can send you a tester invite. For iOS, we email you the TestFlight link. Unless you ticked the box, we may also email you now and then about Whim. We never use it for ads, and we don’t sell it.

Signing up again with the same address replaces your earlier answers. To leave the list, write to support@whim.anycognition.ca from the address you signed up with, and we’ll delete it.

How the AI part works

Our server sends your request, and app material when you change an app, to AI model providers that write or change the code. First, an automated safety check, also run by an AI provider, decides whether the request is allowed. If it refuses something you think is fine, write to us and a person will look at it.

AI providers work for us. They may not train AI models on what we send or use it for their own products. Some keep requests for a limited time to check for abuse and meet legal duties, under their own published retention periods.

We may change which companies do this work. The current ones are listed under “Who handles it right now”. If a change would let any company use your information for its own purposes, we’ll ask you first.

Why we use it, and the legal basis

Some privacy laws, including the EU’s and the UK’s, ask us to name a legal basis for each use.

In Canada, and anywhere else the law asks for consent, we rely on the consent you give on the “Before Whim builds apps for you” screen, on your choice to send a report, and on your choice to join the beta waitlist. In the EU, that same tap is also your consent to Whim storing the phone ID on your phone and reading it. Error details rely on our legitimate interest, as the table above says, and you can turn them off in Settings. You can take back your consent at any time in Settings.

Who we share it with

• AI providers, which get your request and app material to write or change the code and to run the safety check, as “How the AI part works” says.
• Companies that run our servers, logs and email: cloud hosting, logging and monitoring, and email. They handle what reaches our servers, including your requests, the phone ID, usage records, error details, connection data, logs, reports and the beta waitlist, and anything you write to us.
• Both kinds of company handle information only on our instructions, and each must protect it at least as well as this policy does.
• Apple or Google, when they check that a request comes from a genuine Whim app, and when we confirm a purchase you made with them. Google also gets the email address of each Android tester we invite from the beta waitlist. They handle that under their own terms.
• When the law requires it: a valid law, court order or government demand. We may also share what’s needed to deal with fraud, security or safety problems.
• If Whim changes hands. If AnyCognition or Whim is sold or merged, the records we hold go to the new owner, who must follow this policy or ask you first.

Nobody else. We don’t sell or rent your information, and we don’t give it to advertisers or data brokers.

Where it’s handled

We and the companies that work for us handle information in Canada and the United States. An AI request may also be handled in another country, wherever the AI model provider picked for it runs, as “Who handles it right now” says. When the law requires safeguards for sending personal information out of your country or province, for example from Quebec, the EU or the UK, we put them in place. For the EU and UK: Canada has an adequacy decision for businesses covered by its federal privacy law. For the United States, we rely on the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, and otherwise on standard data-protection contract clauses. Write to us if you want details.

How long we keep it

Reports and usage records made before 2026-09-27 are deleted within 90 days, as the earlier version of this policy said.

We keep something longer only when the law requires it, or while we deal with a specific security or legal problem.

Deleted records can remain in encrypted disk backups for up to 14 days before those backups expire.

Keeping it safe

Everything the app sends is encrypted in transit. We don’t store what you ask for, except inside a report you send, and we keep as little else as we can. Only the people who run Whim can reach our servers and the records on them.

If a breach creates a real risk of significant harm, we’ll tell the regulators the law requires and the people affected. We don’t know who you are, so we may tell you in the app or publicly.

Your choices

• Don’t agree. Tap “Not now” and nothing is sent. The example apps and any apps already on your phone keep working.
• Turn off AI features in Settings at any time. That stops everything the app sends except reports you choose to send. Your apps keep working.
• Turn off error details in Settings, and keep everything else.
• Make a new phone ID in Settings. Records tied to the old one are kept for up to 12 months, then deleted. Write to us if you want them deleted sooner.
• Reports are up to you. You see what’s in one before you send it, and you choose whether to include the prompt.

Your rights

Depending on where you live, you can ask us to tell you what we hold about you and give you a copy, correct it, delete it, limit how we use it, or take back your consent.

You can object at any time to our use of your information based on legitimate interests (see the legal-basis table). Write to us, or turn off AI features or error details in Settings, which stops it at once.

To ask, write to support@whim.anycognition.ca. Include your phone’s ID from Settings. We don’t know who you are, so without it we can’t tell which records are yours. For the beta waitlist, write from the address you signed up with instead. We answer within 30 days, and there’s no charge.

If you’re unhappy with how we handle your information, complain to us first at the same address. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it. You can also complain to a privacy regulator at any time, such as the Office of the Privacy Commissioner of Canada, Quebec’s Commission d’accès à l’information, the UK Information Commissioner’s Office, or the data protection authority where you live in the EU.

Do Not Track, and tracking by others

We don’t track you across other apps or websites, so a browser’s Do Not Track signal has nothing to switch off. We don’t let other companies collect information about your activity over time or across other apps and websites through Whim.

US state privacy laws

We don’t sell or share personal information as California and other US states define those words, and we don’t use it for targeted advertising.

Children

Whim is for people 13 and older. It isn’t meant for children under 13, and we don’t knowingly collect information from them. If you think a child under 13 has sent us something, tell us and we’ll delete it.

The first time you use Whim’s AI features, and again every 30 days, Whim asks your app store for an age signal. It keeps only the outcome, allowed or not, and the date it asked, on your phone. Nothing about your age leaves your phone. On an iPhone, Apple may ask you to share your age range, but only where an age law applies. If the store says you’re under 13, or that you’re a minor without a parent’s approval, the AI features stay off. The apps you already have keep working.

Changes to this policy

If we want to collect a new kind of information, use it for a new purpose, keep it longer than this page says, or give it to a new kind of recipient, the app will ask you first, and it won’t send anything new until you agree. A new feature you choose to turn on asks for itself when you first use it.

For other changes, like clearer wording, a different company doing the same job, or keeping something for less time, we update this page, change the date at the top and add a line below.

• 2026-09-27, version 2: rewritten in plainer words. Adds error details, app-integrity checks by Apple or Google, connection data and logs, the list of companies that handle information for us, the beta waitlist on our website, the Privacy Officer, your rights, legal bases, and where information is handled. Reports may now be kept for up to 12 months, and usage records for up to 12 months after last use, instead of 90 days; those made before this version still go within 90 days. Also published in French.
• 2026-09-22, version 1: first version.

Contact

Write to support@whim.anycognition.ca, or by mail to Privacy Officer, AnyCognition Inc., 575 Borbridge Avenue, Ottawa, Ontario, Canada, or call +1 613 862 9687.