Last updated 12 August 2026
Whimlet turns a description you write into a small app that runs on your phone. This policy explains what that involves for your data, in plain terms. Where something is a genuine trade-off, it says so rather than hiding it.
Whimlet is operated by Cristian Marius Cringasu, a sole trader based in the United Kingdom, who is the data controller for the purposes of the UK GDPR. Contact: support@whimlet.com.
| Data | Why | Kept for |
|---|---|---|
| An identifier from Sign in with Apple | To recognise your account. It is specific to Whimlet and cannot identify you anywhere else. | Until you delete your account |
| Your email address | To contact you about your account or a billing problem. If you use Apple's Hide My Email, we only ever see the relay address, and everything still works. | Until you delete your account |
| The descriptions you type | Sent to an AI provider to generate your app. Also stored briefly in our logs when something fails, so it can be diagnosed. | Logs: 30 days |
| Credit balance and transaction history | To bill you correctly and to refund you automatically when a generation fails. | Until you delete your account |
| Token counts per generation | To know what the service costs to run and to price it honestly. Counts only — not the content. | Until you delete your account |
| Crash and hang reports | Delivered by Apple's MetricKit so we can fix what breaks. They contain no personal data. | 30 days |
To generate an app, we send the description you wrote — plus our own instructions describing what the app can do — to a third-party AI provider. This is the part of the service where your text leaves your device, so it is worth being specific.
We currently use OpenAI. We have also built support for Anthropic, and may enable it, including possibly letting you choose between them. If we do, the choice you make determines which company receives your description, and this policy will name whichever providers are actually reachable at the time.
Providers process your text to produce a response and under their business terms do not use it to train their models. Their own retention periods apply to what they receive; we cannot delete data from their systems on your behalf, and we will not pretend otherwise.
Practically: do not put passwords, card numbers, or other secrets into a description. Describe the app you want, not the private data you intend to keep in it.
Descriptions are checked automatically before an app is generated, to refuse requests that would breach our terms or a provider's rules. This is an automated check on the text you submit. It has no legal or similarly significant effect on you — if a description is refused, you can reword it and try again, and nothing else about your account changes.
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask us to restrict processing. Email support@whimlet.com and we will respond within one month.
You do not need to ask us to delete your account. Settings → Account → Delete account removes your account, your balance, and your usage history immediately, and severs the Sign in with Apple link. It is permanent, and any credits you have left are lost. The apps already on your phone stay there.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
Our servers and database are in the United Kingdom (London). Our AI providers process data in the United States, under the safeguards described in their data processing terms.
Whimlet is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
If we change this policy in a way that affects you — in particular, if we change which AI providers can receive your descriptions — we will say so in the app before the change takes effect.