Privacy policy
Oncewhisp · 2026-10-01.31. Controller
Controller: Rodolfo Alexis Galdos Eslava Address: c/o Adressgeber #2225 An der Alten Ziegelei 38 48157 Münster Deutschland Privacy contact: privacy-oncewhisp@gesoftware.dev
2. Account and connections
We process your email, hashed password, nickname and identifier, verification, sessions, public encryption keys, preferences, contacts, invitations, blocks, groups and memberships to run and secure your account and conversations. Your optional profile photo is stored on the server and made available to authorized users; it does not have the end-to-end encryption applied to chat attachments.
3. Messages and storage
Text, photos, audio and captions are encrypted on the device before sending. The server temporarily stores encrypted content and metadata including sender, recipient, channel and timestamps. It does not receive the device private key to read that content. Pending encrypted content expires 2, 4, 6, 8, 12 or 24 hours after sending, according to the recipient’s preference. It is removed from the active queue when the receiving device acknowledges receipt, or by periodic cleanup after expiry. Technical delivery records are deleted 25 hours after creation. Pending message content is excluded from our server backup data. The device inbox is stored encrypted. Opening a message consumes its opening; closing removes its content from the app. Optional local history may keep timestamps and status. Turning history off does not erase previous traces. We cannot prevent a recipient from photographing a screen or making copies by other means. The sender can optionally allow downloading individual photos; this is off by default. Only an explicit save action copies an allowed photo to the recipient’s photo library (or downloads it in the browser). These copies remain after the message closes or the account is deleted, and may be included in the recipient’s own photo backups. Oncewhisp cannot delete these external copies. The chat list also keeps the nickname and account identifier of accepted contacts locally. A chat entry may remain when the other account is deleted or unavailable, until you delete that chat. This does not retain the contents of consumed messages. Photos can be sent in compressed normal quality or as the original supplied by the device (HD); original files may contain embedded metadata. Videos are processed on the device for normal or HD quality. Large attachments are transferred separately in encrypted form. In groups, authorized recipients share an encrypted server copy; it is removed after all remaining unexpired recipients acknowledge receipt or upon expiry. Decryption keys are sent only inside end-to-end encrypted messages. Temporary encrypted attachments are also excluded from server backups. Videos are limited to 60 seconds: normal quality up to 480p or HD up to 720p, without sending the original 4K file. Each prepared file is limited to 32 MB. Videos are encrypted and transferred in chunks without loading the entire file into server memory. The sender may allow saving the video; this option is off by default. Copies explicitly saved to the gallery are outside Oncewhisp deletion and may enter device backups. Incomplete uploads are removed by periodic cleanup once they are at least one hour old; completed deliveries follow the expiry periods above. Encrypted chunks are excluded from server backups.
Temporary retention by agreement
In supported direct chats, both people may agree to keep only future text-only messages until the end of an agreed 2, 6 or 12 hour session starting at acceptance. This is off by default; requests expire after 24 hours and declining does not prevent chatting. Earlier messages, photos, videos, audio and captions are excluded. Texts are stored encrypted on the devices, including when activity history is off. The server stores participants, the agreement identifier, status and dates, but does not create a permanent message archive. Either person can revoke: the app removes saved texts when it processes the revocation and stops retaining future messages. An offline device may keep its copy until it receives the revocation or processes expiry while the app runs. Screenshots and external copies cannot be recalled. Active agreements end after the selected duration or when revoked; inactive records are removed by periodic cleanup after 25 hours from their last update. Agreements are excluded from server backups so old permissions are not restored.
4. Purposes and legal bases
Providing the requested account and communications relies on performance of the service (GDPR Article 6(1)(b)). Necessary security, abuse prevention and diagnostics rely on legitimate interests (Article 6(1)(f)), subject to balancing. Legal duties rely on Article 6(1)(c). Where a feature requires consent, it must be requested separately and can be withdrawn. An operating-system permission alone does not replace legal consent where required.
5. Providers and permissions
Hetzner hosts the API and database; Brevo sends verification and recovery emails. When push notifications are enabled and you allow them, Expo, Apple APNs or Google FCM receive a device identifier and the sender’s nickname with code, but not chat content. You can turn notifications off in your phone settings. Photo selection and the microphone support features you initiate. We do not import your address book or request location to chat. See Services and providers for details.
6. Retention and transfers
Account information remains while your account is active and until a deletion request is processed, except justified legal retention. Logging out does not delete the account or all local storage. Hosting region: Hetzner Online GmbH, Germany. The production server and encrypted backup storage are located in Falkenstein. Technical logs: Application and PHP logs rotate daily with up to 14 archived files; Nginx logs, where generated, also use 14 daily rotations; the Oncewhisp deployment configuration disables access logging. The dedicated Oncewhisp system journal uses a 14-day maximum retention setting and a 100 MB size limit. Rotation operates on files, so these are not exact per-entry deletion deadlines. Relevant extracts may be retained separately for a documented security incident or legal obligation. Backups: Encrypted daily backups are used only for recovery. The Oncewhisp repository keeps snapshots within seven days of the latest successful backup; older snapshots are removed during the next successful retention run. A failed backup can delay expiry. Pending message content, delivery receipts, device tokens, sessions and access/reset/deletion tokens are excluded from backup data. Persistent account information and support cases may remain in earlier backups until rotation. Device copies already received are outside this server backup policy. Email logs: Brevo transactional logs are retained for one month; message previews are disabled and tracking data is anonymized asynchronously for all senders. Provider deletion processing can take up to 24 additional hours. Support correspondence in the contact mailbox is retained while needed to resolve the request and then deleted, except information needed for a documented legal retention duty or claim. Copies held by recipients follow their own mailbox settings. International transfers and safeguards: API data and encrypted server backups are hosted in Germany. Email delivery, push notifications and support correspondence may involve processing outside the European Economic Area, including the United States. Brevo processing is governed by its data processing terms; international transfers use the applicable adequacy decision or contractual safeguards. Expo describes the EU–US Data Privacy Framework and standard contractual clauses in its privacy statement. Apple and Google publish separate terms for their notification services. The applicable mechanism depends on the recipient, service and processing operation; European hosting does not mean that all providers process data only in Europe. Contact privacy-oncewhisp@gesoftware.dev for information about the safeguards applicable to your data.
7. Your rights
You can export your account data, submit privacy requests and delete your account in Settings → Privacy and safety. You can also start deletion without the app at /account/delete by confirming a code sent to your email. Signing out does not delete your account. Deletion removes your profile, contacts, blocks, public keys, sessions and associated pending deliveries. Groups you created are deleted; groups owned by other people remain. Other devices may retain content already received. Backups expire under the retention period below. Reports may be retained for the period described below. You may request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consent. Contact: privacy-oncewhisp@gesoftware.dev. We handle rights requests within GDPR time limits, normally one month; we will explain any applicable extension. You may complain to Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), https://www.ldi.nrw.de or your competent local authority.
8. Children and changes
Minimum age: Only people aged 18 or over may use Oncewhisp. Parental permission does not allow access for people under 18. Material processing changes must be communicated before introduction. This version does not include advertising, usage analytics or Stripe payments.
Reports and requests
Settings → Privacy and safety lets you submit requests or reports. Each contact’s menu also lets you report that person. You voluntarily share the reason, details you write and the related account identifiers. Messages, images and chat keys are not attached automatically. Report text is encrypted at rest and authorized staff can read it to process the report. It is retained for at most 180 days from creation or 90 days from closure, whichever comes first. Do not submit illegal images, passwords or access codes.
Public contact form
You can contact us at /contact without an account. We process your email and enquiry to answer it (Article 6(1)(f) GDPR, our legitimate interest in responding to enquiries; Article 6(1)(b) for steps you request before a contract). The form uses a necessary session cookie and CSRF protection; requests are limited by IP address to prevent abuse. The message is sent through Brevo to our united-domains mailbox. Mail retention follows the periods described above. We do not send an automatic copy to the address entered.