Privacy policy

Who we are

Whimsi is based in the United Kingdom. Under UK data protection law (the UK GDPR and the Data Protection Act 2018), Whimsi is the data controller: responsible for how your information is used.

For anything about your privacy, write to us through the contact form.

What we collect, and why

When you browse

• What you search for, and how many results it found. We keep this without your name or account, to make search better. Phrases that at least two different people looked for can appear in "Wanted on Whimsi" on the homepage, so makers know what people want.
• Which listings get opened, with a random number for your visit, so makers can see how many people opened their thing.
• A scrambled version of your network (IP) address. We only use it to stop abuse, for example to limit how many AI searches, hearts or messages come from one place. It's scrambled one way, so we can't turn it back into your address.
• Hearts. When you heart a listing, we store a random ID kept in your browser and a scrambled network address, so each person counts once.

When you sign in with Google

Google shares your name, email address and profile picture with us. We never see your Google password. We use your account to keep you signed in and to connect your listings, wishes, ratings and snowglobe to you.

When you list something

• Shown publicly: the link, name, description, shelf, tags, screenshot, platform, price and who can use it, plus the name or handle you choose to show as "by …".
• Kept private: your email address, so we can reach you about your listing. It's never shown on Whimsi.
• To help write your listing, our listing helper reads your app's public page and takes a screenshot of it. If your link is a public code project, it also reads that project's public description. You check and change everything before it goes up.

Wishes, ratings and your snowglobe

• Wishes appear publicly, with how many people want the same thing. They're linked to your account privately, so each person counts once.
• Ratings and feedback. Average stars are shown publicly once a few people have voted. Written feedback goes to the maker's dashboard. They see your stars, your words and the date, never your name or email.
• Your snowglobe (the things you save) is linked to your account so it's there on any device.

"Tell me when something fits"

If you ask us to tell you when something is listed, we keep your email address, what you were looking for (in your words, and a tidied version), the wording you agreed to, and a scrambled network address. We only use it to email you about that. Every email has an unsubscribe link.

When you contact us

We keep your name (if you give it), your email address and your message so we can reply, along with a scrambled network address to stop spam, and your account if you were signed in.

What's stored in your browser

Whimsi stores a few small things in your own browser so features work: keeping you signed in, your snowglobe, whether you've used your free search, and finishing what you started after signing in with Google (such as a wish or a listing). None of it tracks you across other sites, which is why there's no cookie banner.

Our reasons (the legal bit)

UK data protection law asks us to say which "lawful basis" we rely on:

• To give you what you asked for (contract): signing in, listing, saving to your snowglobe, replying to your message.
• Our legitimate interests: keeping Whimsi safe from abuse, counting opens for makers, and making search better. We keep these as light as we can.
• Your consent: emails about things you asked to hear about. You can unsubscribe at any time.

Who helps us run Whimsi

A few trusted services handle information for us, only to run the parts of Whimsi below.

• Hosting and database services, which run the website and store information, sign-ins and screenshots.
• Google, for "Sign in with Google".
• AI and screenshot services, which help some of Whimsi's features work.
• Font and code delivery services. Like any website, they see your IP address when your browser fetches the site's fonts and code.

We don't sell your information or share it for advertising. We'd only share it otherwise if the law required it.

Some of these companies store or process information outside the UK, including in the United States. When they do, they protect it under data protection terms that UK law accepts for international transfers.

How long we keep things

• Your account, listings, wishes, ratings and snowglobe: while you use Whimsi, or until you ask us to delete them. A listing you take down is hidden but kept, so you can put it back; ask and we'll delete it completely.
• "Tell me when" requests: until we've emailed you, or you unsubscribe.
• Messages to us: for as long as we need to deal with them.
• Scrambled network addresses: deleted after 30 days.
• Searches: kept without names or accounts, to improve Whimsi.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that's wrong
• delete your information
• stop or limit how we use it, or object to it
• send your information to you in a format you can take elsewhere

Where we rely on your consent, you can withdraw it at any time. To ask, use the contact form with the email address you use on Whimsi, so we can find your information.

What deleting covers. We delete everything we can connect to you: your account, your listings and their screenshots, your wishes, ratings and feedback, your snowglobe, your "tell me when" requests and your messages to us. Searches, opens and hearts were never connected to you, so there's nothing of yours there to find. If our services keep backups, a copy may stay in them for a short time before it's overwritten. We'd only keep something if the law required us to.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.

Keeping it safe

Your information is stored behind access rules, so visitors can only ever see the public parts of Whimsi. Network addresses are scrambled before they're stored, and we never see your Google password.

Children

Whimsi isn't meant for children under 13, and signing in needs a Google account. If you think a child has given us their information, tell us and we'll delete it.

Changes to this policy

If we change how we use your information, we'll update this page and the date at the top. If it's a big change, we'll say so on the homepage too.