Privacy Policy

Last updated: 2 November 2026.

WhosApp (the iPhone, iPad and Android apps and the relay service behind them) is run by Remoteflow Inc., 134 Bayne Crescent, Cambridge, Ontario N1R 7Z1, Canada ("we"). Privacy contact: tanzeel@devflovv.com.

The short version. Messages, calls, photos and files are end-to-end encrypted on your phone. We cannot read them. Our relay only forwards sealed data and keeps very little about you.

What we never see

Your messages are end-to-end encrypted on your phone. Our server never sees message content or your groups. It never receives your contacts' phone numbers in readable form.

What our relay server stores

• Account ids, random ids that identify your account, and the time the account was created. Kept until you delete your account.
• Push tokens, so your phone can be woken for new messages (and for incoming calls on iPhone). Kept until you delete your account or the token changes.
• Public keys, so others can start an encrypted chat with you. Kept until replaced or you delete your account.
• Discovery tokens, while Contact sync is on (it is on unless you turn it off in Settings > Privacy): the one for your own number, so people who have it can find you. The ones your phone sends to see which of your contacts use WhosApp are answered and not kept. Your phone scrambles each number with a secret key that our server holds before anything is sent, so we never receive the numbers in readable form. Whoever holds that key could still work a number out by trying every possible one, so we limit how many lookups each account can make. Kept until you turn it off or delete your account.
• Undelivered messages, as encrypted data we cannot read, addressed to the recipient, for up to 30 days, then deleted. A stored message does not show who sent it: the sender is sealed inside the encryption. Delivered messages are removed.
• Encrypted attachments (photos, files, voice notes), as data we cannot read, with their size and expiry time but no uploader, for up to 30 days.
• Invite links: a scrambled copy of the link and the id of the account that made it, until the link expires (30 days).
• Daily usage counts per account (how many requests of each kind), only to limit abuse.
• A scrambled copy of your phone number (a keyed hash, not the number itself), linked to your account id, so you can sign in again on a new phone.
• A two-step PIN check value, only if you set a PIN. It lets us check your PIN without storing it. Kept until you remove the PIN or delete your account.
• Reports you send us about another account, including any messages you choose to attach. Kept for up to 90 days after the reported account or the reporter is deleted.

We do not store your contacts, your profile photos, or a record of who talked to whom. One limit you should know: your phone is signed in when it hands a message to our relay, so at that moment the relay knows which account is sending to which, how big the message is and when. It uses this only to deliver the message and does not store or log it.

Logs and IP addresses

Our web server keeps no access log, so it does not record IP addresses or the pages you ask for. Its error log records only serious faults (such as a full disk); such a line can contain an address and is deleted after 14 days. The relay and call-relay programs write short status logs without IP addresses, tokens, message content, phone numbers or account ids (the call relay blanks every IP address before the line is stored), and old lines are overwritten after a few megabytes. This website uses no cookies, analytics or trackers.

Phone verification

When you verify a phone number, our own text-message service, TextRail, sends you a text with a code and checks the code you type. TextRail and the phone networks that carry the text process your number to do that. The text of the message is deleted within 24 hours; TextRail keeps a record that a text went to your number. Our relay keeps only the scrambled copy listed above, and counts tries under it for one day so nobody can send you endless codes. You can also connect with friends through an invite link or a QR code.

Push notifications

To wake your phone for new messages we use Apple Push Notifications (iPhone) and Google's Firebase Cloud Messaging (Android). They receive only a device token and an empty wake-up signal, never your messages.

Calls

Calls (and, while a chat is open, messages) go directly between phones when possible. A direct connection means the other phone can see your IP address. If a direct connection is not possible, the call passes through our call relay instead. The call relay carries only encrypted audio and video: it sees both phones' IP addresses while the call lasts, but not what is said, and it does not keep those addresses after the call. The call relay is a standard TURN server. Your phone signs in to it with a scrambled name made from your account id with a secret key that only we hold, never with the account id itself. That name stays the same for your account and can be visible on the network between your phone and the call relay, but without our key nobody can turn it back into your account id.

In Settings > Privacy > Advanced you can turn on Protect IP address in calls: every call then passes through the call relay and every message through our servers, even when a direct connection would work, so the other person never sees your IP address. The call relay still sees it, as described above, and so does our message relay while you are connected, and call quality can drop. A contact you were directly connected to before you turned it on may have seen your address then.

Maps

To draw a map, the app downloads map tiles from OpenFreeMap (openfreemap.org, served through Cloudflare); that service sees your phone's IP address and which map area is on screen, which for a location a friend shared with you is that neighbourhood, but it never sees your messages, your contacts, your account or who you are talking to, and the exact coordinates travel only inside the end-to-end encrypted message. When you open a shared location that has no place name full screen, the app asks your phone's own address lookup (Apple on iPhone, Google on Android) for the street address of that point; that service gets the point, not the message, its sender or your contacts.

Your data on your phone

Chats and media are stored encrypted on your device, kept out of your photo gallery unless you tap Save, and left out of the phone's own iCloud or Google backups. We offer no server backup. You can export an encrypted backup file and keep it wherever you choose.

Your clipboard

The app does not read your clipboard on its own; it pastes only when you choose Paste. When you copy an invite link, group link or message text, it goes on your phone's clipboard like anything else you copy. On Apple devices, Universal Clipboard can sync it to your other devices signed in to the same Apple Account. An invite link carries the secret that makes it work, so treat a copied link like the link itself.

Sharing

We do not sell data and do not run ads or analytics trackers. We share data only with our infrastructure providers (hosting, Apple and Google for push, Google for phone verification) and when the law requires it. Because of encryption we can only hand over the items listed above.

Your choices and rights

• Delete your account in the app (Settings, Account). We then delete your account data from the relay at once. Encrypted attachments you sent are not linked to your account, so we cannot find them to delete early; they expire on their own within 30 days.
• Contact sync is on by default, and you can turn it off in Settings > Privacy > Contact sync: your token is then removed from our relay and your contacts are no longer checked. The app reads your address book only if you allow it on your phone.
• Canadian users have rights under PIPEDA. Users in the EU and UK have rights under the GDPR, including access, deletion and the right to complain to their data authority. Write to tanzeel@devflovv.com.

Children

WhosApp is not for people under 16 (13 where local law allows). We remove accounts we learn belong to younger children.

Changes

We will post changes here, and in the app, before they take effect, and update the date above.