Privacy Policy

1. Who we are

Whoa (\"the app\") is an iOS application that lets two paired users share songs, drawings, photos, and love letters. Whoa is operated by Blackpoint (\"we\", \"us\"). You can reach us at edward.baltaza@blackpoint.dev.

2. Anonymous user identity

When you first open Whoa, the app creates an anonymous user record on our backend (Supabase). This record is identified by a random UUID — we do not collect your email address, phone number, Apple ID, real name, date of birth, or any other personally identifiable information. There is no sign-up form and no password. If you delete the app or sign out, the anonymous identity can be discarded.

3. Display name

You are asked to choose a display name so your partner sees something readable on their score card. The display name is stored on our backend and shared only with the single partner you have paired with. It is not shown publicly, not indexed, not used for marketing, and not linked to any other identifier. You can change or clear it at any time from the Settings screen.

4. Drawings and photos

When you send a drawing or a photo to your partner, the image is uploaded to our private storage (Supabase Storage) and shared with your paired partner only. Access is enforced by row-level security — nobody else can read your uploads, not even other Whoa users.

Drawings and photos are automatically deleted 24 hours after upload. After that window, the file is removed from storage and the database record is deleted. You can also delete an upload manually at any time from inside the app. Deletion is immediate and irreversible. Photos are not added to any public feed, are not backed up off-platform, and are not used for training any model.

5. Reactions

You can react to your partner's drawing or photo with a single emoji. The reaction stores only: the target item ID, your anonymous user ID, and the emoji character. It is visible to you and your partner only, and it is deleted automatically when the underlying drawing or photo is deleted.

6. Pairing codes

To pair with your partner, one of you generates a six-character alphanumeric code. The code is stored briefly on our backend, expires automatically after one hour, and is marked as used the moment it is redeemed. Pairing codes are not tied to any personal information.

7. Push notifications

If you grant push notification permission, iOS provides Whoa with an opaque device token that we store against your anonymous user ID so we can notify you when your partner sends a drawing or photo. The token does not identify you personally and is revoked if you disable notifications or delete the app.

8. What we do not collect

• · No email address, phone number, or real name
• · No health or fitness data
• · No location data
• · No contacts
• · No advertising identifiers (IDFA)
• · No third-party analytics or tracking SDKs
• · No crash-reporting services that collect personal data

9. Where data is stored

The small amount of data we do store (anonymous user ID, display name, partner link, temporary drawings/photos, songs, love letters, device token) lives on Supabase infrastructure. Data is encrypted in transit (HTTPS/TLS) and at rest. We do not share data with any third party for marketing or analytics purposes.

10. Your rights

You can sign out from the Settings screen, which clears your local session. You can unpair from your partner at any time, which removes the link between your two accounts. To request permanent deletion of your anonymous record and any associated summary scores, email edward.baltaza@blackpoint.dev from the device you use with Whoa (so we can match the request to your anonymous ID) and we will process it within 30 days.

11. Children

Whoa is not directed at children under 13 and we do not knowingly collect information from them. If you believe a child has used the app, contact us and we will remove the associated anonymous record.

12. Changes to this policy

If we change this policy we will update the date at the top of the page. Material changes will also be surfaced in-app on your next launch.

13. Contact

Questions about this policy? Email edward.baltaza@blackpoint.dev.