Privacy Policy
whit — log how you feel.
In short: whit works fully offline. Everything you write stays on your device unless you voluntarily sign in for cloud sync. There are no ads, no tracking, and nothing is ever sold or shared with third parties — not even in aggregated or anonymised form. Technical crash reports are off unless you switch them on yourself (section 4).
1. Who is responsible
The data controller under the GDPR is:
Leopold Wolpert
Lindengärten 10
79219 Staufen, Germany
Email: gobi275@proton.me
whit is the private project of one individual and is not affiliated with any employer or other organisation.
2. What the app processes
whit collects nothing in the background. The only data processed is what you enter yourself:
| Data | Purpose | Where it is stored |
|---|---|---|
| Mood entries ("whits"): a 1–7 rating, an energy value, a timestamp, tags, and context about sleep and activity | The core of the app: history, insights, reviews | On your device only; with an account also in the cloud, end-to-end encrypted |
| Free-text notes attached to entries | Your personal journal; visible only to you | On your device only; with an account also in the cloud, end-to-end encrypted |
| Habits and their completion history | Habit tracking, streaks, correlation with mood | On your device only; with an account also in the cloud, end-to-end encrypted |
| First name (optional, asked during onboarding) | Only to greet you on the home screen | On your device only; with an account also in the cloud, end-to-end encrypted |
| Settings: language, colour theme, reminder times | How the app behaves | On your device only; with an account also in the cloud, end-to-end encrypted |
| Email address — only if you choose to create an account | Signing in and linking your data to your account | Firebase Authentication |
Without an account, not a single entry leaves your device. The app contains no advertising or tracking libraries and does not measure how you use it. It collects no location, contacts, photos or usage statistics. Technical crash reports are sent only if you switch them on; section 4 spells out exactly what they contain.
3. Cloud sync (optional)
You can create a free account in the settings to back up your data and use it on more than one device. Nothing is transmitted before you do. The provider is Google Firebase (Firebase Authentication and Cloud Firestore), operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as a processor under Art. 28 GDPR.
Everything you sync is end-to-end encrypted. Your entries, notes, habits, name and settings are encrypted on your device (AES-256-GCM) before they are uploaded, with a key that never leaves your devices unencrypted. Google stores only unreadable ciphertext, and neither Google nor the developer of whit can read your data — not in the database, not in the Firebase console. What remains visible is technical: your email address and account ID (needed to sign in), how many documents your account holds and when the server stored them. Document names are random and reveal nothing, not even when an entry was created.
The key is protected by a recovery code that whit shows you once when you set up sync. You need it to open your cloud copy on a new device. Nobody can restore it for you: if you lose it, the cloud copy can no longer be decrypted. The data on your device is not affected, and you can replace the cloud copy with it at any time.
In addition, your data is stored in an area scoped exclusively to your account identifier, and the database security rules permit access only to the signed-in account itself.
Transfers to third countries (in particular the USA) cannot be ruled out when using Google services. Google is certified under the EU-US Data Privacy Framework; the European Commission's Standard Contractual Clauses apply in addition.
If you sign in with Google, Google learns that you are signing in to whit as part of that process. Google's privacy policy applies additionally.
4. Crash reports
To find and fix errors, whit uses Firebase Crashlytics (Google Ireland Limited, address as above) — only if you have switched crash reports on under Settings → Privacy → Crash reports. The switch is off by default. With it on, if the app crashes, a report is transmitted containing the technical cause: the error message, the position in the program code, the app version, the device model, the operating system version and a randomly generated, app-specific installation identifier.
The contents of your entries — mood values, notes, tags and habits — are never part of a crash report. The identifier is not linked to your account and is reset when the app is reinstalled.
Legal basis is your consent, Art. 6(1)(a) GDPR, given by switching crash reports on. Google retains crash reports for 90 days.
You can withdraw your consent at any time by switching it off again. It takes effect immediately, crash reports not yet sent are deleted from the device, and the choice applies to this device only — it is not synced, so another device can neither switch it on nor off for you.
5. Legal bases
- Art. 6(1)(b) GDPR (performance of a contract) — for storing your entries locally, without which the app would have no function.
- Art. 6(1)(a) GDPR (consent) — for cloud sync, which you give by voluntarily creating an account and can withdraw at any time by signing out or deleting the account.
- Art. 9(2)(a) GDPR — information about your mood and wellbeing may constitute health data under Art. 9 GDPR. It is processed solely on the basis of your explicit consent, given by using the app and its optional cloud backup.
- Art. 6(1)(a) GDPR (consent) — for crash reports, which you give by switching them on and can withdraw by switching them off (section 4).
6. Retention
Local data is kept until you delete it or uninstall the app. Cloud data is kept until you delete it or delete your account. There is no automatic retention period and nothing is retained after account deletion.
7. Deletion and your rights
In the app:
- Individual entries — delete them in History; the deletion propagates to your other devices and to the cloud.
- All data — Settings → Data → "clear all data". Deletes the data on the device and in the cloud.
- Your account and all cloud data — Account sheet → "delete account". Permanently removes the account and every database record belonging to it.
Deletion without the app installed: email gobi275@proton.me from the address you registered with. The account and all associated data will be deleted within 30 days, usually much sooner. Every route in detail — including what is kept — is on the Delete account and data page.
You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of consent (Art. 7(3)) at any time. For portability, the app offers a direct JSON or CSV export under Settings → Data, so you do not need to contact anyone.
You also have the right to lodge a complaint with a data protection supervisory authority.
8. App permissions
- Notifications — only for the reminders you set yourself. The app works fully without this permission, just without reminders.
- Vibration — haptic feedback while using the app.
- Boot completed — restores your reminders after the device restarts.
- Biometrics — only for the optional app lock. Your operating system performs the check entirely; the app receives nothing but "unlocked" or "not unlocked". whit never reads, stores or transmits fingerprint or face data — it never leaves your device's secure hardware.
The app requests no access to location, camera, microphone, contacts or files. When importing a backup you pick the file yourself through the system picker.
About the app lock, plainly: it guards access to the interface; it does not encrypt the database on the device. Anyone with physical access to an unlocked or rooted device could in principle read the files. Your operating system's own encryption applies to the device lock itself.
9. Minimum age
whit is intended for people aged 16 and over and does not knowingly collect data from anyone younger. The threshold follows Art. 8 GDPR: in Germany, a young person can only give valid consent to an online service processing their data from the age of 16. That consent is exactly what cloud sync and the processing of your mood entries as health data rest on (section 5).
Without an account the app processes everything locally on the device. If I learn that an account belongs to someone younger, I delete it along with all data attached to it.
10. Changes
Material changes to this policy will be indicated by the date above and, where necessary, by a notice inside the app.