Privacy Policy

Wyspio is run by [Company legal name] ([registered address]), the controller of your personal data. Reach us (or our data protection contact, where one is required) at [contact email].

Account

• Name, email address, username, and profile picture from the sign-in method you use (ChatGPT, email code, Google or GitHub).
• Profile details you add: bio, emoji avatar and accent colour.
• That you confirmed you meet the minimum age, and who invited you (if you joined through an invite link).

What you create and share

• Prompts and refinement instructions, the wysps generated from them, captions, and audience settings.
• Photos you attach to a wysp, and any note you add to them. We re-encode every photo when you upload it, which removes its location (GPS) and camera details.
• Comments, reactions, replies and direct messages.
• Interactive wysp data: poll votes, counters and small per-viewer saved state.
• Your friends, close friends, blocks and reports.
• Feedback and problem reports you send us: your message, the page you were on, your browser/device type and, if you're signed out, the email you choose to give us for a reply.

Usage and device

• First-party product analytics: events such as “signed up”, “published a wysp” or “was active today”, with small labels like the mood or format you picked and a timestamp. These never include the text of your prompts, captions or messages, and they are stored in our own database, not sent to an analytics company.
• IP address and browser/device type for your sign-in sessions, security and rate limiting.

Connected AI accounts

• If you connect ChatGPT or an OpenRouter key, the access tokens are stored encrypted (AES-256-GCM) and used only to generate your wysps.

• To run the service: sign you in, generate and deliver wysps to the audience you choose, show reactions, comments and messages (contract).
• To keep people safe: review reports, remove content, enforce bans, and prevent spam and abuse (legitimate interests; legal obligations).
• To improve Wyspio: aggregate metrics like activation and retention (legitimate interests).
• To talk to you: sign-in codes and important service or policy updates. No marketing emails without your consent.

To generate a wysp, we send your prompt, mood and format (and, when you refine one, the current version of it) to one of these providers, depending on how your account is set up:

• OpenAI (ChatGPT): when you sign in with ChatGPT and generate with your plan, or when we use OpenAI models.
• Anthropic (Claude): our free AI wysps are made with Claude unless you connect your own AI.
• OpenRouter: when you connect your own OpenRouter key, or when we route a request through it.
• Google (Gemini): when configured as a generation model.

Photos you attach are checked by an automatic safety check (OpenAI or Anthropic) before they are saved, and a small copy is shown to the AI that makes your wysp.

They process the request to return a result, under their own terms and privacy policies. We don't send them your name, email or friends list. We'll update this list before using a new provider.

• Your audience: the people you choose (friends, close friends, a custom list, or everyone for public wysps).
• Service providers who host and run Wyspio for us: [hosting provider], [database provider], [object storage provider] and [email delivery provider], under contracts that limit what they can do with it.
• AI providers as described above.
• Authorities when the law requires it, or to protect someone's safety.
• A buyer or successor if [Company legal name] is reorganised or acquired. This policy would still apply.

We use essential cookies only: your sign-in session, plus short-lived cookies that remember an invite link or a sign-in step in progress. No advertising or analytics cookies, so there's no cookie banner. Wysps run on a separate sandbox domain that never receives cookies.

• Wysps expire after 1, 6 or 24 hours (your choice) and are permanently deleted within about an hour after that, together with their thumbnails, views, reactions, comments and poll data.
• Replies sent as direct messages keep a small snapshot of the wysp they answered (title, emoji, colours, caption) so the conversation still makes sense.
• Notifications are deleted after 30 days.
• Photos are deleted about two hours after the last wysp that uses them expires (or right away when you delete it). Photos you attach but never post are deleted after 3 days.
• Reports and moderation records are kept for [retention period] so we can handle repeat abuse and appeals.
• Analytics events are kept for [retention period]. When you delete your account they're disconnected from you.
• Your account stays until you delete it. Deletion removes it immediately from the live service and from backups within [backup window].

Depending on where you live (for example under the GDPR, UK GDPR or US state privacy laws) you can:

• Access or get a copy of your data: email [contact email].
• Correct it. Most of it is editable in Settings.
• Delete it. Settings → Delete account does this instantly.
• Object to or restrict some processing, and withdraw consent (for example by disconnecting an AI account in Settings).
• Complain to your local data protection authority.

We answer requests within [30] days and never charge for them. We don't sell or “share” personal data for targeted advertising.

Wyspio is for people aged 13 and over (older where local law requires, see the Terms). We don't knowingly collect data from younger children. If you believe a child under 13 has an account, tell us at [contact email] and we'll delete it.

Connections are encrypted (HTTPS), connected AI tokens are encrypted at rest, access to production data is limited to people who need it, and every wysp runs in an isolated sandbox that can't read your account, cookies or device (see Safety). No system is perfect: if we learn of a breach that affects you, we'll tell you as the law requires.

We and our providers may process data in countries other than yours, including the United States. Where required we use safeguards such as the European Commission's Standard Contractual Clauses.

We'll update this policy as Wyspio changes, and tell you in the app or by email before important changes take effect.

Privacy questions or requests: [contact email] · [Company legal name], [registered address].