Privacy, in plain English.

The one-paragraph version

Your video is encrypted in your browser before it reaches us. The encrypted blob is stored on Vercel Blob. Viewing triggers deletion. A newly opened view link expires after 24 hours, and hourly cleanup removes unviewed blobs in batches, retrying failures. The decryption key is never stored on our servers — it lives in the URL fragment of the link the recipient receives, which browsers never include in network requests.

Anonymous to the other person

Wisp does not reveal the sender’s email in the notification, viewer, watermark or reply. The viewer receives only the clip information needed to open it; neither participant’s address is included in its page data.

We still use email privately for sign-in, delivery, replies and payment accounting. Wisp and its delivery providers handle these records. What you say or show can identify you, and the recipient can copy the content.

What we collect

• Sender email + recipient email. Stored on the clip row so we can deliver the link and route any reply back.
• Encrypted ciphertext + IV + ciphertext SHA-256. These are server-blind: we have the bytes, but no way to read them. The hash is the integrity fingerprint we use to verify the upload didn’t corrupt in transit.
• Truncated IP and a coarse browser/OS hint (chrome/ios, etc.) attached to event records (sent / viewed / replied). Used for spam attribution if a recipient flags abuse. Not surfaced to senders. Truncated to /24 (IPv4) or /48 (IPv6) before storage.
• Token balance per email. When you buy a token pack via Stripe, we increment your balance. We don’t store card data — Stripe holds it.

What we don’t collect

• The plaintext video. We can’t see it.
• The decryption key in any persisted form. (See the next section for the one transient exception.)
• Browser fingerprints, third-party analytics, ad pixels.
• Your name. The only identifier is your email.
• Audio reply content. Same encryption story as the video — we hold the ciphertext, not the key.

Referral links

When the referral program is open and you follow a referral link, Wisp stores a signed, first-party referral cookie for up to 30 days. It contains a random referral code and an issue time, not your email or the contents of a wisp. The most recent valid link receives purchase attribution for that browser.

For token purchases, we retain order IDs, buyer email, purchase amounts and any referral commission, refund or dispute adjustment for payment accounting. Referrers can see aggregate counts and amounts, never buyers’ emails, clips or recipients. This cookie is not used to track what recipients watch or to send marketing emails.

If you opt into cash referrals, we also retain the accepted terms version, your Stripe connected-account ID and transfer amounts and status. Stripe collects your identity, tax and bank information directly. Wisp does not store those bank or identity documents. See cash referral terms for eligibility, holds and payout rules.

The one transient exception about the decryption key

The link we email the recipient looks like wisp.video/v/<id>#k=<key>. The #k=... fragment is the decryption key. To compose that email, our server briefly handles the key in memory during the email-send step. We don’t log it,don’t persist it to the database, and don’t retain it after the email goes out.

If you don’t want the key to pass through our server even transiently, you can copy the link from the composer’s success screen and share it via your own channel — Signal, AirDrop, in-person. Email is the convenience path; it isn’t the only path.

Encryption details (for the curious)

We use the browser’s native Web Crypto API: AES-GCM with a 256-bit key and a 96-bit IV generated fresh per upload. AES-GCM is authenticated encryption (AEAD), so any tampering with the ciphertext or IV during transit will fail decryption rather than silently producing garbage. We don’t use any third-party crypto library — only the browser’s built-in implementation.

Retention

• Encrypted blobs: viewing triggers immediate deletion. Unviewed clips expire for newly opened view links after 24 hours; an hourly job deletes their blobs in batches and retries storage failures. A previously opened tab or copied Blob URL may remain usable until storage deletion succeeds.
• Clip metadata and event rows: scheduled for deletion in batches 180 days after Blob deletion is confirmed. A storage failure delays this cleanup so we retain the pointer needed to retry. Sender and recipient emails are part of the clip row; the content fingerprint is a hash.
• Token balance + Stripe records: kept indefinitely while you have tokens, since the alternative is forfeiture. You can request deletion of the balance and we’ll honor it on the next zero-out.
• Webhook and duplicate-prevention logs: retained as needed to keep token balances accurate and review payment disputes. These records have no automatic 180-day deletion schedule today.

Your rights

Email privacy@wisp.video for any of the following:

• Delete my data. We’ll purge any remaining clip rows that reference your email and zero out your token balance. Token refunds for unused balance are at our discretion and depend on Stripe payout timing.
• Tell me what you have. We’ll list the rows we hold for an email address, on request.
• Fix something inaccurate. Self-explanatory.

Subprocessors

• Vercel — application hosting and Blob storage. Vercel Blob holds the encrypted ciphertext only.
• Neon — Postgres hosting for clip metadata and token balances.
• Stripe — payment processing for token packs. Holds card data; we never see it.
• Resend — transactional email delivery (the wisp link to recipients, the reply notification to senders).

Children

Wisp is for users 18+. The product involves recording video and voice replies; we’re not the right tool for under-18 users.

Changes

If we change anything material in this policy we’ll update the page and put a notice on the home page for at least two weeks. We’ll never quietly remove a privacy commitment.