This page describes the current Whispera MVP. It is not legal advice and has not been reviewed by a lawyer. Operator fields that are not filled in yet appear as “Not published yet”.
Operator / imprint
Identification of the service provider for this site and for the Whispera chat service, as required for information-society services.
- Service
- Whispera
- Operator
- Legal form
- Address
- Postal code
- City
- Country
- Hungary
- Phone
- Company number
- Registry court
- Tax number
- EU VAT
- Hosting
There is no appointed data protection officer until one is named above. Contact the operator by email for privacy requests.
This marketing website
The pages under this site (Home, About, Web app, Desktop, Download, Legal) are static. They do not create a Whispera account.
| What | Where | Why | Required? |
|---|---|---|---|
| Theme preference (light / dark) | Browser localStorage, key whispera-theme |
Remember the sun/moon toggle | No. Stays on this device only |
| Font files | Bunny Fonts CDN (fonts.bunny.net) |
Load Plus Jakarta Sans | Yes for this design. Your IP is sent to that CDN |
| Analytics, ads, pixels | — | Not used | — |
| Cookies on this site | — | None set by these pages | — |
The theme setting is not a tracking cookie. There is no cookie banner on this site while no non-essential cookies or analytics are present.
The chat service
If you open the web app and create an account, Whispera processes the data below to run one-to-one encrypted chat. The server stores social-graph records and ciphertext. It does not open message bodies.
Controller: the operator named above. Recipients: the operator and anyone they give database or log access to; a TLS terminator or reverse proxy can see IP addresses and SNI.
Data stored on the server
| Data | Place | Notes |
|---|---|---|
| User id, username, password hash, created time | users |
Username is unique. Password is Argon2id, never stored in plaintext |
| Optional phone (E.164) | users.phone |
Only on your own profile endpoint. Not in public user JSON |
| Optional profile photo | users.avatar |
JPEG / PNG / WebP, max 256 KiB. Visible to you and accepted friends |
| Session id, user id, token hash, expiry | sessions |
Raw session token is only in the cookie or Bearer header. Server keeps SHA-256 |
| Friendship pair, who requested, status, timestamps | friendships |
Accepted friends and pending requests |
| Blocker, blocked, created time | blocks |
Unblock does not restore a friendship |
| X25519 public key (32 bytes), algorithm, timestamps | user_public_keys |
One public key per user. Private key is never uploaded |
| Message id, sender, recipient, client id, nonce, ciphertext, time | messages |
No plaintext column. History is the sealed packet |
Legal bases we rely on for this MVP: performing the chat service you request (account, friends, delivery of sealed messages), and securing the service (rate limits, session cookies). Optional phone and photo are only stored if you add them.
What is not stored
- Message plaintext
- Identity secret keys
- Wrapping keys or IndexedDB blobs on the server
- A plaintext copy of the session token (only a hash)
- Display names or email addresses
- Read receipts, typing indicators, reactions
- Message-body search indexes
- Push tokens
- Analytics events, advertising ids, or third-party trackers in the app
The API rejects JSON fields named plaintext and
secret_key. Request logs record HTTP method, path,
status, request id, and duration. They do not record query strings,
cookies, bodies, passwords, tokens, or keys.
Metadata the operator can see
End-to-end encryption covers message text, not the fact that you talked. Without opening a box, the operator can still see:
- Usernames and when accounts were created
- Who is friends with whom, pending requests, and blocks
- Who published or rotated a public key, and when
- Who sent a message to whom, at what time, and the size of the ciphertext
- Whether two users have an active WebSocket (in process memory, not a table)
- Client IP as seen by the process, used for rate limiting — not written to the application log
- Approximate message length (ciphertext length is an upper bound)
Friendship and message timestamps are enough to build a social graph and an activity timeline. The server cannot read the UTF-8 contents of a correctly sealed message, and cannot see the X25519 secret if the client never sends it.
On your device
| What | Where | Notes |
|---|---|---|
| Wrapped identity secret | IndexedDB in that browser | Salt, wrap nonce, Argon2id limits, ciphertext. Unwrap uses your account password |
| Unlocked secret and open chat | Process memory while the tab is unlocked | Cleared on lock / logout. A memory dump of an unlocked device still wins |
| Session cookie + CSRF cookie | Browser cookies on the app origin | Session is HttpOnly. Needed to stay signed in. Not written to localStorage |
| Theme on this marketing site | localStorage |
Separate from the chat app |
A new browser does not receive the old key. Private browsing may wipe IndexedDB when the session ends. Losing the password or the IndexedDB record means losing old messages. There is no recovery.
Third parties
The implemented chat client includes no analytics SDK, crash reporter, advertising pixel, or CDN-hosted app script. This marketing site loads fonts from Bunny Fonts, as listed above.
If a native app is listed on Google Play or the App Store later, those stores have their own privacy terms. Push notifications are not in this MVP; adding them would create extra metadata (device tokens, wake-ups).
Retention and deletion
- Ciphertext is kept so history can be paged and so an offline recipient can fetch later.
- There is no per-message delete API and no disappearing-message timer in this MVP.
- Deleting the account cascades to sessions, friendships, blocks, public key, and messages you sent or received.
- Login revokes other sessions. A session lasts until expiry (24 hours) or logout.
Your rights
If GDPR / the Hungarian Privacy Act applies to you, you may request access, correction, deletion, restriction, and portability of personal data the operator holds, and you may object to processing based on legitimate interest. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or with your local EU supervisory authority.
Use the operator email above. Account deletion in the app is the self-serve path for wiping the rows listed under stored data.
Limits we do not hide
- Whispera is an MVP, not a Signal replacement.
- There is no third-party security audit yet.
- There is no forward secrecy. A stolen identity secret decrypts stored boxes sealed to that key.
- Public keys are trust-on-first-use. The server could serve a different key.
- A compromised or malicious web origin can exfiltrate passwords, unlocked secrets, and plaintext.
- The operator can drop, delay, or reorder messages, and can see the metadata listed above.
Using the service is at your own risk. Do not use it for high-risk conversations until it has been independently reviewed.