Privacy Policy

Account information. When you sign up, we collect your email address and a password (stored as a one-way bcrypt hash — we never see or store your actual password) or, if you sign in with Google or Apple, the name and email address that provider shares with us. Optional profile fields you fill in — display name, avatar, daily goal, use-case preferences — are stored too.

Tasks and content you create. Everything you type or speak into Wispr — task titles, notes, subtasks, tags, spaces, due dates — is stored so it can sync across your devices and stay available offline.

Voice recordings. When you capture a task by voice, the recording is uploaded securely and sent to our transcription provider to turn it into text and pull out a date, time, and category. The audio is deleted immediately after processing. It is only kept longer if you explicitly turn on a "keep my recordings" setting (off by default).

Location, only when you attach it to a task. Wispr does not track your location in the background. If you attach a place to a task (e.g. "pick up milk" reminding you near a store), we store that location's name and coordinates for that task. Spoken place names are resolved using Google Places and OpenStreetMap.

Google Calendar, if you choose to connect it. If you connect Google Calendar, Wispr reads your events so they appear alongside your plan, and — only if you switch on calendar writing — adds or updates events you create in Wispr. This is opt-in, it is the only Google service Wispr can reach, and you can disconnect it at any time in Settings. What we read, what we keep, and how it is protected is spelled out in "How we protect your Google Calendar data" below.

Purchase and subscription status. If you subscribe to Wispr Pro, our payments provider (RevenueCat) and Apple/Google's own store handle the transaction; we only receive your subscription status, not your payment details.

Crash and performance data. We use Sentry to catch crashes and errors so we can fix them. This includes device/OS information and a stack trace of what went wrong — not the content of your tasks.

Knowingly collecting data from children. Wispr Tasks is a productivity tool built for adults. We don't knowingly collect personal data from children under 13 — the threshold set by the US Children's Online Privacy Protection Act ("COPPA"), which we apply globally. App Store and Google Play may classify the app as 4+ for content, but that's a content rating, not a license to collect data from children. If you believe a child under 13 has created an account, email us at the address below and we'll delete the account and any associated data.

We don't sell your data. We don't run behavioral advertising. We don't use your tasks or voice recordings to train AI models. We don't track you across other apps or websites.

Your account and task data live in a managed Postgres database (Neon). Voice recordings and avatar images, when kept, are stored in Google Cloud Storage. Both providers encrypt data at rest and in transit.

Connecting Google Calendar is optional. When you do connect it, Wispr asks for exactly one permission — `https://www.googleapis.com/auth/calendar.events` — and nothing else. Wispr cannot read your Gmail, your contacts, your Drive, or any other Google service, because it never asks for access to them.

We keep three fields, and no more. For events in a window around today we store the event's title, its start time, and its Google event id (so the same event doesn't import twice). We do not copy or store event descriptions, attendee names or email addresses, locations, attachments, conferencing links, or calendars other than your primary one.

Encrypted in transit and at rest. Every connection between the app, our API, and Google runs over TLS. Your Google access and refresh tokens are additionally encrypted by us with AES-256-GCM before they are written to the database, so they stay unreadable to anyone holding a copy of the raw database — our database provider included. The database and file storage are themselves encrypted at rest by Neon and Google Cloud Storage.

Almost nobody can reach it, and no human reads it. Your calendar data is processed by automated systems only. No employee, contractor, or subprocessor reads it, and it is never reviewed manually. Administrative access to the production database is limited to the single developer who runs the service, protected by two-factor authentication, and used for keeping the service running — not for reading user content.

Erased when you disconnect. Disconnecting Google Calendar in Settings revokes the token with Google and erases our stored copy in the same step, so the authorization stops existing on both sides rather than merely going unused. Deleting your account does the same before it removes everything else. You can also revoke Wispr's access yourself at any time from your Google Account permissions page.

Never sold, never used to train AI. We do not sell Google user data, transfer it to advertisers or data brokers, use it for advertising or profiling, or use it to train, retrain, or improve any AI or machine-learning model — ours or anyone else's. Voice transcription never receives calendar data.

If something goes wrong. If we ever discover a breach affecting your data, we notify affected users and the relevant supervisory authority without undue delay and within 72 hours of becoming aware of it, as the GDPR requires.

Limited Use. Wispr Tasks' use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Groq (voice transcription and parsing), Google Places / OpenStreetMap (location lookup), RevenueCat (subscription management), Sentry (crash reporting), Google / Apple (sign-in), and Google Calendar (only if you connect it). Each only receives the minimum data needed to do its job, described above. We never pass your Google Calendar data to any of the others.

From Settings → Profile, you can export or clear your task data at any time, or permanently delete your account and everything tied to it — this removes your tasks, recordings, and profile from our systems. If you'd rather email us, reach out using the address below and we'll do it for you.

European law asks us to name the legal ground for each thing we do with your data, so here it is in plain terms.

To run the app you signed up for. Your account details, tasks, voice recordings, the places you attach and your subscription status are processed because you asked us to run Wispr Tasks for you — a contract, in legal terms. Without them there is no app.

Because you said yes. Connecting Google Calendar, and receiving product emails, happen only on your explicit consent. You can take that consent back whenever you like by disconnecting the account in Settings or unsubscribing from the email, and doing so doesn't undo anything that was lawful while you'd given it.

Because it keeps the service working. Crash and error reports rest on our legitimate interest in fixing what breaks. They carry device and error information, never your task content. You can object to it, though in practice that means deleting the account, since we can't run the app blind.

Your account and tasks stay until you delete them. Nothing expires on its own.

Voice recordings are deleted immediately after transcription, unless you turned on "save my recordings" — then they live as long as the account does.

Google Calendar access ends the moment you disconnect: we revoke the token with Google and erase our stored copy, so we can no longer read anything. Events already imported stay in your task list as ordinary tasks of yours — delete them individually, or delete your account to remove everything at once.

Crash reports age out within 90 days, enforced by Sentry.

Backups roll on a 30-day window. Deleted rows leave the live database at once and finish ageing out of backups within those 30 days.

Billing records are kept by Apple and RevenueCat under their own tax and accounting duties. Those are not ours to delete.

Wispr Tasks is run from Colombia, and the providers that store and process your data sit in the United States and Europe, so your data does cross borders. Each provider operates under its own transfer safeguards — standard contractual clauses or a recognised adequacy framework — and we don't send your data anywhere beyond the providers named above.

If the GDPR applies to you, you can ask us to show you what we hold, correct it, delete it, hand it over in a portable format, restrict what we do with it, or stop processing that rests on legitimate interest. Most of that you can do yourself in Settings, immediately and without asking anyone. For the rest, write to privacy@wisprtasks.xyz and we'll answer within a month.

You can also complain to the data protection authority of the country where you live or work, or where you think something went wrong. You don't have to come to us first.

If this policy changes in a material way, we'll update the date at the top of this page and, for significant changes, notify you in the app.

Questions about your data? Reach the team at privacy@wisprtasks.xyz — Off The Shelf Studio reads everything sent here. The person responsible for your data — the data controller — is Danilo Santiago Vanegas Saenz, an independent developer in Colombia trading as Off The Shelf Studio.