Privacy policy

1. About this policy and the service

This policy describes data processing for Whytype, an AI assistant that can draft replies from content a user provides or captures, record and transcribe meetings, and provide search and companion watch features. The Whytype mobile app and backend are separate from the DizByte agency website. The identity of the legal entity that operates Whytype has not been confirmed in the materials reviewed; the operator must be identified here before publication.

DizByte developed the website and app. The exact allocation of controller, processor and service-provider responsibilities between DizByte and the Whytype operator must be confirmed by the operator and legal adviser.

2. Information processed

Depending on the features used, Whytype processes the following categories:

• Account and profile data: authentication account information, email address and sign-in provider information held through Supabase Auth; corresponding user records in public.users; and profile preferences and permission settings in public.profiles.
• Sessions and messages: session type, title, timestamps, source/mode, summaries and user/assistant message text inpublic.sessions and public.session_messages. This content may include text users paste, write or capture from another app.
• Search embeddings: message-derived text and vector embeddings in public.session_embeddings to support semantic search.
• Meetings: uploaded audio, storage paths, duration, recording time, transcript, detected language and transcript turns inpublic.meeting_audio. Meeting sessions and their messages are stored with the related session records.
• Journal screenshots: screenshots and their storage paths associated with journal sessions. Screenshots are stored in the private screenshots bucket.
• AI and usage records: AI events and usage ledger rows, which can include event/mode metadata, model labels, token counts, surface, cached status and cost information.
• Devices: phone session identifiers/platform and last-seen timestamps, and watch pairing identifiers, hashed pairing secrets and expiry/confirmation timestamps.
• Avatars: profile images users choose to upload. Theavatars storage bucket is public, so an uploaded avatar object may be retrievable by anyone who has its public URL.

Do not submit information you do not have the right to share. Conversation captures, screenshots, meeting recordings and transcripts may contain information about other people; consider this before using those features.

3. Registration and authentication

The app code supports email/password sign-in and sign-in with Google or Apple through Supabase Auth. These providers process authentication information under their own terms and privacy notices. Supabase account identifiers are associated with Whytype user and profile records. Google or Apple may provide the app with account identifiers and, depending on the provider and user settings, profile details such as email or name.

4. AI processing and service providers

Whytype sends user prompts and relevant conversation context to OpenAI APIs for chat completions. Web-search requests use the OpenAI Responses API. Text selected for semantic search is sent to OpenAI'stext-embedding-3-small embeddings API. Depending on the feature, this can include user-provided message text or text captured from another app. Meeting audio is processed by the app's authenticated Supabase Edge Function and, in the code reviewed, sent to Azure Speech for transcription. Transcripts may then be saved to Whytype and used for meeting summaries or search.

The app code reviewed does not establish the retention, training or deletion settings configured for each provider account. OpenAI, Microsoft Azure, Supabase, Google, Apple and RevenueCat may process data under their respective service terms and settings. This policy does not claim that AI providers never retain submitted data. The operator must verify and document the provider plans, retention settings and any applicable opt-outs before publication.

The repository also contains RevenueCat integration for subscription entitlements. Whether RevenueCat and store subscriptions are currently configured for production has not been verified. If enabled, RevenueCat and the relevant app store process purchase and entitlement information.

5. How information is used and disclosed

Information is processed as needed to:

• create, authenticate and maintain user accounts and profiles;
• provide reply generation, web search, embeddings and meeting features;
• store, retrieve and synchronize sessions, audio, screenshots and avatars;
• pair phone and watch devices and maintain phone-session state;
• measure AI usage and support service operations; and
• protect the service, address support requests and meet legal obligations.

Data may be disclosed to the providers described above, to a person the user chooses to share it with through their own actions, or where disclosure is required by law or necessary to protect people, rights or service security. The repository does not establish a complete list of operational staff access or all production subprocessors; the operator must confirm that list.

6. Storage, access and security

Supabase provides the app's authentication, database and object storage. The reviewed migrations configure meetings andscreenshots as private buckets, with storage policies scoped to the first path segment matching the authenticated user ID. Theavatars bucket is public by design. Database row-level security policies are present on several user-owned tables; this policy does not assert that every table or production configuration has been independently tested.

The service uses technical and organizational safeguards appropriate to its operation, but no internet transmission or storage system can be guaranteed completely secure. The operator should verify production access controls, secrets handling, backups and incident procedures.

7. Retention, deletion and privacy choices

The repository does not establish a fixed retention schedule for account data, conversations, embeddings, meeting audio, screenshots, AI events, backups or provider logs. Data is not represented here as being stored indefinitely or erased immediately. Retention may depend on feature use, account state, provider terms, backup cycles, security needs and legal obligations. The Whytype operator must set and publish concrete retention periods and deletion handling before publication.

Some app records can be removed through in-app session or meeting controls. A public deletion request can be submitted at Account deletion. Submission is not confirmation that ownership has been verified or that deletion has completed. The authenticated account-deletion Edge Function and associated database migration were not present in the audited repository; secure account-wide deletion is therefore not yet available through this website.

Depending on applicable law, users may request access, correction, portability, restriction or deletion of personal data. Use the account deletion page for a deletion request or the DizByte contact form for other privacy questions. The form operator and request-handling process must be confirmed before publication.

8. Children's privacy

Whytype is not designed or marketed as a children's service. The materials audited do not establish a product-specific minimum age, age verification, parental controls or a child-safety reporting/moderation system. Users must meet the minimum age required by applicable law and app-store terms. The operator must choose and publish a clear age eligibility rule before release; this page does not claim that the app verifies a user's age.

See the Whytype Child Safety Standardsfor prohibited conduct and the current reporting limitations.

9. International processing

Supabase, OpenAI, Microsoft Azure, Google, Apple and RevenueCat may process information in countries other than the user's country. The Supabase project region and the complete set of applicable transfer safeguards were not established by this repository audit. The operator must confirm data-region choices, cross-border transfer mechanisms and relevant disclosures for the markets where Whytype is offered.

10. Subscriptions and payments

If paid features are enabled, purchases may be handled by Apple's App Store or Google Play and subscription entitlement state may be processed by RevenueCat. Whytype does not need to receive full payment-card details for store-billed subscriptions. Account deletion does not itself cancel a recurring store subscription. Cancel it separately through the store or provider that billed you. The current production billing configuration must be confirmed by the operator.

11. Changes and privacy contact

This policy may change as the app, providers or legal requirements change. Material changes should be reflected here with a revised date and, where required, communicated to users.

The legal entity operating Whytype and an official privacy contact were not established by the audit. Until the operator publishes verified details, users may use the DizByte contact form; that route is a general agency contact channel, not a verified dedicated Whytype privacy office. The operator must confirm ownership, monitored contact details and request escalation procedures before publication.