Last updated: 31 August 2026
This policy explains what the Whiff State OS mobile application collects, why it collects it, and what control you have over it. It applies to the app only. Purchases made on whiffit.in are covered by our main store privacy policy.
Who we are
Whiff State OS is operated by HerbNexus Private Limited (CIN: U20118MH2025PTC443699), registered at 52 Vidya Nagar, Near Shitla Mata, Nagpur 440024, Nagpur, Maharashtra, India.
For any privacy question or request, contact us at support@whiffit.in.
What we collect
We collect only what the app needs to work. We do not sell your data, and we do not use it for advertising.
Account information
- Mobile phone number — used to create your account and to sign you in with a one-time password (OTP). This is the only identifier we require.
Usage information
- Ritual sessions — which breathing exercise you ran, which state it belongs to, and when you completed it.
- Streaks, rewards and milestones — your current and longest streaks, unlocked rewards, initiation history and initiation milestones.
- Notification preferences — the reminders you enabled, your quiet hours and your time zone.
- What you write — intentions, tasks, first-visible actions, State Capsule entries, feelings and reflections, stored so they can be shown back to you later.
Device information
- Push notification token — an anonymous identifier issued by your device's operating system, used to deliver notifications you have opted into. It is not linked to any advertising profile.
What we do not collect
- We do not collect your location.
- We do not access your contacts, photos, camera, microphone or files.
- We do not collect payment or card details in the app. Purchases happen on our website, which uses its own secure payment processing.
- We do not use advertising identifiers or third-party ad networks.
How we use your information
- To sign you in and keep your account secure.
- To record completed sessions and calculate your streaks so your progress is saved and survives a reinstall or a change of phone.
- To store what you write in the app and show it back to you later, so you can see how your practice has changed over time.
- To send you the reminders and notifications you have chosen to receive.
- To understand, in aggregate, how the app is used so we can improve it.
- To respond to you when you contact us for support.
We rely on your consent to send notifications, and on the necessity of processing to provide the service you have asked for in respect of your account and session history. You can withdraw consent to notifications at any time in your device settings or in the app.
Who we share it with
We share data only with service providers that make the app function. Each processes data on our instructions.
- Supabase — hosts our database and authentication. Your account and session data are stored here.
- Expo — delivers push notifications from us to your device.
- Google (Firebase Cloud Messaging) — delivers notifications on Android devices.
- Apple (Push Notification service) — delivers notifications on iOS devices.
- Our SMS provider — delivers your one-time login passwords. Your phone number is shared for this purpose only.
We do not sell, rent or trade your personal data. We may disclose information if we are legally required to do so, or to protect our rights or the safety of others.
Where your data is stored
Your data is stored on servers operated by our hosting provider in Northeast Asia (Seoul), ap-northeast-2. Some of our service providers may process data outside India. Where that happens, we take reasonable steps to ensure your data remains protected to a comparable standard.
How long we keep it
We keep your account and session data for as long as your account is active, because your streak history depends on it. If you delete your account, we delete your personal data within 30 days, except where we are required to retain something longer by law.
Your rights
You have the right to:
- Ask what personal data we hold about you and get a copy of it.
- Ask us to correct anything inaccurate.
- Ask us to delete your account and your data.
- Withdraw your consent to notifications.
- Raise a grievance about how we handle your data.
To exercise any of these rights, email support@whiffit.in. We will respond within 30 days.
Deleting your account
You can delete your Whiff State OS account and all associated data in two ways:
- In the app — open Settings, scroll to the bottom and choose Delete my account. You will be asked to confirm twice.
- By email — write to support@whiffit.in and include the mobile number associated with your account. We may ask you to verify that you own the account before completing the request.
Deleting your account permanently removes your phone number and account record, completed sessions and streak history, State Capsule entries, intentions, first-visible actions, reflections, work-block task names, initiation history and milestones, reward records, notification preferences and push token. Nothing is kept afterwards except where we are legally required to retain it. This cannot be undone, and your streak progress cannot be restored.
Security
Access to your data is protected by authentication and database access rules, and data is encrypted in transit. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
Children
Whiff State OS is not intended for, and not directed at, anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the date at the top of this page. Where the change is significant, we will tell you in the app before it takes effect.
Contact
HerbNexus Private Limited
52 Vidya Nagar, Near Shitla Mata, Nagpur 440024
Nagpur, Maharashtra, India
support@whiffit.in