✅ A 90-second ritual. Switch your state on demand.
Whiff State OS — Privacy Policy
Last updated: 28 July 2026
This policy explains what the Whiff State OS mobile application collects, why it collects it, and what control you have over it. It applies to the app only. Purchases made on whiffit.in are covered by our main store privacy policy.
Who we are
Whiff State OS is operated by HerbNexus Private Limited (CIN: U20118MH2025PTC443699), registered at 52 Vidya Nagar, Near Shitla Mata, Nagpur 440024, Nagpur, Maharashtra, India.
For any privacy question or request, contact us at support@whiffit.in.
What we collect
We collect only what the app needs to work. We do not sell your data, and we do not use it for advertising.
Account information
- Mobile phone number — used to create your account and to sign you in with a one-time password (OTP). This is the only identifier we require.
Usage information
- Ritual sessions — which protocol you ran, which state it belongs to, and when you completed it.
- Streaks and milestones — your current and longest streaks, calculated from your completed sessions.
- Notification preferences — the reminders you have enabled, your quiet hours, and your time zone.
- What you write — the notes, tasks, reflections and intentions you write in the app, stored so they can be shown back to you later.
Device information
- Push notification token — an anonymous identifier issued by your device's operating system, used to deliver notifications you have opted into. It is not linked to any advertising profile.
- Device type and model — for example "Android" and your handset model, used to deliver notifications correctly and to diagnose problems.
What we do not collect
- We do not collect your location.
- We do not access your contacts, photos, camera, microphone, or files.
- We do not collect payment or card details in the app. Purchases happen on our website, which uses its own secure payment processing.
- We do not use advertising identifiers or third-party ad networks.
How we use your information
- To sign you in and keep your account secure.
- To record completed sessions and calculate your streaks so your progress is saved and survives a reinstall or a change of phone.
- To store what you write in the app and show it back to you later, so you can see how your practice has changed over time.
- To send you the reminders and notifications you have chosen to receive.
- To understand, in aggregate, how the app is used so we can improve it.
- To respond to you when you contact us for support.
We rely on your consent to send notifications, and on the necessity of processing to provide the service you have asked for in respect of your account and session history. You can withdraw consent to notifications at any time in your device settings or in the app.
Who we share it with
We share data only with service providers that make the app function. Each processes data on our instructions.
- Supabase — hosts our database and authentication. Your account and session data are stored here.
- Expo — delivers push notifications from us to your device.
- Google (Firebase Cloud Messaging) — delivers notifications on Android devices.
- Apple (Push Notification service) — delivers notifications on iOS devices.
- Our SMS provider — delivers your one-time login passwords. Your phone number is shared for this purpose only.
We do not sell, rent, or trade your personal data. We may disclose information if we are legally required to do so, or to protect our rights or the safety of others.
Where your data is stored
Your data is stored on servers operated by our hosting provider in Northeast Asia (Seoul), ap-northeast-2. Some of our service providers may process data outside India. Where that happens, we take reasonable steps to ensure your data remains protected to a comparable standard.
How long we keep it
We keep your account and session data for as long as your account is active, because your streak history depends on it. If you delete your account, we delete your personal data within 30 days, except where we are required to retain something longer by law.
Your rights
You have the right to:
- Ask what personal data we hold about you and get a copy of it.
- Ask us to correct anything inaccurate.
- Ask us to delete your account and your data.
- Withdraw your consent to notifications.
- Raise a grievance about how we handle your data.
To exercise any of these, email support@whiffit.in. We will respond within 30 days.
Deleting your account
You can delete your Whiff State OS account and all associated data in two ways:
- In the app — open Settings, scroll to the bottom, and choose Delete my account. You will be asked to confirm twice.
- By email — write to support@whiffit.in from the phone number associated with your account, and we will delete it for you within 30 days.
Deleting your account permanently removes your phone number and account record, your completed sessions and streak history, anything you have written in the app (State Capsule entries and work block task names), your reward and milestone records, and your notification preferences and push token. Nothing is kept afterwards except where we are required to retain it by law. This cannot be undone, and streak progress cannot be restored.
Security
Access to your data is protected by authentication and database access rules, and data is encrypted in transit. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
Children
Whiff State OS is not intended for, and not directed at, anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top of this page, and where the change is significant we will tell you in the app before it takes effect.
Contact
HerbNexus Private Limited
52 Vidya Nagar, Near Shitla Mata, Nagpur 440024
Nagpur, Maharashtra, India
support@whiffit.in