Privacy

Last updated: 30 August 2026

Whale is a small app for sharing what you are listening to and watching with people you choose. This page says what it stores, why, and who else sees it. It describes the app as it actually works.

Whale is made by one person: Vinicius Peron, an independent developer. There is no company behind it.

What Whale stores about you

Your account. When you sign up Whale stores an email address, or the identifier your sign-in provider returns if you use Sign in with Apple or Google. Your email is held by Firebase Authentication and is not copied into the rest of the database.

Your profile. A handle, a display name, a bio if you write one, and a profile photo if you upload one. Also whether your account is private, and whether you can be suggested to other people.

What you share and write. The links you post and any caption you add; your comments and replies; your loves and saves; who you follow and who follows you; the coves you belong to; and any direct messages you send.

A note about direct messages. Messages are private between the people in the conversation, and I do not read them. They are not end-to-end encrypted. They are stored on Whale's servers and I could technically access them, which is the honest position and the one you should assume.

Your device, for notifications. If you turn on notifications Whale stores a push token for each of your devices so Apple can deliver them.

Everything is linked to you. There is no anonymous posting in Whale. Every record above is tied to your account.

What Whale does not do

• No advertising, and no advertising identifiers. No IDFA, and nothing that asks to track you across other apps.
• No analytics. No analytics SDK ships in the app, and no usage events are sent.
• No data brokers. Your data is never sold or shared with one.
• No access to your contacts. An unfinished contacts screen once existed; it was never reachable, it never read a single contact, and it was removed in August 2026.
• No tracking as Apple defines it. Nothing from Whale is combined with third-party data for advertising.

Some things are public, and you should know which

Your profile photo is public. It is stored at a fixed web address that anyone who knows your account's internal id can open, without signing in and even if your account is private. This is deliberate — it keeps photos from breaking when they are re-uploaded — but it means the photo should be one you are comfortable being public.

Your handle is public. Handles map to accounts so people can find and mention you.

Names travel with reactions. When you love, save or comment, your display name is stored alongside that action so it can be shown to whoever can see it.

Who else is involved

Google (Firebase). Whale runs on Firebase — Authentication, Firestore, Storage, Cloud Functions and Cloud Messaging. Everything described above is stored on Google's infrastructure. Google acts as Whale's infrastructure provider and does not use it for its own purposes.

Apple. Push notifications are delivered through Apple's service. If you use Sign in with Apple, Apple handles that sign-in.

The sites your links point to. When you share a link, Whale's server fetches that page once to read its title, artist and artwork. The request comes from that server, not from your device, and carries nothing about you — only the link itself.

For a few services the server asks a published preview endpoint instead: youtube.com, api.deezer.com and soundcloud.com. Everything else — including film and TV — is read from tags on the page itself. There is no film or TV metadata service involved.

Artwork loads directly from those sites. Album and video artwork is loaded by your device from whichever service it belongs to — Spotify, YouTube, Apple Music, Deezer, SoundCloud and others. Whale sends them nothing, but the request itself tells that service your IP address and roughly when you looked. This is how images work on the web; I mention it because it is the least obvious thing in this list.

Resend. When someone reports content, an email is sent to me so I can act on it, using a service called Resend. That email is the only thing Resend ever handles.

How long things are kept

While your account exists, your content stays — that is what the app is for.

When you delete your account, it is deleted. There is no grace period and no soft delete. Your account disappears from the app immediately, and a background job then removes your follows, reactions, comments, cards, cove memberships, message threads, activity, blocks, your profile document, your uploaded photo and your sign-in record. It runs in stages and finishes on its own.

Two honest exceptions. Comments you posted in someone else's thread may leave a marker saying a deleted account wrote there, so the replies around them still make sense. And anything another person already saw or saved to their own shelf is theirs, and I cannot reach into their copy.

You can delete your account from inside the app, in Settings. You do not need to email me.

Children

Whale is not intended for children under 13, and I do not knowingly create accounts for them.

Changes

If this page changes, the date at the top changes with it.

Contact

Questions about privacy, or a request about your data, email me: support@getwhale.app