Privacy Policy

1. Who we are

WUSIR ("we", "us") operates the website at wusir.tech, the WUSIR iPhone app (including its community features and private messages), and the underlying check API. The data controller responsible for the processing described below is:

Martin Molokáč
Donská 27 · 841 06 Bratislava · Slovakia
Contact: support@wusir.tech

2. What we collect, and why

a) Your WUSIR account

To create an account in the app you give us an e-mail address and a password, and you confirm that you are at least 16 years old. We store the e-mail address, a one-way hash of the password (never the password itself), when the account was created, when your e-mail was verified, when you confirmed your age, and which version of our Terms you accepted and when. Signing in creates a session; we keep only a hash of its token, when it was created and last used, and whether it was signed out. If you joined with an invite code, we record who invited you. The account is also linked to the iPhone the app runs on through a device key created by the app (see "Provenance Registry" below). We do not store your IP address or browser/device details with your account.

When you verify your e-mail or reset your password, we send you a six-digit code by e-mail from noreply@wusir.tech through our own mail server. We store only a hashed form of the code; it expires after 15 minutes and works a limited number of times. A record that a code was sent is kept to enforce sending limits, until the account is deleted.

b) Your profile

Your profile consists of a handle (@name), and optionally a display name, a short bio and a profile photo. Profile photos are re-encoded on our server into two small JPEG sizes with all metadata removed. Your previous handles are kept for 30 days to enforce the rename cooldown.

c) Posts

A post is a photo you took and registered with the WUSIR camera, with an optional caption and an optional place name. The place name is text you choose; to suggest one, your iPhone asks Apple's map service to turn the photo's location into a place name. We never keep the file you upload: our server re-encodes the photo into two JPEG versions (up to 1600 pixels on the long side) and removes all metadata, including EXIF and GPS. A post is shown either to all WUSIR members ("public") or only to people on your Close Friends list. You can turn comments off for a post and delete it at any time.

d) Comments, likes, follows, views and Close Friends

We store the comments you write (and what they reply to), the posts you like, the people you follow and who follows you, and your Close Friends list (the people you add are not told). To avoid showing you the same posts again and to give authors a view count, we also record once that you viewed a post. Only the author of a post sees who liked it.

e) Notifications

The app shows notifications inside the app when someone likes or comments on your post, replies to your comment or starts following you. We store one record per such event and whether you have read it. Undoing the action (an unlike or unfollow) removes the notification while it is unread. We never notify across a block.

The app can also send push notifications (for new messages, likes, comments and replies, and new followers) through Apple's Push Notification service (APNs). For this we store the push token that iOS issues to your iPhone for WUSIR, linked to your account's chat device, and we send Apple a short notification text (for example “@handle liked your post”) addressed to that token. The text of a private message is never part of a notification. iOS asks for permission only after your first sent message or post, or when you switch a notification type on; you can decline, and nothing in the app depends on it. You choose which types may send a push in Settings → Notifications, and you can turn all of them off in iOS Settings → Notifications → WUSIR.

f) Reports, blocks and moderation

You can report a post, comment, profile or conversation, and block another member. A report records who reported what, whose content it is, the reason you picked and an optional note; our moderators review it and record the outcome (for example keeping the content, removing it, removing a profile photo, or deactivating an account). After several open reports a profile's display name and bio are hidden until a moderator decides. A block is stored as a pair of accounts; blocking removes follows, notifications and chat between the two of you. Reports about a conversation are described in (g).

g) Private messages (WUSIR app chat)

Chat messages and photos are end-to-end encrypted on your iPhone before they leave it. Our servers cannot read them — not even we can. To deliver them we process only metadata: who sends to whom, when, and how large an encrypted message or photo is, plus the public keys your app publishes so others can start an encrypted conversation with you. The matching private key never reaches our servers: it stays on your iPhone and, because it is stored as a synchronizable Keychain item, is also kept in your iCloud Keychain (if you have it turned on), which Apple encrypts end to end and which can restore it on your other devices. An encrypted message is deleted from our server as soon as the recipient's iPhone confirms it; an encrypted photo when the recipient downloads it. Anything not delivered is deleted after 30 days. Message history is stored only on your iPhone and is not included in backups, so deleting the app deletes it and it does not move to a new iPhone. A first message to someone who does not follow you arrives as a message request, which they can accept or ignore.

Messages can be set to disappear after a chosen time, and photos can be sent to be viewed once. Both are carried out by the apps on the two iPhones; our servers only ever hold the encrypted message until it is delivered. They cannot stop someone from copying a message or photographing a screen, and the sender is told when a screenshot is taken while a view-once photo is open.

If you report a conversation, the app attaches the most recent messages of that conversation (up to 20). You see a preview before you send and can cancel. They are sent to our moderators in readable form, together with your report and the handle of the other person. We cannot verify that attached messages are genuine.

h) Image checks (website, app & API)

When you upload a file to be checked, or paste the address of an image for our server to fetch, it is checked on our server and deleted right away: the image is held only for the duration of the check (if the upload is large, the server may buffer it in a temporary file), any temporary copy is deleted when the check finishes, and nothing is kept afterwards. We do not keep a copy of your images and do not use them to train any model. We do keep a lightweight usage log of each check — timestamp, which endpoint was used, the outcome (the result category and the codes of the reasons shown) and how long the check took — with no image content and no identifier that lets us link a log entry back to a specific person.

i) Provenance Registry (WUSIR camera & website lookup)

The WUSIR app lets you cryptographically register a photo at the moment it is captured, using your device's Secure Enclave and Apple App Attest. Doing so submits: a SHA-256 hash and a perceptual hash of the file, a device signature and device-identity keys, a capture timestamp, and — only if you allow location for the camera — GPS coordinates. Registered photos are linked to your account. Anyone (via the website or API) can later look up that exact file and see whether it was registered and when. A public lookup shows location only rounded to a coarse area, and none at all for a photo you have posted; if the photo is in a public post, the lookup may show your handle. Because this is a provenance/authenticity record, entries are designed to be tamper-evident and are not silently editable; you can delete your own entries in the app, and they are deleted with your account.

j) On your iPhone only

Your album of WUSIR photos and their original files, your chat history and your sign-in and encryption keys are stored on your iPhone (keys in the iOS Keychain). The app asks for the camera to take photos, for location only while you use it (to attach where a photo was taken, never in the background), for permission to add photos to your library when you save one, and for permission to send you push notifications (see 2(e)). It never gets access to your whole photo library: when you pick a photo yourself (for example to check it or as a profile photo), only that photo is shared with the app.

k) Website analytics

We run our own self-hosted analytics (Umami) on infrastructure we control. It does not use cookies, does not use any persistent identifier, and cannot follow you across other websites. It gives us aggregate, non-identifying figures such as page views, referrers, and approximate country of visitors. The app contains no analytics or advertising SDK and does not track you. No data is shared with Google, Meta, or any other third-party analytics or advertising network.

l) Correspondence

If you email support@wusir.tech, we keep that correspondence (hosted on our own mail server) for as long as needed to handle your request and any follow-up.

3. Who can see what

• Other members: your handle, display name, bio and profile photo; your posts according to the audience you chose; your comments; who you follow and who follows you.
• Only you: your e-mail address, your Close Friends list, your notifications, who liked your posts and how many people viewed them.
• Nobody but the two of you: the content of private messages (we cannot read it).
• Our moderators: reported content, the reporter's note and, for a reported conversation, the attached messages.
• Anyone on the internet: whether a specific photo file was registered, as described in 2(i). Community content is not visible outside the app.

4. Legal bases (GDPR Art. 6)

• Account, profile, posts, comments, likes, follows, notifications and chat delivery: performance of our contract with you (providing the service you signed up for).
• Reports, blocks, moderation and the age confirmation: legitimate interest in keeping the community safe, and compliance with legal obligations.
• E-mail codes and sending limits: performance of a contract and legitimate interest in protecting accounts from abuse.
• Check service and usage logs: performance of a contract / legitimate interest in operating and improving the service.
• Provenance Registry: consent — registering a photo, and especially including location, is an explicit, opt-in action you take in the app.
• Analytics: legitimate interest in understanding aggregate, non-identifying usage of the site.
• Correspondence: legitimate interest in responding to you, or performance of a contract if your request relates to one.

5. Retention

• Account, profile, posts, comments, likes, follows, views and Close Friends: until you delete them or delete your account.
• Push token: replaced whenever your iPhone issues a new one, and deleted when you sign out, when your chat device is replaced or removed, when Apple reports it as no longer valid, and when you delete your account.
• Notifications: until the cause is undone while unread, the content is deleted, one of you blocks the other, or an account is deactivated or deleted.
• Sessions: until you sign out or delete your account. E-mail code records: until the account is deleted.
• Uploaded or fetched images for checks: not retained — discarded immediately after analysis. The image address you paste is not stored.
• Check usage logs: contain no personal identifiers; kept in aggregate for product analytics.
• Registry entries linked to your account: until you delete them or your account. Entries registered without an account are kept for the working life of the registry.
• Correspondence: kept only as long as reasonably needed to resolve your request.

Chat: encrypted messages until delivered (at most 30 days), encrypted photos until downloaded (at most 30 days). Conversation metadata (who has a conversation with whom, whether it is a request, and when it was last active) is kept until either person deletes the conversation, one of you blocks the other, or an account is deactivated or deleted. Your chat public keys (identity key and signed prekey) stay with us after you sign out — marked inactive and no longer used to deliver anything — until your account is deactivated or deleted. Signing out does remove unused one-time keys and any undelivered messages for that iPhone.

Reports are kept as moderation records with no automatic expiry. Reports you filed are deleted when you delete your account. If an account that was reported is deleted, the report remains, closed, without a link to that account, and any chat messages attached to it are deleted.

Our servers are backed up regularly. Deleted data can remain in those backups until they are overwritten on a rolling basis; backups are used only to restore the service.

6. Deleting or deactivating your account

You can delete your account at any time in the app: Settings → Delete Account, confirmed with your password. Deletion is immediate and permanent. It removes your account, profile and profile photo, your posts and their photos, your comments, likes, views, follows, Close Friends, blocks, notifications, sessions, the reports you filed, your chat (conversations, keys, undelivered messages and photos) and the registry entries linked to your account. Your handle becomes free again. Messages you already delivered remain on the recipients' iPhones, which we cannot reach.

A deactivated account (by a moderator, or at your request) is not deleted: its posts are hidden from everyone and its handle stays reserved, while its follows, Close Friends, notifications, chat and profile photo are removed.

7. Where your data is processed, and who else is involved

Our servers, including the database, stored post photos, our mail server and our analytics, are hosted with Contabo GmbH in Germany (European Union). For visitors inside the EU/EEA, your data does not leave the EU. For users outside the EU/EEA, using WUSIR means your data is transferred to and processed in the EU, which — unlike the reverse direction — is not something GDPR restricts. We do not use any third-party AI or cloud API to check your images: every check runs on our own servers.

Apple is involved as the maker of the platform: App Attest confirms that registrations come from a genuine copy of the app, the Apple Push Notification service delivers push notifications to your iPhone (it receives your push token and the notification text), iCloud Keychain stores your chat key, and Apple's map service suggests place names. We do not sell your data or share it with advertisers or data brokers. We may disclose data where the law requires it.

8. Your rights

Wherever you are in the world, you can ask us — at support@wusir.tech — to: tell you what data we hold about you, correct it, delete it, export what we hold in a portable format, or object to a particular use of it. Most of your data you can also edit or delete yourself in the app (see Section 6). If you are in the EEA, UK, or Switzerland, these are your rights under the GDPR/UK GDPR, and you may also lodge a complaint with your local data protection authority. If you are in another jurisdiction with its own privacy law (for example the CCPA in California), we extend the same rights to you as a matter of policy, not just where legally required.

9. Age requirement (16+)

You must be at least 16 years old to create a WUSIR account; the app asks you to confirm this when you sign up and does not create an account without it. WUSIR is not directed at children, and we do not knowingly collect data from anyone under 16. If we learn that an account belongs to someone under 16, we will close and delete it. If you believe a child has provided us data, contact us at support@wusir.tech.

10. Security

All traffic to wusir.tech, the app's servers and our API is encrypted in transit (TLS/HTTPS). Passwords are stored only as salted hashes, and sign-in tokens and e-mail codes only as hashes. Private messages are end-to-end encrypted. Registry entries are protected by device-level cryptographic attestation (Secure Enclave signatures, Apple App Attest) so that entries can't be forged by a compromised client. We don't store uploaded or fetched images for checks at all, which limits what there is to protect in the first place.

11. Changes to this policy

If we materially change how we handle your data, we'll update the date at the top of this page and, where the change is significant, note it on the site or in the app.

12. Contact

Questions or requests about this policy: support@wusir.tech