Privacy Policy

Effective date: March 10, 2026

Whimit ("we", "us", or "our") operates the Throw mobile application (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We may collect the following information when you use the Service:

Email address
Content you post on the Service (posts, replies, direct messages)
Subscription and purchase information
Device information and access logs (IP address, browser type, operating system, etc.)

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing and operating the Service
User authentication and account management
Managing paid subscriptions and processing payments
Analysing usage and improving the Service
Responding to inquiries and support requests
Detecting and preventing fraud or violations of our Terms of Service

3. Legal Basis for Processing (EEA / UK Users)

If you are located in the United Kingdom or European Economic Area, we process your personal data on the following legal bases:

Contract performance: Processing necessary to provide the Service you have signed up for.
Legitimate interests: Improving the Service, preventing fraud, and ensuring security.
Legal obligation: Complying with applicable laws and regulations.
Consent: Where you have given us explicit consent (e.g. optional notifications).

4. Third-Party Services

The Service uses the following third-party services, which may process your information in accordance with their own privacy policies:

Supabase – Authentication and database management
Vercel – Hosting and server infrastructure
RevenueCat – Subscription management
Apple App Store / Google Play – Payment processing

We encourage you to review the privacy policies of these third-party providers.

5. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including the United States. These countries may have data protection laws that differ from those in your country.

Where required by applicable law (including UK GDPR), we ensure appropriate safeguards are in place for such transfers.

6. Sharing of Information

We do not sell, trade, or otherwise transfer your personal information to third parties, except in the following circumstances:

When required by law or legal process
When necessary to protect the rights, property, or safety of Whimit, our users, or the public
With service providers acting on our behalf, under appropriate confidentiality obligations

7. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Service. If you delete your account, we will delete or anonymise your information within a reasonable period, except where retention is required by applicable law or for legitimate operational purposes.

8. Data Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data ("right to be forgotten").
Restriction: Request that we limit the processing of your data.
Portability: Request your data in a structured, machine-readable format.
Objection: Object to processing based on legitimate interests.
Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 12.

10. Account Deletion

You may delete your account at any time from the Settings screen within the app. Upon account deletion, we will delete or anonymise your associated information, except where retention is required by law or for legitimate operational purposes.

11. California Privacy Rights (CCPA)

This section applies to residents of California under the California Consumer Privacy Act (CCPA).

California residents have the right to:

Know what personal information we collect, use, disclose, or sell.
Request deletion of personal information we have collected.
Opt out of the sale of personal information. We do not sell personal information.
Non-discrimination for exercising CCPA rights.

To submit a request, please contact us at the address below. We will respond within 45 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will take effect when posted within the Service or on our website. We encourage you to review this policy periodically.

For material changes, we will provide notice through the Service or by email where required by applicable law.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Operator: Whimit

Email: whimit.jp@gmail.com

If you are located in the UK or EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK at ico.org.uk).