NewYour apps can now ship to the app storesShip your apps to the app stores
Legal  ✦

Privacy Policy

Privacy PolicyTerms of ServiceDPASub-processors

Privacy Policy

How we collect, use, and protect your information.

Last updated: May 13, 2026

This Privacy Policy describes how Promnes Lane Technology Inc, doing business as Whacka (“we,” “us,” or “our”), collects, uses, and protects your information when you use our service at whacka.app (the “Service”).

Promnes Lane Technology Inc is the data controller for personal data processed through the Service. Our business address is 8 The Grn Ste A, Dover, DE 19901, United States. For privacy inquiries, contact us at [email protected].

1. Information we collect

Information you provide

  • Account information: email address, display name, username (handle), and avatar.
  • Authentication credentials: password (stored securely via Supabase Auth) or Google OAuth tokens.
  • Payment information: processed by Stripe; we store your Stripe customer ID but do not directly store credit card numbers.
  • Content you create: app descriptions, published apps, comments, and profile information.

Information collected automatically

  • Usage data: pages visited, features used, app generation requests.
  • Device information: browser type, operating system, screen size.
  • Push notification tokens: if you opt in to push notifications.

Information from third parties

  • Google OAuth: if you sign in with Google, we receive your email address and profile information as authorized by you.

2. How we use your information

We use your information to:

  • Provide and maintain the Service.
  • Process app generation requests using AI services.
  • Process payments and manage subscriptions.
  • Send transactional emails (account verification, password reset).
  • Send push notifications (if opted in).
  • Display your profile and published apps to other users.
  • Enable social features (likes, comments, follows, bookmarks).
  • Improve the Service and develop new features.
  • Prevent fraud and enforce our Terms of Service.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

  • Performance of a contract (Art. 6(1)(b) GDPR): to provide the Service, process app generation requests, manage your account, and process payments.
  • Legitimate interests (Art. 6(1)(f) GDPR): to improve the Service, prevent fraud, and ensure platform security. Our legitimate interests do not override your fundamental rights.
  • Consent (Art. 6(1)(a) GDPR): to send push notifications and non-essential communications. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c) GDPR): to retain payment records and comply with applicable laws.

4. AI processing

  • Your app descriptions and prompts are sent to third-party AI services (Anthropic, OpenAI, Google) to generate application code, images, and audio.
  • We do not train our own AI models on your data. Our AI sub-processors process prompts under their respective API-tier data usage policies, which do not use API inputs for model training. See their DPAs linked at whacka.app/legal/subprocessors.
  • Third-party AI providers may have their own data processing policies.

5. Data sharing

We do not sell your personal information. We share data only with:

  • Supabase: database hosting and authentication.
  • Stripe: payment processing.
  • AI providers (Anthropic, OpenAI, Google): to process app generation and runtime requests.
  • Cloudflare: edge proxy, static asset delivery, and DDoS protection.
  • Resend: transactional email delivery.
  • Google OAuth: if you choose to sign in with Google.
  • Law enforcement: when required by law or to protect rights and safety.

6. Published apps and public data

  • When you publish an app, its name, description, icon, and your profile (name, handle, avatar) are publicly visible.
  • Social interactions (likes, comments) are visible to other users.
  • Your follower/following counts and total likes are publicly visible on your profile.

7. Data within published apps

  • Published apps may collect and store data from their end users (“App Data”).
  • App Data is stored in our database and is accessible to the app owner.
  • App owners are responsible for informing their end users about data collection within their published apps.

8. Push notifications

  • We use web push notifications to inform you about social interactions, app updates, and platform announcements.
  • You can opt in or out of push notifications at any time through your notification preferences.

9. Data security

  • We use industry-standard security measures to protect your data.
  • Passwords are hashed and never stored in plain text.
  • Data is transmitted over encrypted connections (HTTPS).
  • Database access is controlled through Row Level Security policies.

10. Data retention

  • Account data is retained for the duration of your active account plus 30 days after deletion.
  • AI generation logs (prompts and outputs) are retained for the duration of the account, supporting debugging and abuse prevention.
  • Payment records are retained for 7 years as required by US tax law.
  • Published apps and their associated App Data may be retained for up to 90 days after account deletion to prevent disruption to end users, then deleted.
  • Push notification tokens are deleted immediately upon opt-out or account deletion.

11. Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate personal data.
  • Request deletion of your account and personal data.
  • Opt out of non-essential communications.
  • Withdraw consent for push notifications.

Additional rights for EEA users: If you are located in the European Economic Area, you also have the right to:

  • Data portability: receive your personal data in a structured, commonly used, machine-readable format.
  • Restrict processing: request that we limit processing of your data in certain circumstances.
  • Object to processing: object to processing based on legitimate interests.
  • Lodge a complaint: file a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

12. Children’s privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover such data has been collected, we will delete it promptly.

13. Cookies and local storage

  • We use browser local storage and cookies for authentication session management.
  • We do not use third-party tracking cookies for advertising.

14. International data transfers

Your data is stored and processed in the United States (AWS us-west-2, Oregon). If you are located outside the United States, your personal data is transferred to the US.

For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller to Processor) as the legal mechanism for cross-border data transfers. A copy of the applicable SCCs is included as an annex to our Data Processing Agreement.

Our sub-processors (listed at whacka.app/legal/subprocessors) maintain their own cross-border transfer safeguards, including SCCs.

15. Data Processing Agreement

If you use Whacka to publish apps that collect data from end users, Whacka acts as a data processor on your behalf. Our Data Processing Agreement, available at whacka.app/legal/dpa, governs this relationship and applies automatically when you use the Service. A list of our sub-processors is available at whacka.app/legal/subprocessors.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification.

17. Contact

If you have questions about this Privacy Policy, please contact us at [email protected].