How we protect your account, your apps, and the data your published apps collect. Plain English, no marketing fluff.
Last updated: June 27, 2026
Every project lives in its own data scope. End-users only see the rows they own — and two published apps can never read each other’s data, even by accident.
Passwords are hashed and never stored or transmitted in plaintext. Sign in with email + password, or with Google — we never see your Google credentials.
Every request — to whacka and to your published apps — runs over HTTPS, end-to-end. No mixed content, no plain HTTP fallback.
Payments are processed by Stripe. whacka never sees or stores card numbers — only the customer ID and metadata needed to deliver credits.
Export or delete at any time. On request, personal data is removed within 60 days. We never sell your data — to anyone, for any reason.
whacka does not train AI models on your data. Your prompts and the code we generate are sent to AI providers only to fulfill your request, under no-training agreements with each provider.
We take vulnerability reports seriously. Email us with reproduction steps — we’ll acknowledge your report and keep you posted through resolution.