Last Updated: February 2026
Wister ("we", "us", "our") operates the Wister mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App.
| Data | Purpose |
|---|---|
| Phone number | Account creation and authentication via SMS verification |
| Display name, username, bio | Profile visible to your contacts |
| Profile photo | Profile avatar visible to your contacts |
| Birthday and nameday | Celebration reminders for your contacts |
| Chat messages | Facilitating communication between users |
| Story images | Sharing temporary visual content (auto-deleted after 24 hours) |
If you participate in the Gift Repurchase Program (Section 7 of our Terms of Service), we may additionally collect:
| Data | Purpose |
|---|---|
| Government-issued ID (passport, national ID card, or driver's license) | Identity verification (KYC) via Stripe Identity, as required by applicable law |
| Selfie / facial image | Biometric verification via Stripe Identity to confirm document authenticity (processed by Stripe, not stored by Wister) |
| Tax identification number (ΑΦΜ, TIN, or equivalent) | Tax reporting obligations under DAC7 and applicable law |
| Tax documentation (W-9, W-8BEN, Greek tax declaration forms) | Tax compliance and withholding obligations |
| PayPal email | Processing repurchase payments |
| Gift Instance ownership data | Verifying eligibility and ownership of Gift Instances submitted for repurchase |
Stripe Identity: Identity verification is performed by Stripe Identity, a third-party service. When you submit identity documents, they are transmitted directly to Stripe for processing. Stripe may collect biometric data (facial imagery) for document verification. Wister receives only the verification result (verified/not verified) and basic identity information. Wister does NOT store your identity documents or biometric data. For details on how Stripe processes your data, see Stripe's Privacy Policy.
| Data | Purpose |
|---|---|
| Firebase Installation ID | Anonymous app instance identifier used for analytics and notifications |
| Device token (FCM) | Delivering push notifications |
| Online status and last seen | Showing availability to your contacts |
| IP address | Security, fraud prevention, approximate geolocation for regulatory compliance (collected by Firebase) |
| Device information | Device model, operating system version, app version — used for compatibility, debugging, and security |
| Transaction history | Recording Ruby purchases, gifts, and repurchase requests |
| Gift and transaction patterns | Gift frequency, volume, and recipient patterns — used for fraud detection and risk scoring (see Section 2A) |
| App usage data | Feature interactions, screen views, and in-app events — collected via Firebase Analytics for service improvement |
| Notification interactions | Whether push notifications are opened or dismissed — used to improve notification relevance |
When a user chooses to add a location sticker to a Story, the App may access the device's location (with permission) to retrieve the city name. The geographic coordinates are not stored. Only the selected location label (e.g., "Athens") is saved as part of the Story content. Location data is not shared with third parties and is used solely for in-app functionality.
Wister does NOT:
Firebase Analytics is used solely for anonymous, aggregated usage statistics to improve the App. No personally identifiable information is shared with advertising networks.
Contact sync is an optional feature used solely for friend discovery — finding which of your existing phone contacts already use Wister. You can enable or disable it at any time.
How it works:
What is stored:
You are in control:
Voice and video calls within the App are powered by Agora.io. During calls, the following data is processed:
| Data | Details |
|---|---|
| Audio and video streams | Transmitted in real-time between participants. Calls are NOT recorded or stored by Wister or Agora. |
| Call metadata | Call duration, timestamp, and participant user IDs — stored by Wister for service functionality. |
| Network quality metrics | Collected by Agora to optimize call quality (e.g., latency, packet loss). |
Encryption: All voice and video calls use Agora's encrypted transmission protocols.
No recording: Neither Wister nor Agora records or stores the content of your calls.
For more information, see Agora's Privacy Policy.
| Source | Data | Purpose |
|---|---|---|
| Google Play Services | Purchase verification tokens | Verifying in-app purchases of Rubies |
| Apple App Store | Purchase receipts | Verifying in-app purchases of Rubies |
We use the information we collect to:
To protect our community and the integrity of the Gift and Gift Repurchase systems, Wister operates an automated fraud detection system that processes certain data to identify potentially abusive activity.
What data is processed:
| Data | Purpose |
|---|---|
| Gift transaction patterns | Frequency, volume, and timing of gifts sent and received — to detect velocity anomalies and coordinated schemes |
| Payout account details | PayPal email — to detect shared payout accounts across multiple users |
| Repurchase request history | Frequency, amounts, and timing of repurchase requests — to detect suspicious patterns |
| Risk score | Computed score (0–100) based on transaction patterns — used to flag accounts for manual review before repurchase approval |
| Account age and activity | Account creation date relative to transaction volume — to identify new account exploitation |
| Chargeback and dispute history | Payment disputes filed via Stripe or app stores — to detect refund abuse |
How it works:
Your rights:
Data retention: Risk profile data is retained for the duration of your account. If your account is deleted, risk profile data is anonymized or deleted within 30 days, except where retention is required by law for fraud investigation purposes.
Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:
| Legal Basis | Data |
|---|---|
| Contract performance (Art. 6(1)(b)) | Account data, messages, transactions — necessary to provide the service |
| Legitimate interest (Art. 6(1)(f)) | Fraud prevention and risk scoring (Section 2A), security, service improvement, Gift Repurchase Program eligibility assessment |
| Consent (Art. 6(1)(a)) | Contact sync, push notifications, birthday sharing, Gift Repurchase Program participation — you can withdraw consent at any time |
| Legal obligation (Art. 6(1)(c)) | Financial transaction records, tax compliance, KYC/AML verification for repurchase, DAC7 reporting |
Chat messages in Wister are protected with End-to-End Encryption (E2EE) using industry-standard cryptography:
This means that only you and the person you are communicating with can read your messages. Wister cannot access the content of encrypted messages.
The App uses Google Play Services to provide core functionality on Android devices:
| Service | Purpose | Data Collected |
|---|---|---|
| Google Play Billing | In-app purchases of Rubies | Purchase history, transaction IDs |
| Firebase Authentication | Account creation and phone verification | Phone number, authentication state |
| Firebase Realtime Database | Real-time messaging and data sync | User data as described in this Policy |
| Firebase Cloud Storage | Storing profile photos and story images | Uploaded media files |
| Firebase Cloud Messaging (FCM) | Delivering push notifications | FCM device token |
| Firebase Analytics | Anonymous usage statistics | App events, user properties, device info, app version |
| Firebase Installation ID | Anonymous app instance identification | Unique installation identifier |
For more information: Google Privacy Policy and Firebase Privacy
On iOS devices, the App uses Apple services:
| Service | Purpose | Data Collected |
|---|---|---|
| Apple Push Notification Service (APNs) | Delivering push notifications | Device push token |
| App Store In-App Purchases | In-app purchases of Rubies | Purchase receipts, transaction IDs |
For more information: Apple Privacy Policy
| Service | Purpose | Privacy Policy |
|---|---|---|
| Stripe Payments | Payment processing for Ruby purchases (credit/debit card). Wister does not store your card details — Stripe handles all card data securely. | stripe.com/privacy |
| Stripe Identity | Identity verification (KYC) for Gift Repurchase Program participants. Processes government-issued ID documents and facial imagery. Wister does NOT store identity documents or biometric data. | stripe.com/privacy |
| PayPal | Processing Gift Repurchase payments to eligible Users | paypal.com/privacy |
| Agora | Voice and video call infrastructure (see Section 1.5 for details) | agora.io/privacy |
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Chat messages | Until deleted by sender or chat cleared |
| Story content | Automatically deleted after 24 hours |
| Transaction records | 7 years (legal/tax requirement) |
| Gift Repurchase Program data (KYC verification result, tax docs) | 7 years from last transaction (legal/tax/AML requirement) |
| Repurchase request audit trail (request details, approval context, payout context) | 7 years from transaction date (legal/tax/audit requirement) |
| Risk profile and fraud alert data | Duration of account + 30 days after deletion (or as required by law for fraud investigations) |
| Push notification tokens | Until you log out or uninstall the App |
| Contact sync data (matched user IDs only — no phone numbers stored) | Until you disable contact sync or delete your account |
| Firebase Installation ID | Until you uninstall the App or clear app data |
| Call metadata (duration, timestamps) | 1 year from call date |
| App usage / analytics data | 14 months (Firebase Analytics default) |
| Device information | Until you delete your account |
When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
You may delete your account at any time through the following methods:
Upon account deletion:
You will receive a confirmation notification when your account deletion is complete.
Your data is stored on Google Firebase servers located in the European Union (europe-west1 region). If data is transferred outside the EU, it is protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) in compliance with GDPR.
For all data protection and privacy matters, you may contact us:
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):
As a user in the European Union, you have the following rights:
To exercise any of these rights, contact us at privacy@wister.site.
We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at https://www.dpa.gr.
The App is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. Financial features (Ruby purchases) and the Gift Repurchase Program require users to be at least 18 years old.
Age verification: Account creation requires SMS verification of a mobile phone number. During registration, users must confirm their date of birth. The App enforces the following age-based restrictions:
If we become aware that a user has provided a false date of birth or that a child under 16 has created an account, we will take steps to suspend the account and delete the associated personal data promptly. We reserve the right to implement additional age verification measures as required by applicable law or platform policies.
If you believe that a child under 16 has created an account, please contact us immediately at privacy@wister.site.
We implement appropriate technical and organizational measures to protect your personal data, including:
No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
In compliance with Google Play's Data Safety requirements, the following summarizes our data practices:
| Data Type | Collected | Shared | Purpose | Optional |
|---|---|---|---|---|
| Phone number | Yes | No | Account creation, authentication | No (required) |
| Contacts (phone numbers) | No (processed in memory, not stored) | No | Friend discovery only — only matched user IDs are stored | Yes |
| Name / Username | Yes | No (visible to contacts within App) | User profile | No |
| Profile photo | Yes | No (visible to contacts within App) | User profile | Yes |
| Birthday / Nameday | Yes | No | Celebration reminders | Yes |
| Messages | Yes | No (E2EE, unreadable by Wister) | In-app communication | No |
| Photos (Stories) | Yes | No (visible to contacts, auto-deleted 24h) | Content sharing | Yes |
| Purchase history | Yes | Stripe (payment processor) | Transaction processing | No (if purchasing) |
| Device identifiers (Firebase Installation ID) | Yes | Firebase (Google) | Analytics, notifications | No |
| IP address | Yes | Firebase (Google) | Security, fraud prevention | No |
| App usage data | Yes | Firebase (Google) | Service improvement | No |
| Approximate location | Yes (city name only, when user adds location sticker to Story) | No | App functionality (Story location sticker) | Yes |
| KYC documents (Gift Repurchase only) | Yes | Stripe Identity (verification processor) | Legal compliance, identity verification | Yes (only if participating in repurchase) |
Data deletion: Users can request deletion of their account and associated data at any time via the App settings or by contacting privacy@wister.site. Data is deleted within 30 days except where retention is required by law.
Data encryption: All data is encrypted in transit using TLS. Chat messages are additionally protected by End-to-End Encryption (E2EE).
In compliance with Apple's App Privacy requirements:
Data Used to Track You: None — Wister does not track users across apps or websites.
Data Linked to You:
Data Not Linked to You:
The Wister website (https://www.wister.site) may use essential cookies required for the website to function properly. We do not use advertising cookies, tracking cookies, or third-party analytics on our website. If this changes in the future, we will update this Privacy Policy and implement an appropriate cookie consent mechanism in compliance with the ePrivacy Directive (2002/58/EC) and applicable national law.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the App or sending a push notification. Your continued use of the App after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your personal data, contact us: