Your practice data, explained plainly.

The short version.

• You can browse public learning and practice pages without creating an account.
• Microphone pitch analysis runs in your browser. Live microphone audio is not uploaded for pitch detection.
• Challenge recordings are stored in your browser using IndexedDB, expire after 30 days, and can be deleted or downloaded by you.
• Accounts require an email address. Payments are processed by Stripe rather than by Whisflo directly.
• Whisflo uses internal product analytics and may use Microsoft Clarity when the analytics project is enabled.

Data processed by Whisflo.

Account data

Email address, verification state, internal user ID, session records, membership entitlements, and Stripe customer or transaction references.

Contact data

The subject, message, optional email, account status, and request metadata such as approximate Cloudflare location, browser language, user agent, referrer, network organisation, and data-centre code.

Product analytics

Page path, event time, route section, locale, practice events, an anonymous browser ID stored in localStorage, and a session ID stored in sessionStorage.

Authentication data

Secure session cookies, hashed network information, user agent, one-time sign-in records, and temporary Google OAuth state when those sign-in methods are used.

Microphone access and local recordings.

Whisflo requests microphone permission only when you start a feature that needs live pitch or challenge recording. Live pitch tools analyze an audio stream in the browser to estimate pitch and stability; the stream is not uploaded to Whisflo for that analysis.

When you intentionally run a recording-enabled challenge, the recording and its pitch or score metadata are saved to the IndexedDB storage in that browser. The current implementation marks these recordings to expire after 30 days. Clearing site data or using the delete control removes them from that browser.

Browser permissions and local storage are controlled by your browser and device. Whisflo cannot recover a local recording after you delete it or clear the site data.

Service providers.

Cloudflare

Hosts the application and provides edge, database, key-value storage, request metadata, and security infrastructure.

Stripe

Processes checkout, payment, customer, invoice, and billing portal operations.

Microsoft Clarity

May provide session and interaction analytics when a public Clarity project ID is enabled on the site.

Google and Resend

Google may provide OAuth sign-in; Resend delivers one-time sign-in emails when email-link authentication is used.

Your choices and requests.

• Deny or revoke microphone permission in your browser.
• Delete or download challenge recordings from the recording controls, or clear Whisflo site data in your browser.
• Sign out to remove the active session cookie from the browser.
• Use browser privacy controls for cookies, local storage, and third-party analytics.
• Contact Whisflo to request access, correction, or deletion of account or message data, subject to applicable legal and operational requirements.

Retention, security, and policy changes.

Whisflo uses secure, HTTP-only session cookies and limits rate-sensitive submission endpoints. Server-side account, billing, analytics, and contact records are kept as needed to operate, secure, support, and account for the service. Not every server-side record currently has a public self-service deletion control.

This policy may change when product behavior, providers, or legal requirements change. Material changes should be reflected by the updated date on this page.

Questions about a specific record or deletion request should be sent to hello@whisflo.com. Do not include passwords, payment card details, or sensitive health information.