1. Who operates whatthe?
VNL Works Inc., a company registered in Japan, operates the whatthe? mobile app, website, and related moderation and support services. This policy applies when you use those services or contact us about them.
2. Information you give us
- Account information received from Apple, including the provider identifier and any email address or profile information you choose to share through Apple.
- Your private date of birth, used to confirm 18+ eligibility. Your exact birthdate is not displayed publicly.
- Your username, one profile photo, optional voice bio, language preferences, and account settings.
- Voice posts, voice replies, YES / NO voice votes, tags, emoji reactions, follows, blocks, and reports.
- Messages and attachments you send to support, safety, or privacy contacts.
3. Information collected through use
- Playback, completion, replay, skip, reaction, reply, follow, profile-open, and feed interaction events used to operate and rank the service.
- Device push tokens, notification status, app version, operating system, language, timestamps, and basic diagnostics.
- Network and security signals used to prevent spam, abuse, automated uploads, account evasion, and attacks. Where possible, these signals are reduced or hashed.
- Moderation records, reports, enforcement actions, and audit history needed to protect users and review appeals.
4. Why we use information
We use information to create and secure accounts; deliver, rank, and personalise voices; store and play media; send notifications; enforce age separation; prevent abuse; investigate reports; provide support; comply with law; and improve reliability. Depending on your location, we rely on performance of our agreement with you, legitimate interests in operating a safe service, consent where required, and legal obligations.
5. Service providers and disclosures
We use service providers such as Supabase for authentication and database infrastructure, Cloudflare for private media storage and delivery, Expo and Apple for app delivery and notifications, Apple for sign-in, and Vercel for this public website. They process information under their own terms and our arrangements with them. We may also disclose information when required by law, to protect people or the service, during a corporate transaction, or when you direct us to do so.
6. Retention
We keep account and content data while your account is active and for the time reasonably needed to operate, secure, and defend the service. Raw feed and playback interaction events older than 30 days are scheduled for daily deletion. Events may remain until the next successful cleanup after that threshold. Derived aggregate ranking metrics may be kept longer without voice content. Deleted content may remain in backups or when preserved as moderation evidence, required by law, or needed to investigate serious harm. Deleting a post or reply removes it from public view immediately. Restricted voice files are normally scheduled for deletion 90 days after deletion; replaced profile images after 30 days. Necessary case evidence is reviewed every 90 days and normally expires within one year after final case and appeal closure. Live references, documented preservation holds, and records with unknown original dates are protected pending review. Cleanup is scheduled every five minutes; retries may delay completion. These media deadlines do not certify deletion of provider backups, emails, or separate audit records. Account deletion follows its separate deletion process, subject to justified evidence preservation.
Routine abuse and rate-limit records are scheduled for deletion after 30 days. Ordinary closed-case records are normally scheduled for deletion one year after final closure, and admin audit records after one year. Daily batch processing and retries may delay completion. Open cases, appeals, preservation holds, unresolved dates, outstanding evidence deletion and continuing enforcement needs can extend retention. We retain minimum deletion history to prevent erased media being restored. Support emails do not have automatic expiry and are reviewed when handling a deletion request or when no longer needed. Provider-managed logs and recovery copies follow their own retention settings.
7. Your choices and rights
- Change your profile and language preferences in the app.
- Remove reactions, delete eligible content, block accounts, or disable notifications.
- Delete your account from Settings. This starts deletion of your account, profile, voices, reactions, and associated personal data, subject to lawful retention.
- Contact us to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where those rights apply.
8. Minimum age
whatthe? is not available to people under 18. We may investigate reports that an account belongs to someone under the minimum age and may restrict or remove that account.
9. International service
whatthe? is intended for a global audience. Information may be processed in countries other than your own. Where required, we use contractual or other recognised safeguards for international transfers.
10. Security and changes
We use access controls, private media storage, short-lived media links, row-level database rules, rate limits, audit records, and restricted administrator access. No system is completely secure. We may update this policy as the product or law changes and will update the date shown on this page. Material changes may also be announced in the app.