Last updated: July 14, 2026
This Privacy Policy describes how WIP LLC ("we," "us," or "our") collects, uses, and shares information about you when you use the Spells mobile application and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
You can ask us to access, correct, export, or delete your personal data. For EU/UK users, this includes GDPR rights such as access, rectification, erasure, restriction, portability, and objection. For California users, this includes CCPA/CPRA rights such as the right to know/access, delete, correct, portability, and non-discrimination.
When you create an account, we collect:
When you use Spells to communicate, we store:
Spells includes a built-in AI assistant. When you interact with the AI, the following data is transmitted to third-party AI providers:
Consent: Before your data is sent to any AI provider for the first time (when you use a slash command or the Artifacts feature), the app asks for your explicit permission. You can decline, and no data will be sent. Your consent preference is stored in your account and can be changed at any time by contacting us at info@wip.llc.
Each of these providers is a service provider or processor acting on our behalf, and we rely on contractual protections and their published privacy commitments where applicable. Their policies are available at:
If you grant permission, we access your device contacts to identify which of your contacts are already using Spells and to make it easier to start conversations. We use phone numbers from your contacts to look up registered users. We do not store your full contact list on our servers; we only retain information about contacts who are already Spells users or who you invite.
Location access may be requested for use within Artifacts — interactive mini-apps embedded in your chats. Location data accessed this way is used only within the context of the specific Artifact and is not stored on our servers.
We request access to your camera and microphone to allow you to take photos, record videos, and record voice messages to share in chats. Camera and microphone access may also be granted to individual Artifacts at your discretion.
If you opt in to push notifications, we store a push notification token associated with your device in order to deliver messages and updates to you. Push delivery may involve Apple Push Notification service (APNs), Firebase Cloud Messaging (FCM), and Expo.
We automatically collect certain usage data to understand how the Service is used and to improve it, including:
Usage analytics are collected via PostHog. Analytics are disabled in development builds.
We share your information with trusted third-party providers only as necessary to operate the Service:
Each provider is contractually required to use your information only to perform services on our behalf and is bound by its own privacy policy, which provides data protections equivalent to or greater than those in this policy.
We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we delete your profile, phone number association, contact associations, notification devices, the messages and media you have sent, your reactions, and the Artifacts you have created. You can delete your account at any time from Settings → Delete Account within the app.
We may retain certain information for longer periods where required by law or legitimate business purposes such as fraud prevention.
Your information is processed by us and our service providers, which may be located in the United States or other countries. By using the Service, you consent to the transfer of your information to these locations, which may have different data protection laws than your country of residence. Where we transfer personal data of EU or UK residents outside their region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We take appropriate steps to ensure your data is treated securely wherever it is processed.
You can delete your account and associated personal data at any time by going to Settings → Delete Account in the app. This permanently removes your profile, phone number association, notification tokens, chat membership records, the messages and media you have sent, your reactions, and the Artifacts you have created.
If you need additional assistance deleting your data, contact us at info@wip.llc.
If you are in the EU or UK, you can exercise the following rights, subject to legal limits:
We process personal data to provide the Service, comply with legal obligations, and pursue our legitimate interests in operating, securing, and improving the Service. We will respond to GDPR requests without undue delay and generally within one month of receipt.
If you are a California resident, you can exercise the following rights, subject to applicable law:
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. California requests are handled within 45 days, with a possible 45-day extension when permitted by law and with notice.
To request a portable export of your account data, email us from the address or phone number associated with your account. We will verify the request against your account phone number and return a machine-readable export that may include your profile information, chats, media, Artifacts, and relevant settings, subject to legal limits and the rights of other users.
You can start the request here: info@wip.llc. We will respond within the time frame required by applicable law.
If WIP LLC is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.
We may disclose your data if required by law or in response to valid requests from public authorities (e.g., a court or government agency).
We may disclose your data in the good faith belief that it is necessary to:
We use commercially reasonable measures to protect your personal data, including encrypted transmission (HTTPS) and secure cloud storage. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
Spells is not intended for anyone under the age of 13. We do not knowingly collect personal information from children under 13. The app requires users to be at least 13 years old during registration. If you believe a child under 13 has provided us with personal data, please contact us immediately at safety@wip.llc and we will delete it. To learn how we protect minors and handle child-safety reports, see our Child Safety Standards.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date at the top.
We encourage you to review this policy periodically. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy, contact us at info@wip.llc.