Last updated: July 2026
This Privacy Policy describes how WIP LLC ("we," "us," or "our") collects, uses, and shares information about you when you use the Spells mobile application and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
When you create an account, we collect:
When you use Spells to communicate, we store:
Spells includes a built-in AI assistant. When you interact with the AI, the following data is transmitted to third-party AI providers:
Consent: Before your data is sent to any AI provider for the first time (when you use a slash command or the Artifacts feature), the app asks for your explicit permission. You can decline, and no data will be sent. Your consent preference is stored in your account and can be changed at any time by contacting us at info@wip.llc.
Each of these providers is bound by their own privacy policies and provides protections for your data that are equivalent to or greater than those described in this policy. Their policies are available at:
If you grant permission, we access your device contacts to identify which of your contacts are already using Spells and to make it easier to start conversations. We use phone numbers from your contacts to look up registered users. We do not store your full contact list on our servers; we only retain information about contacts who are already Spells users or who you invite.
Location access may be requested for use within Artifacts — interactive mini-apps embedded in your chats. Location data accessed this way is used only within the context of the specific Artifact and is not stored on our servers.
We request access to your camera and microphone to allow you to take photos, record videos, and record voice messages to share in chats. Camera and microphone access may also be granted to individual Artifacts at your discretion.
If you opt in to push notifications, we store a push notification token associated with your device in order to deliver messages and updates to you.
We automatically collect certain usage data to understand how the Service is used and to improve it, including:
Usage analytics are collected via PostHog. Analytics are disabled in development builds.
We share your information with trusted third-party providers only as necessary to operate the Service:
Each provider is contractually required to use your information only to perform services on our behalf and is bound by its own privacy policy, which provides data protections equivalent to or greater than those in this policy.
We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we delete your profile, phone number association, contact associations, notification devices, the messages and media you have sent, your reactions, and the Artifacts you have created. You can delete your account at any time from Settings → Delete Account within the app.
We may retain certain information for longer periods where required by law or legitimate business purposes such as fraud prevention.
Your information is processed by us and our service providers, which may be located in the United States or other countries. By using the Service, you consent to the transfer of your information to these locations, which may have different data protection laws than your country of residence. Where we transfer personal data of EU or UK residents outside their region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We take appropriate steps to ensure your data is treated securely wherever it is processed.
You can delete your account and associated personal data at any time by going to Settings → Delete Account in the app. This permanently removes your profile, phone number association, notification tokens, chat membership records, the messages and media you have sent, your reactions, and the Artifacts you have created.
If you need additional assistance deleting your data, contact us at info@wip.llc.
Depending on where you live, you may have some or all of the following rights over your personal data:
For residents of the EU and UK (GDPR): We process your personal data to perform our contract with you (providing the Service), to comply with legal obligations, and for our legitimate interests in operating, securing, and improving the Service. You have the right to lodge a complaint with your local data protection authority.
For California residents (CCPA/CPRA): You have the right to know what personal information we collect (described in "Information We Collect"), to request its deletion, to correct it, and to not be discriminated against for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. To exercise any of these rights, contact us at info@wip.llc.
You can request a copy of the personal data associated with your account — including your profile information, messages, and Artifacts — by contacting us at info@wip.llc. We will verify your request against your account phone number and provide your data in a portable, machine-readable format within the time frame required by applicable law.
If WIP LLC is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.
We may disclose your data if required by law or in response to valid requests from public authorities (e.g., a court or government agency).
We may disclose your data in the good faith belief that it is necessary to:
We use commercially reasonable measures to protect your personal data, including encrypted transmission (HTTPS) and secure cloud storage. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
Spells is not intended for anyone under the age of 13. We do not knowingly collect personal information from children under 13. The app requires users to be at least 13 years old during registration. If you believe a child under 13 has provided us with personal data, please contact us immediately at safety@wip.llc and we will delete it. To learn how we protect minors and handle child-safety reports, see our Child Safety Standards.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date at the top.
We encourage you to review this policy periodically. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy, contact us at info@wip.llc.