Privacy Policy

Last updated: April 2026

This Privacy Policy describes how WIP LLC ("we," "us," or "our") collects, uses, and shares information about you when you use the Spells mobile application and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

Account Information

When you create an account, we collect:

  • Phone number — used to create and authenticate your account via SMS verification (powered by Twilio).
  • Full name — provided during onboarding, used to identify you to other users and personalize your AI experience.
  • Birthday — optionally provided during onboarding, used to personalize your AI agent.
  • Profile picture — optionally uploaded; stored securely on Cloudflare Images.

Messages and Content

When you use Spells to communicate, we store:

  • Text messages you send and receive in chats, including messages sent to or received from the AI agent.
  • Photos and videos you share in conversations, stored on Cloudflare R2.
  • Voice messages you record and send, stored on Cloudflare R2.
  • Stickers you send.
  • Message reactions, replies, and read receipts.

AI Interactions

Spells includes a built-in AI assistant. When you interact with the AI, the following data is transmitted to third-party AI providers:

  • Message text and chat history — sent to OpenRouter, which routes requests to Google Gemini and Meta Llama models, so the AI can respond accurately and with context.
  • Participant names and chat metadata — included with AI requests to personalize responses.
  • Artifact prompts, source code, and build error text — sent to OpenAI (Codex/o-series models) when you ask the AI to create or edit an Artifact.
  • Images you share — may be processed by Cloudflare Workers AI (CLIP model) for sticker generation.
  • Web search queries — forwarded to Exa via OpenRouter when the AI performs a web search on your behalf.

Consent: Before your data is sent to any AI provider for the first time (when you use a slash command or the Artifacts feature), the app asks for your explicit permission. You can decline, and no data will be sent. Your consent preference is stored in your account and can be changed at any time by contacting us at info@wip.llc.

Each of these providers is bound by their own privacy policies and provides protections for your data that are equivalent to or greater than those described in this policy. Their policies are available at:

Contacts

If you grant permission, we access your device contacts to identify which of your contacts are already using Spells and to make it easier to start conversations. We use phone numbers from your contacts to look up registered users. We do not store your full contact list on our servers; we only retain information about contacts who are already Spells users or who you invite.

Location

Location access may be requested for use within Artifacts — interactive mini-apps embedded in your chats. Location data accessed this way is used only within the context of the specific Artifact and is not stored on our servers.

Camera and Microphone

We request access to your camera and microphone to allow you to take photos, record videos, and record voice messages to share in chats. Camera and microphone access may also be granted to individual Artifacts at your discretion.

Push Notifications

If you opt in to push notifications, we store a push notification token associated with your device in order to deliver messages and updates to you.

Usage Data

We automatically collect certain usage data to understand how the Service is used and to improve it, including:

  • IP address and device identifiers
  • App version and platform (iOS/Android)
  • Feature usage events (e.g., onboarding steps, artifact creation, errors)

Usage analytics are collected via PostHog. Analytics are disabled in development builds.

How We Use Your Information

  • To create and manage your account and authenticate your identity.
  • To deliver messages, media, and AI responses within the Service in real time.
  • To power the AI assistant, including generating responses, creating Artifacts, and performing web searches on your behalf.
  • To match your contacts with other Spells users so you can connect with friends.
  • To send you push notifications for new messages and activity.
  • To improve the Service through analytics and usage data.
  • To detect, prevent, and address abuse, fraud, or security issues.
  • To comply with legal obligations.

Third-Party Service Providers

We share your information with trusted third-party providers only as necessary to operate the Service:

  • Twilio — SMS verification for account authentication.
  • Convex — real-time database and backend infrastructure for messages, users, and chats.
  • Cloudflare — hosting, media storage (R2 and Images), and real-time infrastructure (Workers and Durable Objects).
  • OpenRouter / Google Gemini / Meta Llama — AI chat responses. Message text, chat history, and participant context are sent to these services when you use AI features.
  • OpenAI (Codex / o-series) — AI-powered code generation for Artifacts. Artifact prompts, code, and build errors are sent to this service.
  • Cloudflare Workers AI (CLIP) — used for sticker processing. Images may be processed by this service.
  • Exa — web search results requested by the AI on your behalf.
  • PostHog — product analytics.
  • Expo — app delivery and over-the-air updates.

Each provider is contractually required to use your information only to perform services on our behalf and is bound by its own privacy policy, which provides data protections equivalent to or greater than those in this policy.

Retention of Your Personal Data

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we delete your profile, contact associations, and notification devices. You can delete your account at any time from Settings → Delete Account within the app.

We may retain certain information for longer periods where required by law or legitimate business purposes such as fraud prevention.

Transfer of Your Personal Data

Your information is processed by us and our service providers, which may be located in the United States or other countries. By using the Service, you consent to the transfer of your information to these locations, which may have different data protection laws than your country of residence. We take appropriate steps to ensure your data is treated securely wherever it is processed.

Delete Your Personal Data

You can delete your account and associated personal data at any time by going to Settings → Delete Account in the app. This permanently removes your profile, phone number association, notification tokens, and chat membership records.

If you need additional assistance deleting your data, contact us at info@wip.llc.

Disclosure of Your Personal Data

Business Transactions

If WIP LLC is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

Law Enforcement

We may disclose your data if required by law or in response to valid requests from public authorities (e.g., a court or government agency).

Other Legal Requirements

We may disclose your data in the good faith belief that it is necessary to:

  • Comply with a legal obligation
  • Protect the rights or property of WIP LLC
  • Prevent or investigate wrongdoing in connection with the Service
  • Protect the safety of users or the public
  • Protect against legal liability

Security of Your Personal Data

We use commercially reasonable measures to protect your personal data, including encrypted transmission (HTTPS) and secure cloud storage. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

Spells is not intended for anyone under the age of 13. We do not knowingly collect personal information from children under 13. The app requires users to be at least 13 years old during registration. If you believe a child under 13 has provided us with personal data, please contact us immediately at info@wip.llc and we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date at the top.

We encourage you to review this policy periodically. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy, contact us at info@wip.llc.