Privacy Policy

Your car photos and renders

To make a render, Whipshop prepares the photo of your car that you take or pick on your phone (it is resized to at most 1,536 pixels on its long side, and location and other metadata are removed) and sends it through aqualley’s AI gateway, which runs on Amazon Web Services in the United States, together with what the render needs: the part you picked (such as a wrap colour and finish, a wheel style, a drop, a tint level, a spoiler or a lip), any words you type to describe a change (at most 200 characters) and, if you use “Your own wheel”, the photo of the wheel you pick. When you add a part to a build, the gateway starts from the previous render it already keeps for you, so the photo is not uploaded again. The gateway sends these to OpenAI, the third-party AI company that runs the image models and makes the render.

OpenAI does not use your photos, your words or the renders to train its models. OpenAI may keep them for up to 30 days to detect and prevent abuse of its service, and then deletes them, under its own terms and privacy policy for its API. Before your first photo is sent, Whipshop tells you this and asks for your agreement; without it nothing is uploaded.

Your photos are used only to make the renders you asked for. Before a render, Whipshop checks on your phone that the photo is sharp, bright enough and shows the whole car, with your phone’s own built-in image tools; that check never leaves your phone. Whipshop does not use face recognition and never makes face templates or other biometric data, and it does not read or store your number plate as text. Whipshop uses the camera only when you choose to take a photo, and the system photo picker otherwise, so it reads only the photos you pick and does not ask for access to your whole photo library.

How long we keep your photos and renders

• Photos and renders on our server: aqualley’s gateway keeps a private copy of each photo you send and of each finished render, linked to your anonymous app user ID, so that only your copy of Whipshop can download the result and you can keep refining the same build. We keep them for 7 days, then delete them automatically. We do not sell them, share them with anyone else or use them for advertising. You can delete them sooner at any time (see below).
• OpenAI’s copies: OpenAI receives the photo, the part and your words only to make your render; it does not train on them and may keep them for up to 30 days for abuse monitoring, as above.
• On your phone: your builds are kept in Whipshop’s Garage on your phone until you delete them. The before/after slider clip is made on your phone. When you save or share a render or a clip, the destination you choose, such as Photos, Instagram or another app, handles it under its own privacy practices; Whipshop asks only for permission to add to Photos, not to read your library. If you use iCloud, Google backup or another backup service, the Garage may be included according to that service’s settings.
• Reports: if you report a render, we keep the report (the reason, any note you write and an anonymous app ID) together with that render’s photo and result for up to 400 days, so we can review it; only our team looks at them. Deleting your photos (see below) deletes them too.

Deleting your photos

Settings › Your photos › Delete my photos asks aqualley’s gateway to delete every photo and render it keeps for you, and the app shows when that is done. Delete Garage removes your saved builds from your phone; deleting one build in the Garage removes only that build from your phone. To have the other records linked to your User ID deleted, see “Changes and contact” below.

Your credits, first render, offers and invites

To keep plan and pack credits, credits returned for failed renders, the first render on us, gifts from invites and special offers fair, aqualley’s gateway records each render you start: a job identifier, the part, whether it succeeded and which credits it used. These records are linked to your anonymous app user ID and to the identifiers of your App Store or Google Play purchases, which the gateway reads from RevenueCat, so that a purchase cannot be spent twice. The app proves to our server that it is the genuine Whipshop app with Apple’s App Attest on iPhone and Google’s Play Integrity on Android. So that the first render on us, an offer’s timer and an invite reward count once per phone, the gateway keeps a one-way hash of a device identifier (on iPhone one that our apps share on your phone, on Android the Android ID that Android gives the app), never the identifier itself, and which version of the first-render experience your phone was given. To limit renders on us from one network, it also counts them per day under a one-way hash of your network’s IP address, and deletes that count after two days. When you invite a friend, the gateway records your invite code and which codes were claimed and rewarded. None of this is used for advertising.

Feedback

If you send feedback, request a feature, or tell us why a render did not turn out (“How did it turn out?”), the app sends your choice and anything you write, with your anonymous app user ID, to aqualley’s gateway so we can improve Whipshop.

Notifications

If you allow notifications, Whipshop sends its push token, your time zone and whether you want offers to aqualley’s gateway, which sends notifications through Google’s Firebase Cloud Messaging (and Apple’s push service on iPhone). We use them to tell you when your render is ready and, while the Offers switch in Settings is on, for occasional offers and invite rewards, such as a reminder before a special offer ends. We send at most one offer a day and none at night in your time zone. You can turn offers off in Settings, or all notifications in your phone’s settings.

Purchases

Apple or Google processes payments for Whipshop’s subscriptions and render packs. Whipshop uses RevenueCat to verify purchases. RevenueCat may process an anonymous app user identifier, purchase status, and device and diagnostic information needed to provide that service. Whipshop Settings shows this identifier as your User ID so you can choose to share it with support. Offer codes are entered in Apple’s redemption sheet or on Google Play’s redeem page; Whipshop does not read or send the code. aqualley does not receive your payment-card details.

Optional usage analytics

When usage analytics is on in Whipshop Settings, the app sends limited events to PostHog Cloud in the United States. Events include a random Whipshop-specific identifier, a session identifier, the app version and build, whether the device is one of our own test devices, and actions such as opening the app for the first time, finishing onboarding, your choice on the photo agreement, whether a photo came from the camera or the library and passed the photo check, the parts you pick, starting, finishing, saving, sharing, refining or reporting a render and whether it failed, exporting a slider clip, opening or deleting a build in the Garage, viewing the paywall, the pack or an offer, notification, permission and invite choices, and the outcome of a purchase, restore or redeem attempt. They never contain your photos, renders, number plate, the words you type, file names, payment details or contact details. PostHog also tells the app which version of a screen to show when we test two versions (for example whether the first render comes before the paywall), and that choice is kept on your phone.

Whipshop does not read your device’s location and does not ask for a location permission. PostHog derives your approximate country from the IP address of each request and stores that IP address alongside the event; we use country only for aggregate reporting. Advertising tracking and session replay are disabled.

Usage analytics is on by default and you can turn it off in Settings at any time. This stops further collection, discards unsent events and resets the local analytics identifier; it does not remove events PostHog has already received. See PostHog’s privacy policy for that service.

Crash reports

When usage analytics is on, Whipshop also sends crash reports to Google’s Firebase Crashlytics so we can fix problems. A crash report contains technical details of the crash (the code that failed), the app version, device model, operating system version and the state of the app at the time, with a random installation identifier; it never contains your photos, renders, User ID, payment details or contact details. Turning off usage analytics in Settings also turns off crash reports. See Firebase’s privacy information.

How you found Whipshop

To learn which of our videos, links and ads bring people to Whipshop, the app records once how it was installed: whether it came from an Apple Search Ads campaign (Apple tells the app through its AdServices service, without tracking you across apps), or, on Android, the campaign or invite code in one of our links, and, if you choose to answer, where you heard about Whipshop. These values are added to the usage analytics events and stored with your anonymous app user ID at RevenueCat, so we can see downloads and revenue by source in aggregate. They are not sent when usage analytics is off. Our links at go.aqualley.net count taps per campaign, device type and country, and store no IP address or identifier.

Support emails

“Report a bug” opens an email to info@aqualley.net filled in with your User ID, app version and build, device model, iOS or Android version, locale and store country. Nothing is sent unless you send it.

Children

Whipshop is not directed to children. We do not knowingly collect personal information from children through the app.

Changes and contact

We may update this policy as Whipshop changes. The current version will be posted on this page. For privacy questions or requests, contact info@aqualley.net. To have the records linked to your User ID deleted, email us the User ID shown in Whipshop Settings; we delete aqualley’s gateway records for it within 30 days, except the records that stop a purchase, the first render on us, an offer or an invite reward from being used twice. Purchase records kept by Apple, Google and RevenueCat follow their own policies.

Whipshop Support · Terms of Use · Privacy Policy