Skip to content
Join the waitlist

Legal

Privacy Policy

Last updated: 30 October 2026

The short version

WHIG is coming first to iPhone. You film and talk on your iPhone. Your video, audio and item photos are captured and kept on the phone. They are never uploaded to WHIG.

Your iPhone turns what you say into text. Only that text is sent to WHIG’s reading service, which uses Anthropic’s Claude to turn it into an inventory and sends the result straight back to your phone. WHIG does not store the transcript or returned inventory. The request also includes your country, recording length and any space name you chose.

WHIG also holds account and service details, described below. Your item-by-item inventory is encrypted on your phone and is not stored in our database. You choose whether to save or share your Evidence Package, and where to send it.

For website tracking and information saved on your phone, see Cookies and device storage.

Cookies and device storage

On this website

We do not use advertising cookies, tracking pixels or analytics scripts on this website. We do not track your browsing across other websites.

Our waitlist uses Supabase to handle your registration. If you visit through a referral link, we read the code in that link when you join. Your email and referral details are saved with your waitlist registration, rather than in an advertising cookie.

You can manage cookies and clear site data in your browser settings. Clearing site data does not remove your waitlist registration. To request removal, contact us.

In the iPhone app

WHIG uses storage on your phone to remember your settings and consent choices, keep your inventory available between visits, and keep you signed in using Supabase authentication. Your inventory is encrypted, and encryption keys and sign-in information are protected using iOS secure storage.

Sign-in sessions are refreshed while valid and removed when you sign out or the session becomes invalid. Saved inventory and preferences have no automatic expiry. Signing out does not delete your saved inventory or files you have exported. Recording files follow the retention described under Data deletion.

We use this device storage to provide the app’s features, not for advertising or tracking you across apps. If we introduce optional tracking, we will update this policy and ask for permission before enabling it wherever consent is required, with a way to refuse or withdraw that permission.

What we collect

  • Account details, including your email address when provided, and sign-in identifiers from your chosen sign-in provider, for account access and communications.
  • Waitlist details: your email, referral link and referral counts when you join or check your waitlist registration.
  • Country and property profile (e.g. house, apartment, 3 bedrooms, state and whether the area is city or regional; never an address or postcode) for valuation calibration and regional statistics.
  • Your agreement and choices: that you agreed to your walkthroughs being read before the first one was, and whether you contribute to regional statistics.
  • Recording and session metadata (status, timestamps, step completion). No inventory content.
  • Purchase records: whether your account has unlocked the Evidence Package, with the App Store transaction reference. Apple handles payment. WHIG never sees your card details.
  • Anonymised regional totals, described under Regional statistics.
  • Signed record fingerprints for older signed records: cryptographic hashes and digital signatures used to check a record’s integrity. These contain no item names, values, or content of any kind. See What is a sealed record? below.

What does not go in our database

  • Item names, brands, or model numbers
  • Individual item values
  • Inventory content of any kind
  • Transcript text
  • Photos, video or audio
  • Insurance policy documents
  • Anything that could reconstruct what you own

Our database holds account, profile, consent and processing details, anonymised regional totals and cryptographic fingerprints, but not your item-by-item inventory.

How your walkthrough becomes an inventory

On your iPhone

Recording happens on your iPhone. Video and audio stay on the phone and are never uploaded. Transcription uses Apple’s on-device speech recognition. The photo for each item is taken on the phone from your own video, and photos never leave the phone. After your walkthrough has been read, WHIG attempts to save the video to Photos. Once saved, WHIG removes its temporary clips. If saving fails or permission is denied, the clips remain on your phone so you can retry. If you use iCloud Photos, Apple stores it like any other video in your library. WHIG never receives your video.

Reading the transcript

Reading the transcript is how WHIG makes your inventory, so it is needed for automatic inventory creation. Before your first walkthrough is read, the app tells you, under “How WHIG makes your list”, that a text transcript goes to Claude AI by Anthropic, and asks you to allow it. Choosing Not now sends nothing, and nothing is read. You can withdraw permission in Profile, Privacy. This stops future sends and retries on that phone, but cannot recall text already sent to Anthropic. You can also add items yourself.

Only the transcript text (the words you said, with timings) is sent, with your country, the recording length and any space name you chose. Anything you say aloud is part of the transcript. It is sent over an encrypted connection (TLS), to WHIG’s reading service. It runs on Amazon Web Services. The service passes the text to Anthropic’s Claude to identify your belongings, write short descriptions, assign categories and pick a price bracket. Price ranges come from WHIG’s researched pricing guide (low, mid and high per item type, per country), using only each item’s type and tier. The reply goes straight back to your phone.

WHIG does not store the transcript or returned inventory. We record account-linked reading identifiers and daily usage counts to enforce limits. Your sign-in is checked so only account holders can use the service. WHIG does not send account identifiers to Anthropic, but personal details in your narration or space names are included. Diagnostic logs contain operational metadata, not transcript or inventory content. Reading-service logs have a 30-day retention policy.

Anthropic processes the text under its commercial API terms. By default, Anthropic does not use API inputs or outputs to train its models. It deletes API inputs and outputs within 30 days of receipt or generation, except where a longer period is needed to enforce its usage policy, is required by law or has been agreed otherwise. See Anthropic’s data retention policy.

Your personal inventory

Your inventory is encrypted on your device. With an Evidence Package, you can save your documents together with a full copy of your inventory and photos to a location you choose, so you can restore WHIG on a new phone. That saved copy is not encrypted, so keep it somewhere private. WHIG never receives it.

Regional statistics

Regional statistics are off unless you turn them on in Profile, Privacy (signed-in accounts). WHIG uses them to improve estimates and may license aggregated research to insurers and researchers (see How we use aggregate data). You can stop future sharing at any time. Totals already added stay in the statistics, because nothing in them links back to you. Each account contributes once, and only from a whole-home walkthrough with at least 3 spaces and 15 items. Single-room recordings never contribute. Anonymous accounts never contribute: a real property profile is required.

A contribution is sent to a separate service and contains only:

  • Country, and the area from your profile: state or territory where listed, and city or regional
  • Property type and bedroom count (or a bedroom band)
  • Totals for standard categories (e.g. “Electronics”) and a household total
  • Two counts: the number of spaces and the number of items

Specialist items, such as jewellery and art, are left out.

It does not contain: user identifiers, item names, brands, transcripts, photos, individual values, or anything that could identify you or reconstruct your inventory.

Contributions are combined into banded totals by country, area, property type and bedroom band, kept separate by year and by the valuation method that produced them. Exact bedroom counts are only grouped nationally, never by area. A group is only used once at least 50 homes have contributed to it. An exact bedroom count is only used once 200 homes have contributed; below that, only bedroom bands are used.

Each account contributes once. We keep a note that your account has contributed, not what it contributed, so it is only counted once.

How we use aggregate data

The anonymised aggregate dataset has commercial value. We may licence it in aggregate form to insurers, actuaries, property and research organisations. This is part of how WHIG is funded and improved.

The released dataset contains combined category totals, not individual household records. It contains no user identifiers, item names, or individual values.

You can opt out at any time in Profile, Data & privacy. Past contributions cannot be individually extracted (they are aggregated at generation with no individual record retained). Opting out means nothing further is contributed from your account.

Encryption

Your inventory uses AES-256-GCM with a 256-bit key generated on your iPhone and protected by iOS secure storage. WHIG does not receive that key. A saved Evidence Package can be read by anyone who has the file, so store and share it with care.

Data deletion

Your walkthrough

Your video stays on your phone. After reading, WHIG attempts to save a copy to Photos. Temporary clips are removed after the copy is saved; if saving fails, they are kept so you can retry. Clips from a failed or interrupted recording stay on your phone so you can retry, until you discard them. The transcript is not stored by WHIG after it is read.

Receipts you attach

Receipts attached to your inventory are part of your local evidence. Email-based receipt processing is not part of the first iPhone release. Any future service that receives receipts needs a separate explanation of what is collected, who processes it and its retention.

Account deletion

You can delete your account at any time in the app, in Profile. This deletes your account and sign-in, your profile, consent choices, recording metadata, purchase records, any temporary recording files and fingerprints of older signed records. It also attempts to clear WHIG’s copy of your inventory on that phone. If local removal fails, the app tells you to delete and reinstall WHIG. Evidence Packages you saved elsewhere stay yours. Anonymised totals already added to regional statistics cannot be picked out or deleted, because they contain no user identifier. To remove a waitlist entry, contact us.

What is a sealed record?

Signed records from earlier versions of WHIG contain cryptographic fingerprints (SHA-256 hashes and AWS KMS digital signatures) identifying the signed original processing session. Later edits remain separate. These signatures check the signed hashes. They do not make a locally created record independently timestamped.

A sealed record contains:

  • Session identifier and processing time metadata
  • Hashes of processing outputs, including audio, transcript, inventory and extracted frames
  • Digital signatures from AWS Key Management Service

A sealed record does not contain:

  • Item names, values, or descriptions
  • Transcript content
  • Images or video frames
  • Anything that reveals what you own

Sealed records are kept in our database until you delete your account, so the signed original can be checked. This does not authenticate later edits, prove ownership, validate estimated values or establish the moment a video was filmed. Records made with the current app use an independent timestamp instead, described next.

Independent timestamps

When a walkthrough is saved, your iPhone computes a fingerprint of its original record: a SHA-256 hash of the inventory, the valuation, each item photo and the video, plus the session number, app version and the phone’s clock. Only that fingerprint is sent, with your sign-in, to WHIG’s timestamp service. It contains none of your items, words or photos. The service submits it to public OpenTimestamps calendar servers, which anchor it in the Bitcoin blockchain, and returns the proof to your phone. WHIG stores neither the fingerprint nor the proof.

Once certified, the proof can show the record existed by a Bitcoin block’s time. Certification can take hours and may remain pending or unavailable. It does not show when you filmed, who owns the items or what they are worth, and it does not cover edits made after saving. The Certificate of integrity in your Evidence Package describes it, and anyone can check it at whig.app/verify without uploading the file.

Sharing your documents

You choose how to send your exported PDF and JSON files using your phone’s sharing options. Check the contents before sharing: exports can include inventory details, photos, receipts and session identifiers. WHIG cannot revoke copies after you send them.

Service providers

  • Apple: on-device speech recognition, and App Store payments and refunds.
  • Anthropic: reads your transcript text, as described above.
  • Amazon Web Services: runs WHIG’s reading and timestamp services.
  • Supabase: accounts, sign-in and WHIG’s database.
  • RevenueCat: verifies App Store purchases and restores access, using your WHIG account identifier and purchase information. It does not receive your inventory.
  • OpenTimestamps calendar servers: receive record fingerprints only.
  • ipapi.co: suggests your country from your internet address when you set up your profile.
  • Frankfurter: currency exchange rates. No personal data is sent.

Your rights

  • Access: Your inventory data is on your phone and in any Evidence Package you save. You have direct access at all times.
  • Deletion: Delete your account in the app, in Profile. Account and service data deletion, retained fingerprints and past aggregate contributions are described above.
  • Opt out: Stop contributing anonymised aggregates at any time in Profile, Privacy. Withdraw transcript permission in Profile, Privacy to stop future sends and retries on this phone.
  • Portability: Your Evidence Package includes JSON structured data that can be used by compatible systems.

Applicable law

WHIG is designed to comply with privacy legislation across all markets we operate in, including the Australian Privacy Act 1988, UK GDPR, US state privacy laws (CCPA and equivalents), Canadian PIPEDA, and New Zealand Privacy Act 2020. Truly anonymised aggregate data is generally outside the scope of these frameworks; separate choices about processing and contributions are explained in this policy.

Contact

Questions about this policy? Get in touch.