The short answer
Whizi stores your account, conversations, files and generated media on Cloudflare, using Workers, D1, R2 and Durable Objects. Authentication and account management are provided by Clerk, website payment processing is handled by Stripe, and image generation jobs and their output are handled by fal.ai.
Whizi and its service providers may process information in countries other than your own, including Canada and the United States. Where required, Whizi uses appropriate contractual or legal safeguards for international transfers.
| Data | Where it lives | How long |
|---|---|---|
| Conversations and messages | Cloudflare, on the stack that runs synchronized chats | Retained while the account remains active, unless you delete the content or the account |
| Uploaded attachments | Cloudflare R2 object storage | Configured to expire after up to 30 days |
| Generated media | Cloudflare R2 object storage | Configured to expire after up to 30 days |
| Pinned project files | Cloudflare, with the project | Stored until deleted, these do not expire |
| Saved memory | Cloudflare, with the account | Kept until deleted |
| Entitlement and usage state | Cloudflare, with the account | Kept while the account exists |
| Sign-in identity | Clerk | Removed by account deletion |
| Card details | Stripe, for website payments | Whizi does not store full payment-card numbers |
| Recent chats on a phone | A local cache on the device, up to 40 conversations | Cleared by the in-app deletion flow, by clearing app storage, or by uninstalling |
| Deleted database rows | Cloudflare D1 point-in-time recovery history | Up to 30 days before aging out |
The service providers named in the policy
The privacy policy names the providers Whizi uses to operate the service. The ones that touch stored content or account state:
- Clerk for authentication and account management.
- Cloudflare Workers, D1, R2, and Durable Objects for hosting, synchronized chats, media, account state, usage limits, reports, and security and operational processing.
- OpenRouter and routed model providers for AI prompts, responses, attachments, search context, transcription, speech, and related model processing.
- fal.ai for image-generation prompts, jobs, and generated media.
- Stripe for website payment processing.
- Expo for optional transactional push-notification delivery.
Two of these are visible in the product when something goes wrong. Media could not be stored. is raised when the R2 write returns no object, which is the storage layer failing rather than the model, and Invalid or expired session token. is HTTP 401 unauthorized when token verification against the Clerk JWKS throws.
Retention, category by category
The policy commits to a ceiling rather than a lifetime. Uploaded attachments and generated media "are configured to expire after up to 30 days and may be deleted sooner by you or during account deletion". Whizi's shared media constant is what currently sets that ceiling, at 30 days, so 30 days is the longest an object is configured to survive rather than the age it is guaranteed to reach.
The observable consequence is a specific refusal rather than a broken image. An object past its retention window returns Media has expired., HTTP 404 media_expired, while Media not found. is HTTP 404 media_not_found when the media id does not resolve for the caller at all. Generated images are served through signed URLs, so a link inside an old conversation was never a permanent address.
Two retention facts that are easy to miss:
- Pinned project files do not expire. Their bytes are stored until deleted, unlike chat attachments, because a pinned file has to ride along with every turn in the project.
- A phone keeps its own copy. The mobile app may keep a local cache of up to 40 recent conversations on a signed-in or guest device. That cache is not a separate cloud backup, and it is cleared by a successful in-app deletion flow, by clearing app storage, or by uninstalling.
Security and operational logs carry no published number of days. They are kept only as long as reasonably needed to operate and secure the service, investigate incidents, prevent fraud or abuse, resolve disputes, or comply with law.
What providers may cache after they answer
OpenRouter and routed AI or media providers may temporarily cache portions of a prompt or response to support multi-turn conversations, reduce latency, provide prompt caching, prevent abuse, or operate their services. Cache duration, retention, and any provider-controlled use vary by provider and endpoint.
Whizi does not represent that every provider follows the same retention period or a universal zero-data-retention setting, and does not claim it can instantly remove a provider cache that has already been created. Which provider receives a given message is covered in what Whizi does with your data.
What a lapsed subscription keeps
Cancelling and deleting are two different actions, and only one of them removes data. Cancelling stops billing and ends access at the end of the paid term, while the account and its contents remain. Account information and synchronized chat history are generally retained while the account remains active, unless you delete particular content or delete the account, which is what makes resubscribing later a continuation rather than a fresh start.
What changes is the tier, not the storage: an account that syncs down to the free tier keeps its account record, chats, media and saved memory exactly where they were. The limits and messages that come with that tier are covered in subscription not active.
One retention rule works in your favour here: Whizi does not keep deleted chat content or uploaded or generated media merely because a payment record must be retained. Payment processors may separately retain transaction, receipt, tax, fraud, chargeback or dispute records for periods required by law or their compliance obligations, and Whizi may retain limited account, transaction, security, tax, fraud-prevention or dispute records when legally or operationally required.
The timing rule for cancelling itself, and where to do it, is in billing and cancellation.
Getting a copy, or getting it all removed
Both paths are covered on neighboring pages: export chats and files carries the export contents, and what Whizi does with your data carries the account deletion section, with the item-by-item removal list and what survives deletion.
- Storage runs on Cloudflare Workers, D1, R2 and Durable Objects
- Sign-in is Clerk, website payments are Stripe, image generation is fal.ai
- Processing may occur in countries other than your own, including Canada and the United States
- Attachments and generated media are configured to expire after up to 30 days
- Pinned project files are stored until deleted and do not expire
- A phone may cache up to 40 recent conversations locally, which is not a cloud backup
- Cancelling keeps the account and its contents; only deletion removes them
Frequently asked questions
Where are Whizi conversations physically stored?
On Cloudflare. The privacy policy names Cloudflare Workers, D1, R2 and Durable Objects as the providers used for hosting, synchronized chats, media, account state, usage limits, reports, and security and operational processing. Attachments and generated media sit in R2 object storage specifically, which is why a failed write surfaces as Media could not be stored.
Can I choose which country my Whizi data is stored in?
The privacy policy makes no residency commitment. It states that Whizi and its service providers may process information in countries other than your own, including Canada and the United States, and that where required Whizi uses appropriate contractual or legal safeguards for international transfers.
An image in an older Whizi chat will not load. What happened?
Its retention window most likely passed. Generated images are served through signed URLs rather than permanent addresses, so a link sitting inside an older conversation can stop resolving, and the request answers Media has expired., HTTP 404 media_expired, instead of returning the bytes.
If I cancel my subscription, do I lose my chats?
No. Cancelling stops billing and ends access at the end of the paid term, while the account and its contents remain, so resubscribing later picks up where you left off. Account information and synchronized chat history are generally retained while the account remains active. Removing the data is a separate action, account deletion, and Whizi does not keep deleted chat content or media merely because a payment record must be retained.
Where is my data stored if I never created an account?
In the same place, under an anonymous device-bound guest profile. Creating an account is optional in the mobile app, and continuing without one needs no name or email address. The guest credential is stored on the device, and Whizi stores a one-way derived identifier so it can recognize the guest profile, synchronize data, verify subscription access, and later link that data to an account.