privacy.
Last updated October 2026
No accounts, no names, no ads. Your voice is deleted after 24 hours. We keep almost nothing, and nothing that points back to you.
Who runs Whisperdrop
Whisperdrop is run by Karol Gajda, an individual based in the United States, who is responsible for your data (the "data controller" under the GDPR and UK GDPR).
What we store, and for how long
- Your recording: stops playing after 24 hours and is deleted from our storage within about an hour after that. If you take it back, it's deleted right away.
- Reactions, reports and plays: deleted along with the secret.
- A random cookie: lets you react, report, and take back your own secret. It's not linked to who you are, and it expires after 30 days.
- Your IP address: never stored by us. We keep a scrambled version that changes every day, only to stop spam and abuse and to count each listener once.
Once it's out there
Deleted from Whisperdrop doesn't mean nobody kept a copy. Anyone listening can record what they hear, and we can't stop that. A recording of your voice could also identify you to someone who knows you. Keep both in mind before sharing.
Who else is involved
Whisperdrop runs on Cloudflare. Cloudflare sees your IP address, as any host does, to deliver the site and protect it from attacks. It also:
- Stores the recordings until we delete them. How long deleted data lingers in Cloudflare's own systems is covered by its terms, not ours.
- Checks for bots (Turnstile), using your IP address and signals from your browser. This only runs when you react, report, or post.
- Counts page visits (Web Analytics): pages viewed, where visitors came from, rough location, and browser type. No cookies, and no tracking of individuals.
All of this is covered by Cloudflare's privacy policy. Cloudflare handles this data on our behalf and only on our instructions. We don't sell data, show ads, or share it with anyone else.
Why we use it
- Storing and playing your recording: to provide the service you ask for when you drop a secret (performance of a contract). A recording may reveal sensitive things about you, like your health or beliefs; you choose to make it public, and you can take it back.
- The cookie, the scrambled IP, reports and play counts: to keep Whisperdrop safe and working, stop spam and abuse, and moderate what's posted (our legitimate interests).
- Page visit counts: to understand how Whisperdrop is used, without identifying anyone (our legitimate interests).
Cookies
We only use cookies the site needs to work: the random cookie above, and a small one that tells the page you already have it. There are no advertising or tracking cookies, so there's no cookie banner.
Where your data goes
Whisperdrop is run from the United States, and Cloudflare processes data in many countries. If you're in the EU, UK or Switzerland, Cloudflare protects transfers with the safeguards the GDPR requires, such as the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Automatic hiding
If people on several different networks report a secret, it's hidden automatically, and a person reviews it. This is about the recording, not about you, and it has no legal or similar effect on you.
Your rights
Under the GDPR and UK GDPR you can ask to see, correct, delete, or export your data, restrict or object to how it's used, and complain to your local data protection authority (in the UK, the ICO). The fastest way to delete a secret is Take it back, from the phone you posted it on.
Because there are no accounts, we can only find your data if you can show it's yours, for example with the secret's link and the phone you posted from. Most of it is gone within a day anyway.
Children
Whisperdrop is for adults only. If we learn someone under 18 has posted, we delete it.
Changes
If this page changes, the date at the top changes too.