WhosWhoZoo is built so the lasting copy of your memory lives in infrastructure you own, not on a server belonging to us. This page explains exactly what that does and does not mean — including the parts where your data does leave your account.
Last updated 24 September 2026
Your four memory files, the archive tiers, and every photo you save are stored in the Cloudflare account you created during setup. They sit in your KV namespace and your R2 bucket, under your billing, subject to your deletion.
If you stopped paying us tomorrow, none of it would be affected — there is no WhosWhoZoo service in the middle to switch off. That isn't a policy we're promising to honour; it's a consequence of where the files physically are.
The app can't answer questions without sending your notes to a model. Here is every outbound path — all of them from your own Worker, straight to the provider:
/recall.| Provider | Trains on it? | How long they keep it |
|---|---|---|
| Anthropic | No | Deleted within 30 days |
| OpenAI | No | Up to 30 days for abuse monitoring — except voice transcription, which has no such retention |
| ElevenLabs (optional) | Yes, unless you opt out | Voice data up to 3 years after last use |
ElevenLabs is the odd one out, and it's off by default. Their policy allows using customer data for training unless you opt out in your ElevenLabs account settings. If that matters to you, use the OpenAI voices instead — they're the default, and they carry the no-training guarantee.
These are the providers' own published policies, not promises we can make for them. Each offers a zero-retention arrangement, but Anthropic and OpenAI both gate it behind approval and an organisation-level agreement, so an ordinary install does not have one. If you need that, you'd need to arrange it with them directly for your own API account.
Installing the app means putting your keys into your Cloudflare account, and the installer does it for you. That means your Anthropic key, your OpenAI key, any ElevenLabs key, and your Cloudflare token pass through whoszoo.app on the way.
While we're forwarding them, we can technically see them. We won't claim otherwise — a service that handles a credential in transit is in a position to read it, and any wording that implies we couldn't would be false.
What we do about that: the relay writes nothing to disk, logs no request bodies or headers, and can only forward to a fixed list of provider addresses. Your keys exist in memory for the moment it takes to pass them along. They end up as encrypted secrets in your own Worker, which Cloudflare won't read back out to anyone — including us.
After installation, the setup service is never involved again. Your Worker calls Anthropic, OpenAI and ElevenLabs directly. Nothing routes through us. You could block whoszoo.app at your firewall and your app would carry on working.
Your Cloudflare token is the most powerful credential in the process, and it's only needed to install. We recommend deleting it once setup finishes — the app never uses it again, and a token you've deleted can't be misused by anyone, us included.
One record per install or update, kept in our own Cloudflare KV:
It exists for one purpose: telling whether a single licence is being installed across many different accounts. The account ID is hashed because the only thing that question needs is whether two entries match, never what the account actually is.
These records are kept for 24 months. Anything older is deleted automatically — the log prunes itself whenever a new install is recorded or the log is opened, so expired entries do not survive ordinary use of the product. We don't store your notes, your photos, your passphrase, your API keys, or your Worker's address.
Payments run through Gumroad, who are the merchant of record and hold their own copy of your purchase details under their privacy policy.
Your passphrase is hashed with PBKDF2-SHA256 and never stored in a readable form. Sign-in attempts are rate-limited per IP address. Changing your passphrase signs out every device immediately.
The Access Key from setup is a recovery credential only. On its own it can reset your passphrase and nothing else — it cannot read your memory, export it, or spend your API credit.
Export produces an encrypted bundle of every file and photo, protected by a password you choose. That password never leaves your browser: the encryption happens on your device, and it's never sent to the Worker or to Cloudflare. The app reads its own export format back, so there's no lock-in and no conversion step.
WhosWhoZoo has no compliance certification of any kind. Not HIPAA, not SOC 2, not PCI, not ISO 27001. Nothing on this page is a business associate agreement, a data processing agreement, or a guarantee of professional privilege.
It's built and maintained by one person. The architecture is genuinely more private than most note apps — that is a different claim from being cleared for regulated data, and we want to be careful not to let one sound like the other.
If you handle client records under a professional obligation — medical, legal, financial, pastoral — the question isn't whether this app is well built. It's whether your obligations permit storing that information in a personal cloud account and sending it to a commercial AI provider. Many don't. Check before you rely on it, and if you're unsure, keep identifying details out of your notes: the app is just as useful when someone is "M." as when they're a full name.
If you find a security issue, email renocreationsutah@gmail.com — or, if that shows as “[email protected]” because scripts are blocked, it is renocreationsutah [at] gmail [dot] com.
It's one developer, so expect a human reply rather than an instant one. Please give it a little time before disclosing publicly, and I'll keep you posted on the fix.