Privacy Policy

Updated October 15, 2026

Wisp is a browser extension that turns the empty new tab into a workspace for your bookmarks. This page explains in plain words what data we get, why, and how we protect it.

Who processes your data

The data controller is Artur Sergeevich Bizilya, self-employed, taxpayer ID (INN) 503021503325, email privacy@wisp.monster. Data is processed in line with Russian Federal Law No. 152-FZ “On Personal Data”.

What we collect

Only what the extension needs to work — nothing for advertising or behavior analytics.

• Email and password — only if you create an account for sync. The password is stored as an argon2 hash; we can’t see it.
• Your workspace — pages, boards, links, tasks, habits, calendar events, goals and appearance settings, but only while you’re signed in and sync is on.
• Your own wallpaper — with Premium or the trial: the picture you choose (a single frame for videos) is stored on the server so it shows on your other devices and in Telegram. We keep the latest 5; wallpaper you delete in Wisp is deleted from the server too.
• Two-factor authentication — if you turn it on: the TOTP secret and recovery codes (codes are hashed, like passwords).
• Payments — we never see card details. Payments are processed by Robokassa and YooKassa; we only receive the payment status and amount.

Telegram bot and mini app

If you link Telegram to your account (bot @wisp_wisp_bot), we store:

• Telegram data — your numeric ID, username, first name, language, app platform (iPhone, Android, desktop) and the date you linked it.
• Your phone’s time zone — so the summary and reminders arrive on your local time.
• Notification settings — which messages the bot sends and whether you allowed it to write to you.
• Delivery notes — which summaries and reminders were already sent and which tasks you snoozed, so nothing arrives twice; one-time link codes that live for 5 minutes.

Links you send to the bot are saved to your workspace — the “Inbox” window, like links saved from the extension. We don’t store the chat itself. Telegram passes us this data signed; we never receive your phone number or contacts.

You can unlink Telegram at any time: in the extension (Settings → Account → “Wisp on your phone”) or in the mini app (Account → “Unlink Telegram from the account”). After that the bot stops writing to you and the mini app no longer gets your data. Telegram itself delivers the bot’s messages under its own privacy policy.

Without an account

Until you sign in, or while sync is off, your boards and links stay on your device in the browser’s database (IndexedDB) and are never sent to us.

Two widgets load public data from the internet: exchange rates come from cbr-xml-daily.ru, and site icons come from your browser’s cache or the site itself. These requests don’t include your bookmarks or any account data.

How we use data

• Sync — so the same boards and settings are on all your devices.
• Running the service — signing in, account recovery and activating Premium after payment.
• Service emails — about your account, payments and your trial ending soon. Everyone with an account gets them.
• News and offers — only if you opted in: with the checkbox at sign-up or the switch in Settings → Account. You can turn it off there at any time, or reply “unsubscribe” to any email.
• Nothing else. No ads, no behavior tracking, no selling or sharing data with third parties for marketing.

Legal basis and retention

We process data with your consent, given when you create an account or pay for Premium, and to perform our agreement — providing sync and Premium. News and offers by email need a separate consent; we keep the time you gave it while it is active. Account data is kept while the account exists; payment records are kept as long as tax law requires. You can withdraw consent at any time by emailing us: the account and its data will be deleted.

Storage and security

Account data is stored on our server in a PostgreSQL database. Passwords and recovery codes are hashed. Your session is confirmed by a token that expires after 180 days; signing out ends it right away.

Deleted pages, boards and links go to the trash first, so you can restore them. Deleting your account erases the data permanently (see “Your rights”).

What others can see

• Public links — if you share a board by link, anyone with that link can see it. It’s your choice and you can turn it off at any time.
• Rooms — people you invite to a room see the pages you open for them. Your email is shown to them only after you accept an invitation.
• Workshop and Ideas — appearance profiles you publish and ideas you post are public and shown with your public id (like #KAKB5), not your email.
• Robokassa and YooKassa process payments and see only the payment itself, not your boards.

We don’t share data with advertising networks, analytics services or data brokers.

Your rights

• Export — download all your bookmarks as a standard HTML file or a full JSON backup in Settings → Data.
• Delete your account — email us and we’ll erase your account and all related data permanently.
• Stop syncing — just sign out; the extension keeps working locally.

Children

Wisp is not intended for children under 13, and we don’t knowingly collect their data.

Changes

If this policy changes significantly, we’ll update the date at the top. Using Wisp after that means you accept the updated version.