Last Updated: February 2026
Wister ("we", "us", "our") operates the Wister mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App.
| Data | Purpose |
|---|---|
| Phone number | Account creation and authentication via SMS verification |
| Display name, username, bio | Profile visible to your contacts |
| Profile photo | Profile avatar visible to your contacts |
| Birthday and nameday | Celebration reminders for your contacts |
| Chat messages | Facilitating communication between users |
| Story images | Sharing temporary visual content (auto-deleted after 24 hours) |
If you apply to the Community Recognition Program (Section 7 of our Terms of Service), we may additionally collect:
| Data | Purpose |
|---|---|
| Government-issued ID (passport, national ID card, or driver's license) | Identity verification (KYC) as required by applicable law |
| Proof of address (utility bill, bank statement, or official correspondence) | Address verification for compliance purposes |
| Tax identification number (ΑΦΜ, TIN, or equivalent) | Tax reporting obligations under DAC7 and applicable law |
| Tax documentation (W-9, W-8BEN, Greek tax declaration forms) | Tax compliance and withholding obligations |
| PayPal email or SEPA bank details | Processing Community Recognition payments |
| Content creation and engagement metrics | Evaluating eligibility and contribution to the Wister community |
| Data | Purpose |
|---|---|
| Firebase Installation ID | Anonymous app instance identifier used for analytics and notifications |
| Device token (FCM) | Delivering push notifications |
| Online status and last seen | Showing availability to your contacts |
| IP address | Security, fraud prevention, approximate geolocation for regulatory compliance (collected by Firebase) |
| Device information | Device model, operating system version, app version — used for compatibility, debugging, and security |
| Transaction history | Recording Ruby purchases, gifts, and Community Recognition |
| Gift and transaction patterns | Gift frequency, volume, and recipient patterns — used for fraud detection and risk scoring (see Section 2A) |
| App usage data | Feature interactions, screen views, and in-app events — collected via Firebase Analytics for service improvement |
| Notification interactions | Whether push notifications are opened or dismissed — used to improve notification relevance |
Wister does NOT:
Firebase Analytics is used solely for anonymous, aggregated usage statistics to improve the App. No personally identifiable information is shared with advertising networks.
Contact sync is an optional feature that you can enable or disable at any time via Settings > Privacy > Contact Sync.
How it works:
You are in control:
Voice and video calls within the App are powered by Agora.io. During calls, the following data is processed:
| Data | Details |
|---|---|
| Audio and video streams | Transmitted in real-time between participants. Calls are NOT recorded or stored by Wister or Agora. |
| Call metadata | Call duration, timestamp, and participant user IDs — stored by Wister for service functionality. |
| Network quality metrics | Collected by Agora to optimize call quality (e.g., latency, packet loss). |
Encryption: All voice and video calls use Agora's encrypted transmission protocols.
No recording: Neither Wister nor Agora records or stores the content of your calls.
For more information, see Agora's Privacy Policy.
| Source | Data | Purpose |
|---|---|---|
| Google Play Services | Purchase verification tokens | Verifying in-app purchases of Rubies |
| Apple App Store | Purchase receipts | Verifying in-app purchases of Rubies |
We use the information we collect to:
To protect our community and the integrity of the Gift and Community Recognition systems, Wister operates an automated fraud detection system that processes certain data to identify potentially abusive activity.
What data is processed:
| Data | Purpose |
|---|---|
| Gift transaction patterns | Frequency, volume, and timing of gifts sent and received — to detect velocity anomalies and coordinated schemes |
| Payout account details | PayPal email — to detect shared payout accounts across multiple users |
| Withdrawal history | Frequency and amounts of withdrawal requests — to detect suspicious patterns |
| Account age and activity | Account creation date relative to transaction volume — to identify new account exploitation |
| Chargeback and dispute history | Payment disputes filed via Stripe or app stores — to detect refund abuse |
How it works:
Your rights:
Data retention: Risk profile data is retained for the duration of your account. If your account is deleted, risk profile data is anonymized or deleted within 30 days, except where retention is required by law for fraud investigation purposes.
Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:
| Legal Basis | Data |
|---|---|
| Contract performance (Art. 6(1)(b)) | Account data, messages, transactions — necessary to provide the service |
| Legitimate interest (Art. 6(1)(f)) | Fraud prevention and risk scoring (Section 2A), security, service improvement, Community Recognition Program eligibility assessment |
| Consent (Art. 6(1)(a)) | Contact sync, push notifications, birthday sharing, Community Recognition Program application — you can withdraw consent at any time |
| Legal obligation (Art. 6(1)(c)) | Financial transaction records, tax compliance, KYC/AML verification for Community Recognition, DAC7 reporting |
Chat messages in Wister are protected with End-to-End Encryption (E2EE) using industry-standard cryptography:
This means that only you and the person you are communicating with can read your messages. Wister cannot access the content of encrypted messages.
The App uses Google Play Services to provide core functionality on Android devices:
| Service | Purpose | Data Collected |
|---|---|---|
| Google Play Billing | In-app purchases of Rubies | Purchase history, transaction IDs |
| Firebase Authentication | Account creation and phone verification | Phone number, authentication state |
| Firebase Realtime Database | Real-time messaging and data sync | User data as described in this Policy |
| Firebase Cloud Storage | Storing profile photos and story images | Uploaded media files |
| Firebase Cloud Messaging (FCM) | Delivering push notifications | FCM device token |
| Firebase Analytics | Anonymous usage statistics | App events, user properties, device info, app version |
| Firebase Installation ID | Anonymous app instance identification | Unique installation identifier |
For more information: Google Privacy Policy and Firebase Privacy
On iOS devices, the App uses Apple services:
| Service | Purpose | Data Collected |
|---|---|---|
| Apple Push Notification Service (APNs) | Delivering push notifications | Device push token |
| App Store In-App Purchases | In-app purchases of Rubies | Purchase receipts, transaction IDs |
For more information: Apple Privacy Policy
| Service | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Payment processing for Ruby purchases (credit/debit card). Wister does not store your card details — Stripe handles all card data securely. | stripe.com/privacy |
| PayPal | Processing Community Recognition payments to eligible Participants | paypal.com/privacy |
| Agora | Voice and video call infrastructure (see Section 1.5 for details) | agora.io/privacy |
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Chat messages | Until deleted by sender or chat cleared |
| Story content | Automatically deleted after 24 hours |
| Transaction records | 7 years (legal/tax requirement) |
| Community Recognition Program data (KYC, tax docs) | 7 years from last transaction (legal/tax/AML requirement) |
| Risk profile and fraud alert data | Duration of account + 30 days after deletion (or as required by law for fraud investigations) |
| Push notification tokens | Until you log out or uninstall the App |
| Contact sync data (hashed numbers) | Until you disable contact sync or delete your account |
| Firebase Installation ID | Until you uninstall the App or clear app data |
| Call metadata (duration, timestamps) | 1 year from call date |
| App usage / analytics data | 14 months (Firebase Analytics default) |
| Device information | Until you delete your account |
When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
You may delete your account at any time through the following methods:
Upon account deletion:
You will receive a confirmation notification when your account deletion is complete.
Your data is stored on Google Firebase servers located in the European Union (europe-west1 region). If data is transferred outside the EU, it is protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) in compliance with GDPR.
For all data protection and privacy matters, you may contact us:
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):
As a user in the European Union, you have the following rights:
To exercise any of these rights, contact us at info@donationpos.gr.
We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at https://www.dpa.gr.
The App is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. Financial features (Ruby purchases) and the Community Recognition Program require users to be at least 18 years old.
Age verification: Account creation requires SMS verification of a mobile phone number. During registration, users must confirm their date of birth. The App enforces the following age-based restrictions:
If we become aware that a user has provided a false date of birth or that a child under 16 has created an account, we will take steps to suspend the account and delete the associated personal data promptly. We reserve the right to implement additional age verification measures as required by applicable law or platform policies.
If you believe that a child under 16 has created an account, please contact us immediately at info@donationpos.gr.
We implement appropriate technical and organizational measures to protect your personal data, including:
No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
In compliance with Google Play's Data Safety requirements, the following summarizes our data practices:
| Data Type | Collected | Shared | Purpose | Optional |
|---|---|---|---|---|
| Phone number | Yes | No | Account creation, authentication | No (required) |
| Name / Username | Yes | No (visible to contacts within App) | User profile | No |
| Profile photo | Yes | No (visible to contacts within App) | User profile | Yes |
| Birthday / Nameday | Yes | No | Celebration reminders | Yes |
| Messages | Yes | No (E2EE, unreadable by Wister) | In-app communication | No |
| Photos (Stories) | Yes | No (visible to contacts, auto-deleted 24h) | Content sharing | Yes |
| Purchase history | Yes | Stripe (payment processor) | Transaction processing | No (if purchasing) |
| Device identifiers (Firebase Installation ID) | Yes | Firebase (Google) | Analytics, notifications | No |
| IP address | Yes | Firebase (Google) | Security, fraud prevention | No |
| App usage data | Yes | Firebase (Google) | Service improvement | No |
| KYC documents (Community Recognition only) | Yes | No | Legal compliance | Yes (only if applying) |
Data deletion: Users can request deletion of their account and associated data at any time via the App settings or by contacting info@donationpos.gr. Data is deleted within 30 days except where retention is required by law.
Data encryption: All data is encrypted in transit using TLS. Chat messages are additionally protected by End-to-End Encryption (E2EE).
In compliance with Apple's App Privacy requirements:
Data Used to Track You: None — Wister does not track users across apps or websites.
Data Linked to You:
Data Not Linked to You:
The Wister website (https://www.wister.site) may use essential cookies required for the website to function properly. We do not use advertising cookies, tracking cookies, or third-party analytics on our website. If this changes in the future, we will update this Privacy Policy and implement an appropriate cookie consent mechanism in compliance with the ePrivacy Directive (2002/58/EC) and applicable national law.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the App or sending a push notification. Your continued use of the App after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your personal data, contact us: