Wherewhy privacy policy
Effective 27 September 2026
Wherewhy is made by Single Hand Studio ("we"). It helps you understand your own Solana wallet history. It is built to keep your records on your phone. This policy explains what stays on your device, what our server receives, who else is involved, and how to have your data deleted.
In short
- Your notes, labels, categories, rules, attachments and imported history are stored only on your phone.
- Our server receives your public wallet address so it can prove you own it and fetch public blockchain data for it.
- Wherewhy never asks for, sees or stores your seed phrase or private keys, and never moves your assets. The only transaction it ever asks your wallet to sign is a Pro payment you choose to make.
- There are no analytics, advertising, tracking or crash-reporting services in the app, and we do not sell data.
What stays on your phone
Imported transaction history, your notes, labels, categories, counterparty names, rules, review decisions and attachments are kept in the app's private storage on your device. They are excluded from Android's cloud backup. If you create a Wherewhy backup, it is encrypted with a passphrase you choose and saved wherever you decide; we never receive it or the passphrase.
What our server receives and keeps
| Data | Why | How long |
|---|---|---|
| Your public wallet address, when you first and last signed in, and how many times | To know which wallet a sign-in, a free trial or a purchase belongs to | Until you ask us to delete it |
| Sign-in challenges and sessions (stored as a one-way hash) | To prove you own the wallet, without a password | Challenges 5 minutes; sessions 15 minutes |
| Daily usage counters per wallet | To apply the daily activity-check limits and protect our provider budget | Deleted when they expire, within days |
| A one-way hash of your IP address | To limit abuse (rate limiting) | About one minute |
| Pro price quotes: wallet address, plan, token, amount | To match a payment to the price you were shown | Unpaid quotes are deleted after 30 days |
| Pro purchases: wallet address, transaction signature, amount, token and time | To grant Pro for life and restore it after a reinstall | For as long as your Pro plan exists, and as required for our records |
| Seeker trial claims: wallet address and the Genesis Token used | To allow one free trial per token and per wallet | For as long as the trial rule applies |
To show your history, our server asks a blockchain data provider for the public transactions of your wallet address and passes them to the app. The results are not stored on our server.
Services we use
- Vercel hosts our server, and Neon hosts its database. Like any web host, Vercel may keep standard request logs, which include IP addresses, for a limited time.
- Helius provides public Solana blockchain data. It receives your public wallet address from our server, not from your phone.
- Jupiter: the app asks Jupiter directly for token names and the SKR price. Only token mint addresses are sent, never your wallet address.
- Your wallet app (for example Seeker Wallet or Phantom) handles sign-in and payment approvals under its own privacy policy.
- Solana Explorer opens in your browser only when you tap a link to it.
These services may process data in the United States or other countries.
Payments
Pro is paid on the Solana blockchain from your own wallet. Blockchain transactions are public and permanent: anyone can see them, and nobody, including us, can delete them. We record the purchase so that Pro stays yours.
Deleting your data
- On your phone: uninstall Wherewhy, or clear its storage in Android settings, and delete any backup files you made. This removes everything the app stored.
- On our server: email singlehandstudio.games@gmail.com with your wallet address. We may ask you to prove you own the wallet, for example by signing a short message. We will delete the records linked to it within 30 days. Deleting a purchase or trial record ends that Pro plan or trial. We may keep a payment record where the law requires it.
Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the use of your personal data, and to complain to your data protection authority (in the UK, the Information Commissioner's Office). To exercise any of these rights, email us.
Children
Wherewhy is not directed at children, and we do not knowingly collect data from them.
Security
All traffic between the app and our server is encrypted (HTTPS). Session tokens are stored only as one-way hashes. Your private records never leave your phone unless you export or back them up yourself.
Changes
If this policy changes, we will update this page and its effective date.
Contact
Single Hand Studio, singlehandstudio.games@gmail.com