legal
Privacy policy
Effective October 20, 2026
Whisper is a chat tool for OnlyFans creators and their teams. It drafts replies in the creator's voice, and the creator or their team decides what gets sent. Operators sign in on the dashboard, connect an OnlyFans account, and can also use the Whisper command-line app.
This policy explains what personal information Whisper collects, why, who receives it, and the choices you have. It covers whisper.fans (the product and dashboard), docs.whisper.fans (the documentation), the command-line app, and emails we send. In this policy, "Whisper", "we", "us", and "our" mean the operator of Whisper.
Information we collect
Information you give us
- Account information. When you sign up or sign in, we collect your name, email address, the organization you belong to, and your role in it. We also record whether your account has been approved or is on the waitlist.
- Team invites. If you invite someone to your organization, we collect the email address you enter so the invite can be delivered.
- Connected-account settings. Settings you enter for a connected account, such as persona style, boundaries, and how far back to look at earnings.
- Content you create in Whisper. Questions you ask, and the changes you make to a draft before it is sent.
- Messages to us. If you email hello@whisper.fans, we keep your message and email address so we can respond.
Information from connected OnlyFans accounts
When a creator links an OnlyFans account, the sign-in happens on the screen of OFAuth, the service that handles the link. Whisper does not receive or store the OnlyFans password, and OFAuth holds the OnlyFans session. Once an account is linked, Whisper reads the following from it:
- the account's profile
- chats and messages, including messages with fans
- subscriber information
- earnings and transaction history
- vault media
- subscription counts
Whisper can also send messages and paid messages from the connected account. A message is sent when an operator approves it, or when an operator has turned on a setting that lets routine replies send without a separate approval.
Information we collect automatically
When you use Whisper, our servers and service providers record your IP address, browser or device type, the pages and features you request, timestamps, and error logs. When Whisper drafts a reply or answers a question, we log which AI model and provider handled the request, whether it succeeded, and how long it took. We use these records to run the service, track costs, and fix problems.
Our pages load fonts from Google Fonts. When your browser downloads those fonts, Google receives your IP address and basic browser information.
Command-line app
The command-line app signs in with short-lived access tokens and refresh tokens. The app keeps its tokens on your computer, and we store refresh tokens so we can renew or revoke your sessions. The app also keeps a local copy of connected-account data on your computer and syncs it with Whisper's storage so your team works from the same history.
Billing
Whisper does not collect payment card numbers today. Plans and credits are recorded manually. If we add a payment processor later, that processor will collect card details directly, and Whisper will not store card numbers.
What we do not collect
We do not collect precise location, government ID numbers, or demographic information. We do not use advertising cookies, show interest-based ads, or use Google Analytics.
How we use information
- To provide Whisper. Sign you in, show your organization the accounts it has connected, read connected-account data, draft replies, answer questions about the account, and send messages.
- To draft replies. We use the information on a connected account, and the instructions you give us, to prepare drafts for that account.
- To keep accounts secure. Manage sessions and tokens, control who in an organization can see which connected accounts, and investigate misuse.
- To track usage and costs. Record AI requests so we can measure usage for each organization and apply plan limits.
- To communicate with you. Reply to your emails and send service messages, such as usage alerts and notices that an account import has finished.
- To fix and improve Whisper. Use request and error logs to find bugs and improve performance.
- To comply with law. Respond to lawful requests and legal process, protect the rights and safety of people and of Whisper, and prevent fraud and abuse.
We do not use personal information for advertising, and we do not sell it.
Drafting and training
We use chats on connected accounts to draft replies and to improve drafting. Excerpts of those chats can be used when drafting for other Whisper customers. Marking an account private limits who on your team can open it. It does not keep those excerpts out of drafting for other customers. Drafts for an account also improve as that account is used. That is part of providing the service.
Separately, you can ask us to include a connected account in a training export. That export can include the account's chats, replies sent from it, and questions and answers from Whisper's own chat. It is off unless you email us to turn it on. When it is off, we do not add the account to the export. Turning it off applies to new material. Deleting the connection deletes copies kept for the export. To change it, email hello@whisper.fans.
How long we keep information
- Account information is kept for as long as your account exists. After an account is closed, we delete or de-identify it within a reasonable period, except where we need to keep it for security, to resolve disputes, or to comply with law.
- Connected-account content is kept while the account is connected. When a connection is deleted, Whisper stops reading new data from it and deletes copies kept for the training export. Excerpts already used for drafting stay until you ask us to delete them. To have the rest of that account's stored content removed, including those excerpts, email hello@whisper.fans and we will delete it, except logs we need for security and billing records.
- Request and usage logs are kept as operational records for cost tracking, security, and debugging.
- Copies on your computer made by the command-line app stay there until you delete them.
- Emails to us are kept as long as we need them to handle your request and keep a record of it.
Your choices
- Update your account. Use the account menu on the dashboard, or email us.
- Disconnect an OnlyFans account. Remove it from the accounts page. Whisper stops reading data from it. See the retention section above for what happens to content already stored.
- Training export. Email us to include a connected account in the training export, or to take it out. This does not turn off drafting, or the use of excerpts when drafting for other customers.
- Close your account. Email us to close your account and delete its information, subject to the exceptions above.
- Declining to provide information. We need some information, such as an email address, to give you an account. Without it, we cannot provide the service.
If you message a creator who uses Whisper
Creators and their teams use Whisper to read and reply to their OnlyFans messages. If you message a creator who uses Whisper, Whisper processes the profile details that creator can see, your messages with that creator, and your purchases from that creator, so that creator can draft replies. Excerpts of your messages may also be used when Whisper drafts for other creators. That text may be sent to the AI model provider used for the draft.
You can send questions or requests about this information to the creator, or email hello@whisper.fans with your OnlyFans username and the creator involved.
Security
We use safeguards designed to protect personal information, including encrypted connections, access controls within each organization, and short-lived sign-in tokens. No system is perfectly secure, and we cannot guarantee the security of your information.
Where information is processed
Whisper processes personal information in the United States, and our service providers may also process it in other countries where they operate. If you use Whisper from outside the United States, your information will be transferred to the United States, where privacy laws may differ from those where you live.
Children
Whisper is not intended for anyone under 18, and we do not knowingly offer it to anyone under 18. OnlyFans accounts are adult accounts. If you believe someone under 18 has given us personal information, email hello@whisper.fans and we will delete it.
OnlyFans and other services
This policy is not a promise about OnlyFans' own privacy policy. OnlyFans collects information directly under its own policy, and creators should read it. The service providers named above also have their own privacy policies. Our sites may link to other sites, and we are not responsible for how those sites handle information.
Your state privacy rights
This section applies to residents of California and other US states whose privacy laws apply to Whisper. It adds to the rest of this policy. Some rights exist only in some states, and each has exceptions, so we may decline a request where the law allows.
Notice at collection
The table below describes our practices now and during the 12 months before the effective date of this policy. It uses the categories in the California Consumer Privacy Act.
| Information | Category under California law | Disclosed for a business purpose to |
|---|---|---|
| Account information: name, email address, organization, role, approval or waitlist status, team invite emails, plan and credit records | Identifiers; customer records; professional information; commercial information | Clerk, Cloudflare |
| Connected-account data: OnlyFans profile, subscribers, chats and messages, vault media | Identifiers; electronic and visual information; sensitive personal information (contents of private messages) | OFAuth, Cloudflare, the AI model provider used for the account, Cursor when account analysis is run, and the model provider for another customer when an excerpt is used in that customer's draft |
| Earnings, transactions, and subscription counts from connected accounts | Commercial information | OFAuth, Cloudflare, the AI model provider used for the account, and Cursor when account analysis is run |
| Content you create in Whisper: account settings, questions you ask, and changes you make to drafts | Electronic information; inferences | Cloudflare, the AI model provider used for the account, and Cursor when account analysis is run |
| Device and usage data: IP address, browser or device type, pages requested, timestamps, request and error logs | Internet or other electronic network activity | Cloudflare, Clerk; Google Fonts receives IP address and browser details when fonts load |
- Sources. We collect this information from you, from members of your organization (for example, when they invite you), from connected OnlyFans accounts through OFAuth, from Clerk, and automatically when you use Whisper.
- Purposes. We use each category for the purposes listed in how we use information.
- Retention. See how long we keep information.
- No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing personal information of anyone under 16.
- Sensitive personal information. Connected-account messages can include the contents of private communications and information about a person's sex life, which some state laws treat as sensitive. We use this information only to provide Whisper as described in this policy and to keep it secure. We do not sell it or use it for advertising.
- Automated decisions. We do not use personal information for automated decisions that produce legal or similarly significant effects, such as decisions about housing, employment, credit, education, or health care.
- De-identified information. If we de-identify information, we do not try to re-identify it, except to test whether our de-identification meets legal requirements.
Your rights
- Know and access. Ask what personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and for a copy of it.
- Correct. Ask us to correct inaccurate personal information about you.
- Delete. Ask us to delete personal information we collected from you.
- Opt out. We do not sell personal information, share it for targeted advertising, or use it for significant automated decisions, so there is nothing to opt out of today. Browser signals such as Global Privacy Control have nothing to turn off, and we will honor them if that changes.
- Appeal. If we decline your request, you can appeal by replying to our decision or by emailing us with "Appeal" in the subject line.
- No discrimination. We will not treat you differently for exercising these rights.
How to make a request
Email hello@whisper.fans and tell us which right you want to exercise. We verify requests using the email address on your Whisper account, so send it from that address if you can. If you do not have a Whisper account, include your OnlyFans username and the creator involved so we can find the information. If we cannot verify a request, we may ask for more information or decline it. We respond within the time the law requires.
Where state law allows, you can have an authorized agent make a request for you. We may ask the agent for proof that you authorized them, such as signed permission or a power of attorney, and we may ask you to confirm your identity with us directly.
California Shine the Light
California residents can ask whether we disclosed personal information to third parties for their own direct marketing during the past year. We do not make those disclosures. You can send a request to hello@whisper.fans with "Shine the Light Request" in the subject line.
Changes to this policy
We may update this policy. When we do, we will post the new version on this page and change the effective date at the top. For material changes, we will also let account holders know by email or in the product.
Contact
For questions about this policy or to make a privacy request, email hello@whisper.fans.