Privacy policy
effective 31 October 2026. What Wundr keeps about you, and why.
Wundr is a feed of small interactive programs at wundr.fun and in the Wundr app. It is operated by Hitesh Goyal ("Wundr", "we"). This page says what we collect, what we do with it, who else touches it, and how to have it removed. It applies to the website and the app together.
the short version
On the website you can play everything without telling us who you are, and without an account our server holds nothing about you: your progress stays in your browser. The app asks you to sign in. If you sign in, we keep your email address and the fact that Google, Apple or a six-digit code proved it was yours. If you sign in with WhatsApp or add it, we also keep your WhatsApp number and the identifier Meta gives us for you; the message you send to sign in goes through Meta. People who have your number can find you on Wundr by it unless you turn that off in settings. In the app, finding friends sends the phone numbers in your contacts to us to check against Wundr accounts, only when you ask, and we do not keep them. Anything a wundr does with your microphone, camera or motion sensors happens on your device and never leaves it. We do not sell data and we do not show advertising.
what we collect, and where it comes from
Nothing, if you do not sign in. On the website, playing needs no identity. The progress a wundr saves for itself is kept in your browser. Our server counts how many times each wundr was played and shared, and a count from someone who is not signed in carries nothing that says who. A shared link carries a random code for that one share, so we can see that someone arrived on it; the code is not tied to a name, an address or a device fingerprint. The app asks you to sign in before you play; the usage measurement below uses a separate random identifier, which is not your account.
What you do with wundrs, once you sign in. Which ones you have played, liked, saved or shared, the progress a wundr saves for itself (a streak, a best score, a drawing you made), the people and topics you follow, and votes on the request board. Each is stored against your account. When you sign in, the progress you made in that browser before signing in is added to your account, and we show you what was added with a way to take it back out.
What you write. A request for a wundr. A handle you claim. Requests can be listed publicly once a person on our team reviews them; a way to reach you, which a request made before 22 October 2026 could carry, is never shown publicly. A comment on a wundr or a reply to one, and the comments you like: anyone can read a comment, with your handle and character beside it, and see how many likes it has, but not who liked it. When you delete a comment, or your account, its words are deleted at once; if someone has replied to it, an empty marker with no name or words keeps its place so the reply still reads. A catalogue you create: its name, its one-line note and the wundrs in it. Anyone who has a catalogue's link can open it, and it is listed on your page, unless you make it private.
Reports and blocks. When you report something, we keep what you reported, the reason you picked, anything you wrote with it, and, if you were signed in, that it was you. A wundr can be reported without an account, and that report is kept with nothing that says who sent it. Reports are read by our team only; the person whose page, catalogue, request or comment you reported is not told it was you. When you block someone, we keep that you did, so that neither of you is shown the other's page, catalogues or comments. The person is not told.
Your account, if you make one. Your email address; if you use Google or Apple, the account identifier that provider gives us for you and the address it confirms, and nothing more (we ask for your email only, never your name, contacts or picture; if you chose Apple's Hide My Email, the address we hold is the relay address Apple made for you); for Apple, a token we keep only so that we can tell Apple to end our access when you delete your account; whether the year you were born makes you 13 to 17 or 18 or over, and when (we never keep the year); and the sign-in sessions on your devices (a hashed token, the device's browser string, and timestamps) so you can sign one out. Six-digit codes are stored hashed, expire in minutes, and are deleted after use.
What is public about an account. Your handle, the character you drew if you drew one, the catalogues you created and did not make private, the comments you wrote, and who you follow and who follows you can be seen by anyone. Your email address, your number, what you saved and your progress cannot. If you draw a character, we keep the short recipe it is drawn from and the picture our server draws from it; you never upload a photo for it.
WhatsApp, if you use it. To sign in with WhatsApp you send us a message with a short code in it. That message reaches us through Meta, which runs WhatsApp, and Meta tells us the identifier it uses for you and, in most cases, your phone number. We keep the identifier so you can sign in again, and the number on your account, with when it was confirmed. A record of each sign-in (the code, which WhatsApp sent it, and the kind of device that asked) is kept for about a day so the sign-in can finish, then deleted. Nothing else from the chat is kept, not even the name on your WhatsApp profile. By default, people who have your number can find your Wundr name with it (see below); you can turn that off, or remove WhatsApp from your account, in settings.
Your contacts, in the app, only if you ask. Finding friends reads the phone numbers in your contacts, after you agree on a screen that says so and then in your phone's own permission prompt. We send those numbers, never names, to our server with your phone's region, compare them with the numbers people have allowed to be found, and drop them: they are not stored or logged, and we do not contact or invite anyone in them. You see the Wundr names that matched. You can withdraw the permission in your phone's settings at any time.
Notifications, in the app, if you turn them on. If you allow notifications, your phone gives the app an address to send them to, a push token. We keep it with the sign-in session on that phone, so signing out there stops them. We use it to tell you that someone followed you, liked or commented on a card you made, challenged you or answered your challenge, or wants a game with you, or that the team looked at a card you made, and for nothing else. We hand each notification to Apple, for an iPhone, or Google, for an Android phone, to deliver. You can turn each kind off in the app's settings, or all of them in your phone's settings.
Usage measurement. We record events about how Wundr is used: that the app opened, that a wundr was seen, touched, stayed on, liked, saved or shared, which pages were opened and which steps of signing in were taken, how long something took to make on your device (such as the picture of a run), and the coarse preferences you picked when you first arrived. We do not record what you type, and we do not capture the contents of the canvas. On the website, our analytics provider may also record interaction patterns for a session, such as scrolls and taps, to help us find what is broken. In the app, the same kinds of events may be sent from your phone, the wundrs you play included, with a random identifier the app makes for itself and keeps on your phone, and the app asks our analytics provider not to work out where you are from them, and not to keep your phone's internet address. That identifier is not your account, your name, your email or your number, and a new one replaces it when you sign out or delete your account. The app does not read your phone's advertising identifier, and nothing in these events is used for advertising or to track you across other companies' apps or websites. You can stop the app sending them at any time: turn off share usage data in the app's settings.
What you search for. What you type into search is matched on your device first. When it is a description rather than a subject we can answer from the catalogue itself, it is also sent through our server to a model run by TypeSafe AI, which ranks the wundrs against it. It is sent without your account or your name, and we do not store it.
Guesses in the sketch room. When you guess a drawing, the guess and the word being drawn are sent through our server to the same TypeSafe AI model, which says whether they name the same thing. Nothing else goes with them: not your account, your name or the drawing. The room keeps the game in memory while it runs, and not after.
Your network address. Our server reads the address a request comes from to limit abuse, for example how many plays or shares one connection can record in a few minutes. It is held in memory for the length of that window and is not written to a database.
Sensors and photos: on your device only. Some wundrs listen, look, or feel motion. That data is processed in your browser or app, in the moment, and is never uploaded, recorded or measured by us. This is a rule of the product, not a setting. Where a wundr lets you bring in a thing of your own from a photo, the photo is cut out on your device and the cut-out is kept on your device; we do not receive either.
cookies and local storage
Your preferences and the progress wundrs save live in your browser's local storage, which is what lets you play without an account; once you sign in, so does your sign-in token. During a sign-in we set one short-lived, HTTP-only cookie on our API so the round trip to Google, Apple or your inbox cannot be hijacked; it expires within ten minutes. Our analytics provider sets its own identifier for the measurement above on the website; in the app, the random identifier described there is kept in the app's own storage on your phone instead. We do not use advertising cookies.
what we use it for
To make the feed work and remember you between visits; to sign you in and keep your account yours; to let people who have your number find you on Wundr, if you leave that on, and to show you which of your contacts are here when you ask; to add the progress you made before signing in to your account when you sign in; to count how often each wundr is played and shared; to decide which wundrs to show next; to run the public request board; to send you a sign-in code when you ask for one; to keep the service from being abused; and to understand, in aggregate, what people find worth their time. We do not use your data to profile you for advertising, and we do not sell or rent it.
who else handles it
Providers that run infrastructure for us, each bound to process data only on our behalf: Vercel serves the website; Railway hosts our API and database; Resend delivers sign-in emails; Google or Apple handles sign-in when you choose it; Meta carries the WhatsApp message you send to sign in, and the replies we send you there; Cloudflare stores the pictures of drawn characters; PostHog stores the usage events above; Apple and Google deliver the app's notifications. TypeSafe AI runs the model that ranks a search by description and judges a guess in the sketch room, and receives what was typed and nothing about who typed it. Some of these run in the United States, so your data may be stored outside India. We will disclose data if the law requires it, or to protect the safety of people using Wundr.
how long we keep it
Sign-in codes: minutes; a WhatsApp sign-in record, about a day. Sessions: 90 days from last use, or until you sign out. Your WhatsApp number and identifier: until you remove WhatsApp in settings or delete the account. A phone's push token: until you sign out on it, its session ends, or it stops taking notifications. The numbers from your contacts: not kept at all. Your account and what you did: until you delete the account. A request you posted to the board outlives the account, with your account and contact removed from it, because the board is a record of what people asked for. A report you sent also outlives the account, with your account and anything you wrote removed from it, because what was reported still has to be looked at; your blocks, the blocks others made of you, and reports about your own page or catalogues go with the account. The plays and shares you made stay in each wundr's count with nothing attached that identifies you. Analytics events are kept for one year, then deleted.
your choices and rights
Delete your account from settings on the website (the dots on the You page) or from the You tab in the app. That removes your email, your WhatsApp number, sign-in methods, sessions and everything stored against your account, including the catalogues you created, the comments you wrote and your character; if you signed in with Apple, we also tell Apple to end our access. It detaches your account from any request on the board and from the plays and shares it counted.Stop being findable by your number, or remove WhatsApp, in settings.Undo a block from the You tab in the app, under blocked people.Sign out a device from the same place; signing out also clears your account's progress and likes from that browser. Play without an account on the web at any time; what you play then stays in your browser, and clearing your browser storage removes it.
Under India's Digital Personal Data Protection Act, 2023, and other laws that may apply to you, you can ask us what personal data we hold about you, ask us to correct or erase it, withdraw consent, and raise a grievance. Write to hitesh@wundr.fun. We answer within the time the law allows, usually sooner. If you are not satisfied, you may approach the Data Protection Board of India. Our grievance contact is Hitesh Goyal, reachable at the same address.
children
On the website, playing needs no account and no personal data, at any age. An account is for people who are 13 or over: we ask the year you were born when you sign up, and we do not knowingly hold personal data about anyone younger than 13. If you are under 18, use Wundr with the permission of a parent or guardian. When that year makes you 13 to 17, the app starts with share usage data turned off, and we remove anything posted on Wundr that is not suitable for people under 18. If you believe we hold data about a child under 13, write tohitesh@wundr.fun and we will remove it.
security
Session tokens, email codes and the secret a WhatsApp login is collected with are stored as hashes, so a copy of our database contains no working logins. Traffic to our servers is encrypted. No system is perfectly secure; if we learn of a breach affecting you, we will tell you and the authorities the law requires.
changes
When this page changes in a way that matters, the date at the top changes with it, and if you have an account we will tell you before the change takes effect. Continuing to use Wundr after that date means the new version applies.