Privacy policy

Last updated: June 20, 2025

The privacy of your data is important to us. This document tells you what data we collect and why, how your data is handled, and your rights with respect to your data.

tl;dr

We don’t want to collect any of your data, and unless you specifically request to share it with us, we aren’t collecting it. And, if we do have your data, it is because you asked us to hold it and consider it yours. It’s not something that we are allowed to access, mine, or monitize in any way.

As of this writing, we are not collecting anything from you that you have explicitly asked us to collect. Our website does not use any databased cookies, we do not integrate with any 3rd-party marketing services, other than a font we use from Google, but we do not collect data from that HTTP request.

Our mobile app, Whosit, runs entirely on your device unless you elect to use our cloud services, and does not integrate with any external services for advertising, crash analytics, or anything else. All of our cloud services are encrypted distinct to your user account, and will be challenging for us to decrypt (technically possible, but not something we can do at scale), and extremely difficult for anyone else to do if our data leaks to another provider.

When required under applicable law. Devious Panda, LLC is a U.S. company and all data infrastructure are located in the U.S.

Requests for user data. Our policy is to not respond to government requests for user data unless we are compelled by legal process or in limited circumstances in the event of an emergency request. However, if U.S. law enforcement authorities have the necessary warrant, criminal subpoena, or court order requiring us to disclose data, we must comply. Likewise, we will only respond to requests from government authorities outside the U.S. if compelled by the U.S. government through procedures outlined in a mutual legal assistance treaty or agreement. It is our’ policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.

Preservation requests. Similarly, Devious Panda’s policy is to comply with requests to preserve data only if compelled by the U.S. Federal Stored Communications Act, 18 U.S.C. Section 2703(f), or by a properly served U.S. subpoena for civil matters. We do not disclose preserved data unless required by law or compelled by a court order that we choose not to appeal. Furthermore, unless we receive a proper warrant, court order, or subpoena before the required preservation period expires, we will destroy any preserved copies of customer data at the end of the preservation period. Our standard practice is to facilitate your recovery, so while data is generally flagged as deleted, rather than actually destroyed.

If we are audited by a tax authority, we may be required to disclose billing-related information. If that happens, we will disclose only the minimum needed, such as billing addresses and tax exemption information. Note to tax authorities: we don’t have anything at all.

If Devious Panda, Ltd is completely or partially acquired by, or merges with another company we will notify you before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

At Devious Panda, we strive to apply the same data rights to all customers, regardless of their location. Some of these rights include:

  • Right to Know what personal information is collected, used, shared or sold.
  • Right of Access the personal information we gather about you.
  • Right to Correction.
  • Right to be forgotten.
  • Right to Complain.
  • Right to Restrict Processing.
  • Right to Object.
  • Right to Non-Discrimination.
  • Many of these rights can be exercised by signing in and updating your account information. Please note that certain information may be exempt from such requests under applicable law. For example, we need to retain certain information in order to provide our services to you. Of course, since we don’t collect anything at all, all of these rights are moot, but we want to let you know that we respect them.

Depending on applicable law, you may have the right to appeal our decision to deny your request, if applicable. We will provide information about how to exercise that right in our response denying the request. You also have the right to lodge a complaint with a supervisory authority. If you are in the EU or UK, you can contact your data protection authority to file a complaint or learn more about local privacy laws.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at dave@deviouspanda.com and we’ll be happy to try to answer them!