Privacy Policy
Effective 5 November 2026 · Last updated 6 October 2026
This policy explains what personal information Wendkom, LLC collects when you use iShalom or visit wendkom.com, why we collect it, who else sees it, and what you can ask us to do with it.
iShalom is still in development. It is not yet generally available, and some of the practices described here apply to a service you cannot sign up for yet. Where something is planned rather than built, this page says so rather than describing it as though it already works.
Contents
Who we are
Wendkom, LLC is a limited liability company organised under the laws of the State of Washington, United States, UBI 606 295 898, with an effective date of 5 November 2026. Our registered address is 522 W Riverside Ave #10688, Spokane, WA 99201, United States.
For the purposes of data protection law, Wendkom, LLC is the controller of the personal information described in this policy. You can reach us about anything on this page at privacy@wendkom.com.
TODO — name the EU Article 27 representative here, with a postal address in an EEA member state and a contact email, before iShalom is offered in the EEA.
TODO — name the UK Article 27 representative here, with a UK postal address and a contact email, before iShalom is offered in the United Kingdom.
What this covers
This policy covers the iShalom application — on iOS, Android and the web — and the wendkom.com website. It does not cover other companies' services, including the app stores you download from, your mobile carrier, or any website we link to.
Messages you send travel to other people. Once someone receives your message, what they do with it is outside our control and outside this policy.
What we collect
We try to collect as little as the product can work with. We do not buy personal information about you from anyone, and we do not sell or share it for advertising.
| Category | What it is | Why |
|---|---|---|
| Account | Your name or display name, email address, password (stored only as a one-way hash, never in a readable form), and your profile photo if you add one. | To create your account, sign you in, and let the people you talk to recognise you. |
| Messages | The conversations you take part in, and their contents. Where end-to-end encryption is in use we hold only ciphertext — see section 4. | To deliver your messages and show you your history across your devices. |
| Attachments | Photos, voice notes, files and other media you send or receive. | To deliver them. These are not end-to-end encrypted. |
| Calls | Who called whom, when, for how long, and the technical quality data needed to route a call. We do not record calls. | To connect calls, to show you your call history, and to diagnose call failures. |
| Device & push | A push notification token issued by Apple or Google, your device model and operating system version, app version, and language setting. | To deliver notifications and ring your device for an incoming call, and to support the devices people actually use. |
| Technical logs | IP address, request times, and error diagnostics generated by our servers. | To keep the service running, to investigate faults, and to detect abuse. |
| Support | What you write to us, and the address you write from. | To answer you. |
Things we do not do
- No third-party analytics or advertising. iShalom contains no analytics SDK, no advertising SDK and no tracking pixels. We do not profile you and we do not build an advertising identity for you.
- No call recording. Voice and video are relayed, not stored.
- No selling. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Your contacts
We do not read your phone's address book. iShalom never asks for access to your contacts, and no copy of them reaches us. The contact list inside the app is only the people you have connected with on iShalom itself.
What we can and cannot read
"End-to-end encrypted" means only the people in the conversation hold the keys, so we could not hand over the contents even if we were compelled to. It is a strong claim, so here is exactly where it applies and where it does not.
End-to-end encrypted
- Text messages, where enabled. Your device seals each message separately to every recipient device using keys that never leave those devices. Our servers store only the sealed envelopes. We cannot read these messages, and our own server-side search cannot either — encrypted messages are excluded from it by design.
Not end-to-end encrypted
- Attachments. Photos, voice notes and files are protected in transit and on disk, but we hold them in a form we could read. End-to-end encryption for attachments is planned and not yet built.
- Calls. Voice and video are encrypted between your device and our server, and between our server and the other participants, but the call passes through a server we operate in order to be routed. We do not record calls; we could in principle observe the media as it passes.
- Anything outside the message body — who you talk to, when, your account details, your profile photo.
Notifications. To ring your phone when the app is closed, we must hand a notification to Apple's or Google's push service. We keep the contents of that notification to the minimum needed, but the fact that you received something at a given moment necessarily passes through them.
Why we use it
We use the information above to provide the service, to keep it secure and working, to answer you when you contact us, and to comply with the law.
If you are in the United Kingdom, the European Economic Area or another place with similar law, our legal bases are: performing our contract with you (delivering your messages and calls); our legitimate interests (keeping the service secure, preventing abuse, and fixing faults); your consent, where we ask for it, such as for access to your camera, microphone or notifications; and compliance with legal obligations. Where we rely on consent you can withdraw it at any time, including in your device settings.
Who else receives it
We use a small number of service providers to run iShalom. They process information on our instructions, for us, and not for their own purposes.
| Provider | What for | What they see |
|---|---|---|
| Apple | Push notifications to iPhone and iPad (APNs) | A device token and the notification payload |
| Push notifications to Android (Firebase Cloud Messaging) | A device token and the notification payload | |
| Google reCAPTCHA | Blocking automated sign-up abuse | IP address and interaction signals from the sign-up page |
| Hetzner Online GmbH | The servers that run iShalom and store its data, located in Hillsboro, Oregon, United States | Everything we hold, as the operator of the machines |
Account and notification email is sent by our own mail server at wendkom.com. No third party handles it.
Text messages
If you give us your mobile number we use it to send account security messages — a code to reset your password, and alerts about two-factor authentication on your account. We send no marketing texts.
Mobile information is never shared with third parties or affiliates for marketing or promotional purposes. Everything described elsewhere in this section excludes text messaging opt-in data and consent: that information is not shared with anyone. Service providers who help us deliver messages process it only to do that, and for nothing else.
You can stop account security texts by replying STOP to any of them, or by removing your number in Settings. Replying HELP returns our contact details. Message frequency varies, and your carrier's message and data rates may apply. Stopping these messages may prevent you signing in if you lose access to your password or your authentication app.
Our call servers are operated by us, on our own infrastructure. Call media is not handed to a third-party calling provider.
Legal requests
We may disclose information if we are legally required to — a valid subpoena, court order or equivalent — or where we believe in good faith that disclosure is necessary to prevent serious harm. We can only ever produce what we actually hold, which for end-to-end encrypted messages is ciphertext we cannot open.
If the business changes hands
If Wendkom, LLC is sold, merged or reorganised, information may transfer as part of that transaction. It would remain subject to this policy until you are told otherwise.
Where it is processed
Wendkom, LLC is based in Washington State, and our servers are in Hillsboro, Oregon, United States. If you use iShalom from outside the United States, your information is transferred there and processed there, under laws that may differ from your own and that may permit access by United States authorities.
Where personal information is transferred out of the United Kingdom or the European Economic Area to a provider acting for us, we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum to them, with that provider.
How long we keep it
We keep your account and your conversations for as long as your account is open, so that your history is there when you open the app. Most of the rest runs on a timer, applied automatically every night:
- Account and messages — until you delete your account (see section 10).
- Messages you delete — removed from your view at once, and erased from our servers, with their attachments, after 30 days.
- Call records — 12 months. We never record the calls themselves.
- IP addresses — 90 days, after which they are stripped from the records that held them.
- Technical logs — 30 days.
- Sign-in sessions — 30 days after they go idle.
- Moderation records — 24 months, without your IP address after the first 90 days.
- Support correspondence — we aim to keep it no longer than 24 months, and we delete it within 30 days if you ask us to or if you delete your account.
- Backups — deleted data may persist in encrypted backups for a short period before those backups rotate out.
We may keep information longer where we have to for legal reasons, or to resolve a dispute or enforce our Terms.
Your rights and requests
Wherever you are, you can ask us to show you what we hold about you, correct it, delete it, or give you a copy in a portable form. You can also object to our processing, or ask us to restrict it.
Depending on where you live you may have further rights — for example under the UK and EU GDPR, or the California Consumer Privacy Act. Exercising them never costs you anything and we will not treat you differently for asking.
Write to privacy@wendkom.com. We answer within 30 days, and we will tell you if we need longer. We may need to verify that the request really comes from you before we act on it, particularly for deletion.
If you are in the UK or EEA and you think we have got this wrong, you can complain to your national data protection authority. We would rather you told us first.
Deleting your account
You can delete your account from inside iShalom, in Settings. You do not need to ask us, and you do not need to install the app to get it done — if you cannot reach the in-app option, email privacy@wendkom.com from the address on the account and we will do it for you.
Deleting your account removes your profile, your account details, your message history on our servers, and your attachments. Two things survive, and it is fairer to say so than to discover it later: messages you already sent remain on the devices of the people who received them, which we cannot reach; and anonymised technical logs that are no longer linked to you may remain until they rotate out.
Children
You must be at least 13 years old to use iShalom. If you are in the European Economic Area or the United Kingdom, you must be at least 16. Where the law where you live sets a higher minimum age than either of those, that higher age applies to you.
iShalom is not directed at young children, and we do not knowingly collect personal information from a child below that age. If you believe a child has given us information, write to privacy@wendkom.com and we will delete it.
Security
Everything travels over encrypted connections. Passwords are stored only as one-way hashes, so nobody at Wendkom can read your password. Access to production systems is limited to those who need it. Text messages can be end-to-end encrypted, which means that for those messages the strongest protection is one we cannot undo.
No service is perfectly secure, and we would rather say that than imply otherwise. If you find a vulnerability, please tell us at security@wendkom.com — see reporting a security issue.
Changes to this policy
When we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you in the app or by email before it takes effect, rather than relying on you noticing a new date.
How to contact us
Privacy questions and requests:
privacy@wendkom.com
Security reports:
security@wendkom.com
Everything else:
hello@wendkom.com
Wendkom, LLC
522 W Riverside Ave #10688
Spokane, WA 99201
United States