Privacy
Last updated October 2, 2026
Whisk is an early-access desktop design tool for people and AI agents working together on real HTML and CSS. This page explains the information used to run Whisk and the choices you have about your account and files.
Account information
Whisk uses WorkOS to support email-code and Google sign-in. We use your account ID, verified email address, and name to identify you, display collaborators, deliver invitations, and control access. Signing in with Google provides the identity information needed to authenticate your account.
The desktop app manages your session credentials. It uses protected local storage when available; otherwise, your session lasts only for the current app session.
Design files and collaboration
Whisk processes the content you create or upload, including HTML, CSS, text, images, and other file assets. Cloudflare hosts application services, stores and synchronizes editable documents and their saved versions, and stores file metadata, team membership, permissions, invitations, assets, and published snapshots.
This information is used to open and save files, collaborate, recover work, and provide the sharing features you choose. Collaborators may see your name and activity within files they can access.
Your sharing choices
Personal files start private. Team roles and direct invitations determine who can access team and shared files. Team owners and administrators retain access to their team’s files, including restricted files.
You can enable a live viewing link or a published snapshot link. Anyone with an enabled link can view the linked content without signing in. Revoking a link stops subsequent access through it, but cannot remove screenshots or other copies that someone already made. Check a file’s sharing settings before including sensitive information.
Local recovery and AI tools
The desktop app keeps preferences and recovery data on your device. Recovery data can include unsent changes and assets, and is scoped to the account and file. This helps preserve work when a connection fails or access changes.
If you use AI features or connect an agent, requests and relevant file content may be processed by the configured AI provider or agent service. Their handling of that information depends on the provider and your configuration. Review the provider’s terms before sending sensitive content.
Service providers and technical information
Hosting and authentication providers may process technical information such as IP addresses, device or browser information, and request metadata to deliver and protect the service. Provider policies explain their own practices:
The homepage loads fonts from Google Fonts and its screenshot carousel from jsDelivr. These services receive the technical information needed to deliver those resources. If you sign up for product updates using the linked Tally form, the information you submit is used to handle that request.
Access, correction, and deletion
To ask about your information, correct account details, or request account or data deletion, email dev@croc.studio. Please identify the account and files involved. We may need to verify ownership before acting on a request.
Closing an account does not necessarily remove team files or copies held by other people. Recovery data on your own device is separate from hosted data. Tell us what you want removed so we can explain the scope, including any provider backup or operational retention that applies.
Changes and contact
We may update this page as Whisk develops and will change the date above when we do. Questions about privacy can be sent to dev@croc.studio.