Suggestions

Suggestion #1 - Improve the mixing process

For those wondering how Whirlwind works, it's quite simple. An example of flow of the process is as follows:
1. Your input is received by Whirlwind.
2. Your input is moved to the Whirlwind hot wallet.
3. You receive your output from the Whirlwind hot wallet minus your chosen fee and after your chosen time delay.

If you are using the "Fast" option with one input and the same output, no matter what fee you use you can be sure that anyone that is trying to track your blockchain transactions will be able to match the output with the input and the use of the service would be quite worthless. If you must use "Fast", you must break up the inputs into multiple outputs and use the time delay. If you really want to achieve privacy, I believe that the best way to go is to create multiple notes, combine them and create multiple outputs of different value at different times.

No matter which method you choose however, it is very easy to distinguish that your input was sent to Whirlwind and that the output has come from the Whirlwind hot wallet. This should be noted if you do not want future receivers to know that you are using/have used Whirlwind. The pitfalls of this come forward if Whirlwind is ever black-listed or tagged by chainanalysis or another related company, or if Whirlwind is ever sanctioned (like TornadoCash). If this happens, all coins would be tainted. Whether you believe in tainted coins or not, any service that you use that does believe in tainted coins would probably ask you questions due to the usage of Whirlwind.

It should be noted as well that it is possible to receive outputs including inputs from your deposit. Use a longer time delay if you want to avoid this. It should become less common as the service increases in usage.

I believe that the service should be improved with a more sophisticated mixing process. I suppose that in its infancy, it is fine for the time being. Though I can't see it being viable for too long if there are interests who do not want Whirlwind to be a solution for privacy in the future. These forces evidently exist after recent events in the last month.

I suppose that one positive about the mixing process is that one can easily verify the reserves on hand. I was able to confirm that whirlwind controls at least 4.98 BTC at the time of writing (not including cold storage, if any)

I went through his report and altough I'm sure we already fixed the issues outlined by him, I will still try to get him to do a paid review for your confirmation.

Coinmixer.se (the service used as example in the report) works like most mixers on the market today, and they all have the same big issues in common:
1.Maximum delay time is limited
2.Maximum amount of output addresses is limited
3.No option to have higher outputs than inputs
4.Use of mixing codes

These issues make it possible for anyone to perform blockchain analysis with relative ease. The privacy set (number of deposits your output transaction could have originated from) which is the most important figure in my opinion, is reduced to only the transactions that were performed during the time limits imposed by the "maximum delay". And since you also know the maximum number of output transactions each deposit has, it's not that difficult to deanonymize it.

We solve all these issues by introducing the Note mechanism. Let's see how the above issues apply to Whirlwind:
1.Maximum delay time is unlimited
2.Maximum amount of output addresses is unlimited
3.Outputs can be higher than inputs (combine Notes)
4.We don't use mixing codes

Since the user has the option to deposit and withdraw whenever he likes and we don't impose a limit, blockchain analysis becomes useless. In the case of coinmixer.se it's written in the report that they had about ~1000 deposit transactions a week. If we assume we'll have the same, then the privacy set of Whirlwind will grow by 1000 every week.

After 10 weeks every output transaction could originate from any of the 10,000 deposits into Whirlwind, and this figure will only grow as time goes on. With other mixers it doesen't matter how many deposits they have in total, the privacy set doesen't increase.

The use of mixing codes by a service confirms that the privacy set is very weak and introduces other risks since it can link your transactions. If a mixer does what it's supposed to do, it shouldn't matter if you get 'your own coins' back because anyone that ever used the service could have withdrawn those coins.