Cookie Policy

Strictly necessary: the session cookie

whoin_session keeps you signed in and lets us run account actions. It lasts at most 30 days in your browser and is set with the HttpOnly and SameSite=Lax flags, plus Secure on HTTPS. Signing out clears it on that device and closes the session. The session on our server can end earlier. It is strictly necessary for the signed-in service you asked for, so it is set without a consent prompt.

Browser storage that is not a cookie

• whoin-region (session storage): keeps your selected city and district while you move between pages. It is not location tracking or GPS. The browser clears it when the tab session ends.
• whoin-return (session storage): remembers the page you were on so we can send you back after you sign in or link an account. It is cleared with the tab session.
• whoin_liked_profiles_v1 (local storage): keeps up to 200 liked profile cards so the heart state looks right in your browser. Entries can include profile links and card details.
• whoin-quirks-draft-v1 (local storage): holds the “Not Just Me” options you picked before signing in, with a draft timestamp. A draft older than 24 hours is ignored and removed the next time the page opens, and it is removed after you save successfully. Nothing is deleted while your browser is closed.
• whoin-voice-owner (local storage): a random window identifier that decides which open window speaks the arrival announcements when you use the voice feature.
• whoin-cookie-preferences-v1 (local storage): your advertising choice, the policy version and the save time, kept for 180 days. It only applies where Google’s European consent screen does not (see below).

Likes and voice records have no automatic expiry in the app. They stay until the app updates them or you clear this site’s data in your browser. On a shared device, consider clearing site data. Clearing local likes does not delete the likes or the account stored on our servers.

Security and outside services

We use Cloudflare Turnstile to reduce automated abuse. During a security check, Cloudflare may process browser and connection information, and it may set its own cookies or storage. When you link an official X, Instagram, TikTok or Google account, you are sent to that company, and its own privacy and cookie policies apply there. Names and lifetimes of third-party cookies depend on the service and your browser.

Cloudflare privacy policy ↗

Advertising and Google’s consent tool

We use Google’s certified consent tool (Privacy & Messaging, a CMP) on eligible pages. Google decides where the visit is coming from. For visitors in the European Economic Area, the United Kingdom and Switzerland, it can show a consent message with options to consent, decline or manage choices. Your choice is stored by Google’s TCF-compatible mechanism.

When the consent tool loads, your IP address, browser and device details and technical information about our site can be sent to Google. Google AdSense is set up for magazine and topic pages. Whether an ad actually appears depends on Google’s approval of the site, ad availability and your choice. No advertising code runs unless you have allowed it. We do not run ads on city and district pages, sign-in and profile pages, contest pages or legal pages.

The privacy, cookie, terms, policies and delete-data pages, plus sign-in and profile pages, do not load the consent tool at all. If you open your cookie preferences from one of them, the flow continues on the home page.

How Google uses data from partner sites ↗ · Google My Ad Center ↗

Changing your choice

The Cookie preferences button at the top of this page tries to reopen Google’s consent screen. If the European consent scope does not apply to this visit, you will see a local accept or reject choice for advertising cookies instead. Declining does not block access to the site. If the consent screen cannot load, ads stay off and you can keep using Who In.

A local choice only covers visits where Google’s European consent does not apply, and it never replaces Google’s consent where that applies. Choices saved under an older policy version are not valid, so you will be asked again. Withdrawing consent is as easy as giving it: use the same button.

Your browser controls

You can block cookies in your browser settings or delete cookies and site data for Who In at any time. Blocking the session cookie will stop sign-in and account features from working.

For how we handle personal data, see the privacy notice. To delete your account, see Delete my data. You can also write to hello@whoin.app.