Privacy Notice

1. Who is responsible

The controller of your personal data is Oğuzhan Erol, an individual (placeholder for the operator of Who In until a company is set up). Contact for anything in this notice: hello@whoin.app.

2. What we collect and why

Account and sign-in. Your email address, used only for one-time sign-in links, account and security messages and, if you leave it on, a single notice when the site opens. Your email address is never shown on your card or on public pages. A sign-in link works once and expires after 30 minutes. When you sign in we set a session cookie (see the Cookie Policy). Legal basis: performing the account you asked for.

Linked official accounts. When you link Google, Instagram, X or TikTok you are sent to that company’s own authorization screen. We never ask for or store your social media password. From the provider we receive a unique account identifier and your current username (from Google, also your name and email address). The access token used for that read is not kept. Linking shows that you control the account at that moment; it does not confirm your identity, age or anything you say about yourself. You can remove a link at any time on your profile page. Legal basis: performing the account you asked for, and your consent to the link.

Profile card (only if you create one). A card name in the form “First name” or “First name + initial”, your linked social profile link, the city and optional district you declare, your age or age range (18 or over), your gender (woman, man or prefer not to say), ready-made activity and availability tags and, optionally, “Not Just Me” picks. There is no free-text bio, phone number, address or GPS location. Nothing here is checked by us; it is what you declare. Once you choose to go visible, this information can be seen by other visitors for the period you pick (30 days or 365 days). Legal basis: your consent, which you give by choosing to go visible and can withdraw at any time by going invisible.

Likes and last visit day. If you like a profile, that like is stored with your account. We also store the day (UTC, no time of day) you last visited. If your card is visible, you may be listed on the “Tonight” page for that day; members without a visible card are never listed. Legal basis: performing the service, and our legitimate interest in showing who is around.

Quizzes and contests. If you play a “Who Knows?” quiz we store, tied to your account, the contest, your answers, score, timing and your attempt counts. The leaderboard shows your name as “First name + initial” only if you allowed that when you started; otherwise it shows “Who In member”. Weekly discovery quiz attempts (such as the where-is-this quiz) are not shown on any leaderboard. Legal basis: performing the service, and your consent for the leaderboard name.

Feedback. If you send feedback or a suggestion, we receive the type you chose, your message, any optional contact details and any screenshot you attach, by email. Please hide personal or sensitive details in screenshots. A short technical record (a message ID and a fingerprint) is kept for 24 hours to stop duplicate sends. Legal basis: our legitimate interest in handling your request.

Security and technical data. Cloudflare processes your IP address and browser details to serve the site and run its security checks, including the Turnstile bot check. To limit abuse we also compute a one-way hash of your IP address and use it for per-minute request limits; it is kept only for that minute. Legal basis: our legitimate interest in keeping the service secure.

Account activity log. For support and abuse prevention we keep a log of when you signed in, linked or removed a social account, changed your profile, visibility, notices or likes, sent feedback or started a contest. It records only the type of action, the provider name and the time, for 90 days, and is visible only to the administrator. It never contains passwords, sign-in links, OAuth codes, tokens, IP addresses, email addresses or social media content. Legal basis: our legitimate interest in security and support.

Advertising. Where ads are allowed and you consent, Google may process your IP address, browser and device details and cookies. See the Cookie Policy. Your account email address is not shared for advertising. Legal basis: your consent.

3. Who receives your data

Other visitors see only what you choose to make visible on your card. We do not sell personal data.

Service providers (processors) act on our instructions: Cloudflare, Inc. hosts and runs the service (Workers, Durable Objects storage and email sending) and provides the Turnstile security check.

Google provides the consent tool and advertising (AdSense) and, if you use it, Google sign-in. Google acts as an independent controller for its own advertising and consent processing.

X, Instagram and TikTok are independent controllers of their own services. When you link an account, their privacy policies apply to what happens on their side.

We may disclose data if the law requires it or to protect the safety of members.

4. International transfers

Our providers operate globally, so your data may be processed in countries other than yours, including the United States. Where the EU or UK GDPR applies, we rely on the transfer mechanisms these providers offer, such as standard contractual clauses or the EU–US Data Privacy Framework where they take part. We do not control those arrangements and cannot promise a particular storage location. You can ask us for more information at hello@whoin.app.

5. How long we keep it

Card visibility ends automatically after the period you chose (30 or 365 days) and does not renew itself. Sign-in links expire after 30 minutes. The session cookie lasts at most 30 days. The account activity log is kept for 90 days. The last-visit day is overwritten on each visit and past days are not kept. Weekly discovery quiz attempts are removed eight weeks after they start. Feedback emails are kept for as long as needed to deal with your request. Other account data, including your email, linked accounts, card, likes and contest records, is kept until you delete your account.

When you delete your account, this data is removed from the live system and all your sessions are ended. We keep limited, access-controlled operational backups; deleted records are not restored into the live system from them.

6. Your rights

Depending on where you live, you have the right to: be told whether we process your data and get a copy (access); correct inaccurate data (rectification); have your data deleted (erasure); restrict how we use it; receive the data you gave us in a portable format; object to processing based on legitimate interests; and withdraw consent at any time, without affecting what happened before. You can delete your account yourself on the Delete my data page, remove a linked account or go invisible on your profile page, and change cookie choices in Cookie preferences. For anything else write to hello@whoin.app. We may need to check that the request really comes from the account owner. We aim to reply within one month.

We do not use your data for decisions made solely by automated means that have legal or similarly significant effects on you.

7. Complaints

Please contact us first so we can try to fix the problem. You also have the right to complain to the data protection authority in the country where you live or work or where you think a violation took place. In the UK that is the Information Commissioner’s Office.

8. Adults only

Who In is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us at hello@whoin.app and we will remove it.

9. Security

Traffic is encrypted with HTTPS. Sign-in links and session tokens are stored only as one-way hashes. Sign-in and sensitive actions have request limits and a bot check. Access to administration tools is limited to the operator. No online service is perfectly secure; if a breach affects your rights we will tell you and the authorities as the law requires.

10. Changes to this notice

We may update this notice as the service changes. The date at the top of the Policies pages shows when they were last reviewed. For significant changes we will give notice on the site or by email before they take effect.