Privacy

As of October 2026. This page explains which data Whosgoin stores, what for, and who sees it. It applies to the app and to whosgoin.com. This is a translation; the German Datenschutz page is the binding version.

1. Who is responsible

Tobias Pfülb
Email: [email protected]

2. What the app stores

Account: your mobile number, your email address if you want, and your password (stored only in encrypted form).
Profile: name, username, profile photo and a short bio, if you add them.
Friends: friend requests, friends, your circles of friends and people you block.
Plans: plans and ideas you create (title, time, place, description, who sees it), whether you join or decline, your reactions, votes on times and the bring list.
Chat: messages and reactions in a plan's chat.
Location: only if you share it. By default you only share it while you're out, and only with the people you choose. Older locations are hidden.
Push: a device token so we can send you notifications, if you allow them.
Reports: if you report someone or something, we store the report so we can review it.

We use no ads, no tracking and no analytics tools. We don't sell data. If the app crashes or hits an error, it sends an error report (see Sentry under 5).

3. What for and on what legal basis

We process this data so the app works: so you can create plans, invite friends, join and chat (Art. 6(1)(b) GDPR, contract of use). We use location and push only with your consent, which you can withdraw at any time in the app or in your iPhone settings (Art. 6(1)(a) GDPR). Reporting and blocking serve the safety of all users (Art. 6(1)(f) GDPR).

4. Who sees your data

What you share is only seen by the people you choose for it: your friends, a circle of friends, the people you invite or, for public plans, everyone nearby. Other users see your profile with name, username and photo so they can find you and add you as a friend.

5. Service providers

We use these service providers to run Whosgoin. We have data processing agreements with all of them; transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

Supabase (Supabase Inc., USA): database, sign-in and photo storage. The data is stored on servers in Frankfurt am Main.
Resend (Resend Inc., USA): sending emails, for example the code when you forgot your password.
Twilio (Twilio Inc., USA): sending the text message with the confirmation code when you sign up, change your number or forgot your password. Your mobile number is transmitted for this.
Expo (650 Industries Inc., USA) and Apple: delivering push notifications.
Apple Maps: showing the map in the app on iPhone.
Photon / komoot (komoot GmbH, Germany): searching for places when you enter a place for a plan. Only your search term is transmitted.
Cloudflare (Cloudflare Inc., USA): running this website and the invite and share links.
Sentry (Functional Software Inc., USA): error reports when the app crashes or hits an error. A report contains the error message, app version, device model, iOS version and your anonymous account ID, but no name, phone number, email address, IP address or screenshots. The data is stored on servers in Frankfurt am Main. The legal basis is our interest in an app that works (Art. 6(1)(f) GDPR).

6. Calendar and contacts on your device

If you allow it, the app adds plans you're going to to your iPhone calendar. This happens only on your device. We don't read or upload your calendar.

If you tap “Find friends from your contacts” and allow access, the app turns the phone numbers in your address book into check values (SHA-256 hashes) and sends only these to our server. It compares them with the confirmed numbers of other users and sends you the matches. The check values are not stored, and names and other contact details never leave your device. If you don't want to be found by your number, turn off “Findable by my number” in the settings.

7. How long we keep data

We keep your data as long as you have an account. You can delete your account in the app at any time: You → Settings → Delete account. We then delete your profile, plans, messages, locations and photos. We keep reports only as long as needed to review them.

8. This website

When you visit whosgoin.com, Cloudflare processes technically necessary data such as IP address, time and the page requested, to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). We set no cookies and use no tracking. If you pick a language, your browser remembers it locally; this is never sent to us.

When you open a shared plan link, the page shows that plan's title, time and place so messengers can show a preview.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Just write to [email protected]. You can also complain to a data protection supervisory authority.

10. Age

Whosgoin is meant for people aged 16 and over.