Version 2026-09 · applies from 6 September 2026
The data controller is Victor Borisov, a private individual in Bulgaria, running Who’s Where as a non-commercial project. Contact: support@whoswhere.net.
| Data | Why | How long |
|---|---|---|
| Google or Apple account id, email, name; profile photo from Google if you keep it | To sign you in and create your profile (contract) | Until you delete your account |
| Profile you fill in: name, photo, study year, majors, graduation year, a line about you, interests; optionally age, city, hometown, dorm | To show who you are to other users (contract). Everything except dorm is visible to all signed-in users; dorm only to friends | Until you delete your account or the field |
| Events you post: title, description, cover photo, time, a point on the map, categories | The purpose of the app (contract) | Until the event is deleted; ended events stay in participants’ history |
| Your participation, invitations, follows, blocks, attendance marks and no-shows | To run events and show reputation (contract) | Until you delete your account |
| Messages and photos in event chats | To let participants talk (contract) | Kept with the event; you can delete your own messages |
| Push notification token of your device | To deliver notifications (contract) | Removed after 90 days without use or when you sign out |
| Reports you make and moderation actions concerning you | Safety of the community (legitimate interest; store rules) | Reports 30 days after closing; moderation log kept |
| Usage events: which screens are opened, what actions are taken — no content, no location | To see whether the app works (legitimate interest). Switch off in Settings → “Share usage statistics” | 12 months |
Your location is used only on your phone, only when you tap “My location” on the map, and is never sent to our servers. Events have a location because their hosts put a pin on the map.
Photos are compressed on your phone before upload; embedded metadata such as GPS coordinates is removed.
We do not sell data, do not show ads, and do not use advertising or tracking SDKs.
Under the GDPR you can access, correct, delete and export your data, and object to processing based on legitimate interest. Most of this you can do yourself: edit your profile, delete messages, switch off usage statistics, and delete your account in the app (Me → Settings) or on the deletion page. For a copy of your data or anything else, email support@whoswhere.net. You may also complain to the Bulgarian Commission for Personal Data Protection.
Your profile, photo, interests, follows, device tokens and pending requests are deleted. Events and messages that other people took part in are kept but anonymised (“Deleted user”), because they are also those people’s history. Accounts unused for 36 months are anonymised automatically.
The app is for people aged 16 and over. We don’t verify age; if you are younger, please don’t sign up.
If this policy changes in a way that matters, the app will ask you to accept the new version.