WhereAtt Privacy Policy

Who we are

WhereAtt is a location-sharing app for friends and families. It is operated by Milan Štěpánek, an individual based in Brno, Czech Republic ("we", "us"), who is the controller of your personal data.

Questions, requests and complaints about privacy: stepoun83@gmail.com

What data we process

Phone number. You sign in with your phone number and a one-time SMS code. The number is stored by our authentication service. We also store a one-way hash (SHA-256) of it, so that friends who have your number in their contacts can find you in WhereAtt.

Contacts. Only if you allow access. Phone numbers from your contacts are turned into one-way hashes on your phone; only these hashes are sent to our server to find out which of your contacts already use WhereAtt. We do not store them, and contact names never leave your phone.

Location. Your precise location, also in the background while location sharing is on. We keep only your latest position (each update overwrites the previous one) - we do not keep a location history. It is used to show you on your groups' map, to detect when you arrive at an event and to tell your group when members are nearby. You can turn sharing off in your profile at any time; while it is on, Android shows a permanent notification.

Profile. Your display name and avatar color. With WhereAtt Pro you can also add a profile photo; it is resized on your phone before upload.

Groups and events. Group names and memberships; invitations to groups (who invited whom and when) until they are accepted, declined or cancelled; events you create (title, place, time) and who has arrived.

Event chat and photos. Messages and photos you add to an event. Photos are resized on your phone before upload. Events are deleted automatically, together with their chat and photos, a few minutes after they end.

Notifications. A technical identifier of your device (notification token) used to deliver push notifications, and a history of the notifications WhereAtt sent you (for example new events, arrivals, chat messages, invitations) shown under the bell in the app.

Purchases. If you buy WhereAtt Pro or subscribe to it, Google Play handles the payment. We receive the order ID, a purchase token, the product, its status (bought, pending, renewed, cancelled, expired, refunded) and, for subscriptions, when the current period ends and whether it renews. We never see your card or other payment details.

Usage statistics. Unless you turn it off in Profile > Share usage statistics, the app sends Google Analytics for Firebase information about how it is used: which screens you open and which features you use (for example that an event or a group was created, which event icon was chosen, whether you have Pro), together with a random app-instance identifier, your WhereAtt user ID, device model, operating system and app version, language and approximate country. It never includes your location, contacts, names, phone number, photos or messages. We do not collect your advertising ID and do not use this data for advertising.

Technical logs. Our service providers keep short-lived server logs (such as IP address, time and type of request) for security and troubleshooting.

Why we process it (legal bases)

• To provide the service you signed up for - account, groups, location sharing, events, chat, photos and Pro features (performance of a contract, Art. 6(1)(b) GDPR).
• Access to location, contacts, photos/camera and notifications is only used after you grant the permission on your phone; you can withdraw it at any time in the system settings (consent, Art. 6(1)(a) GDPR).
• Security, preventing abuse and fixing errors (legitimate interest, Art. 6(1)(f) GDPR).
• Usage statistics, to understand which features are used and to improve the app (legitimate interest, Art. 6(1)(f) GDPR). You can object at any time by turning off Profile > Share usage statistics.
• Keeping purchase records required by tax and accounting law (legal obligation, Art. 6(1)(c) GDPR).

Who can see your data

Members of the groups you belong to can see your display name, avatar color or profile photo, current location and when it was last updated, events in the group, and the messages and photos you share there. Nobody else can see them.

When a group owner invites you, the owner can see your display name and avatar color in the list of pending invitations, and you can see the group's name, the owner's display name and the number of members before you decide. You join only if you accept.

We do not sell your data, we do not show ads and the app contains no advertising trackers. Usage statistics (see above) are used only by us to improve WhereAtt.

Service providers

We use these providers to run WhereAtt. They process data only on our behalf and under data processing terms:

• Supabase - database, sign-in, file storage and server functions. Data is stored in the EU (Frankfurt, Germany).
• SMS delivery provider used by our sign-in service - receives your phone number to send the verification code.
• Expo (USA) - relays push notifications to your device.
• Google Firebase Cloud Messaging (Google) - delivers push notifications on Android.
• Google Play (Google) - app distribution and payments for WhereAtt Pro.
• Google Analytics for Firebase (Google) - usage statistics, only while "Share usage statistics" is on.
• Geoapify (EU) - address search when you create or edit an event. Geoapify receives the text you type, your IP address and the approximate map position used to rank nearby results.
• Mapbox (USA) - map tiles. Mapbox receives your IP address and the map area being displayed; we have turned off Mapbox usage telemetry in the app.

Where a provider processes data outside the EU/EEA, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

How long we keep data

• Location: only your latest position. When you turn sharing off, your group keeps seeing your last known position with its time until you share again or delete your account.
• Events, their chat and photos: deleted automatically a few minutes after the event ends.
• Notification history: 30 days, then deleted automatically; you can clear it earlier in the app. Group invitations: until they are accepted, declined or cancelled, or the group is deleted.
• Account, profile (including a profile photo), groups and notification tokens: until you delete your account. A profile photo is deleted as soon as you remove or replace it.
• Purchase records: kept as long as tax and accounting law requires (in the Czech Republic up to 10 years); after you delete your account they are no longer linked to you.
• Usage statistics: event-level data is kept for 14 months in Google Analytics, then deleted automatically.
• Server logs: short-term, as set by our providers (typically days to weeks).
• If WhereAtt is discontinued (see the Terms of Use), all accounts and their data are deleted within 30 days after the service ends; purchase records are kept as described above.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw any consent you have given. Write to stepoun83@gmail.com and we will respond within one month.

You can also lodge a complaint with a data protection authority - in the Czech Republic the Office for Personal Data Protection (www.uoou.gov.cz), or the authority in the EU country where you live.

Deleting your account

In the app: Profile > Delete account. This immediately and permanently deletes your account, profile (including your profile photo), location, notification tokens, group memberships, the groups you own (with their events, chats and photos), the events you created and all messages and photos you added.

Without the app: send a request from any email to stepoun83@gmail.com with the phone number you registered with. We may ask you to confirm that the number is yours, and we will delete the account within 30 days.

A WhereAtt Pro purchase belongs to your Google account; if you create a new WhereAtt account later, you can restore it with "Restore purchase". Deleting the account turns off the renewal of a monthly Pro subscription; the month already paid can still be restored on a new account until it ends.

Children

WhereAtt is not directed at children under 13. Users under 15 (or the age of digital consent in their country) may use WhereAtt only with the consent and involvement of a parent or guardian, for example in a family group.

Security

All communication between the app and our servers is encrypted (HTTPS). Access to data is limited by database rules so that only you and members of your groups can read what is meant for them.

Changes to this policy

We will update this policy when the app or our providers change. The date below shows the latest version; significant changes will be announced in the app.

Last updated: 2026-09-29