Where — Privacy Policy

Effective date: 28 October 2026 · Version 1.0

The operator of Where, based in Zagreb, Croatia, is responsible for your personal data when you use Where. Write to us about anything on this page at privacy-where@googlegroups.com. This policy forms part of our Terms of Service.

In short

Where shows you real-world events near you, each with a group chat. To do that it needs to know where an event is, who is going, and how to reach your phone with a notification.

• We do not sell your data, show you advertising, or track you across other apps.
• There is no analytics in the app at all.
• Report text is reviewed by software that runs on our own servers — it is not sent to any AI company.
• You can delete your account in the app, and most of your data goes with it. A few things do not, and we say exactly which below rather than leave you to find out.

What we collect, why, and on what legal basis

We only collect what a feature actually needs. "Contract" below means we cannot provide the thing you asked for without it; "consent" means you chose to switch it on and can switch it off.

We do not collect an advertising identifier, and the app contains no analytics SDK.

What the app asks your phone for

Besides your position, the app asks to send you notifications, and it asks for your camera and microphone when you take a photo or video for a chat, your photo library when you attach one, and permission to save a photo or video you received back to your library. Each of the last four is asked for at the moment you use the feature, and each reaches only what you choose in that moment — we see the items you pick, not your library. The app asks for nothing else: no contacts, no calendar, no health or fitness data, and no tracking permission.

What is stored on your device

Some things stay on your phone rather than on our servers: your notifications, so the app works offline; your last known position, as the fallback above; your diagnostics choice; and an identifier the app generates for itself to register for push. Signing out or deleting your account clears your diagnostics choice and closes the notification store, and the notification history is cleared when an account next signs up on the device. The saved position and the app's own installation identifier stay until you delete the app. None of them is a hardware identifier or an advertising one.

Location, specifically

This is the most sensitive thing we hold, so: we store the location of an event, not a trail of where you go. The app asks for your position only while you are using it, to centre the map — it never collects location in the background, and it cannot, because the app does not request that permission.

Photos and videos you share have their embedded location removed before they are uploaded, so a chat attachment does not carry the place it was taken.

Deleting a message makes its text unreadable in the conversation and in our records. Two copies can outlast it: a nightly backup taken before you deleted it, until that backup is pruned; and any text you or someone else quoted into an abuse report, which is kept for the moderation period below. Deleting a message also deletes the file attached to it, and every attachment is deleted four weeks after it was sent in any case — see How long we keep things.

If you create an event you can set an anonymisation radius. For anyone who is not the creator or an accepted participant, our servers send only the blurred location — the exact point is not transmitted to them at all, rather than being hidden in the app. The one exception is the moderation software described below, which reads a reported event uncut.

Who else processes your data

Most of these act for us, under contract, and only for the purpose listed. Two do not, and the distinction matters legally: Google Maps Platform operates on controller-to-controller terms, and Google and Apple are each their own controller for the sign-in you choose — what they do with your account there is governed by their privacy policies, not ours.

Push notifications travel through Firebase, and on an iPhone onward through Apple's notification service, which means their contents — including message text and event details — pass through Google's and, on iOS, Apple's infrastructure to reach your device. That is how push works on both platforms; there is no way to deliver a notification without it.

Google, Apple and Amazon Web Services are headquartered in the United States, so some of the data above may be transferred outside the European Economic Area, or reached from there. Where the recipient is certified under the EU–US Data Privacy Framework, that is what the transfer rests on; otherwise it rests on the standard contractual clauses the European Commission has approved, which form part of our agreement with them. Your files and our database backups are in Frankfurt, Germany; the database itself runs on our own servers in Croatia.

Automated decisions about your account, and your right to a human

Read this section if you are ever banned. We are telling you more than most apps do here, because the law requires it and because it is true.

Reports about users and events are triaged by software, not a person. A language model running on our own infrastructure decides whether a report is founded, and to do that it reads a good deal more than the report itself. It can read:

• the direct messages between the two people involved;
• the reported person's own messages in every group and event chat they are in, or have left — not only the ones they share with the reporter;
• both people's profiles, and the events they have taken part in;
• the reported event's name, description, tags and exact location, including the precise point behind an anonymisation radius;
• who has blocked whom, in both directions, which includes other people's identifiers;
• previous reports both people have been involved in — the reporter's history, to weigh how reliable they are, and reports filed against the reported person before.

A decision it is not sufficiently confident about is marked inconclusive and not acted on. A founded report can result in content being removed, a temporary suspension, or a permanent ban.

Appeals are currently also decided automatically. You can appeal a serious outcome once, in the app, within 14 days, and that appeal is assessed by the same kind of software.

Under the GDPR you have the right not to be subject to a decision based solely on automated processing where it significantly affects you, unless one of the law's exceptions applies. We rely on the exception for a decision that is necessary to perform our agreement with you (Article 22(2)(a)): keeping the app safe enough to use is part of providing it, and a report cannot wait for someone to be awake. In every case you keep the right to obtain human intervention, to express your point of view, and to contest the decision. Every decision is recorded with a written reason, which a person reviewing your case reads and which you can ask us for — see Your rights. The reason is kept for the moderation period in How long we keep things; after it, only the outcome remains.

When your account is restricted the app tells you that it was, the category of the report it rests on, and how to appeal.

You can ask a person to review it. Write to privacy-where@googlegroups.com, say what happened, and a member of our team will look at your case themselves and can overturn the decision. The in-app appeal does not count as this, because it is automated too.

How long we keep things, and what deleting your account really does

You can delete your account at any time from Settings in the app, and you do not need the app to ask: write to privacy-where@googlegroups.com and we will do it for you. When your account is deleted:

• your profile is anonymised — you appear as "Unknown user" wherever you still appear;
• the key that encrypts your account data in our event history is destroyed, which makes that part permanently unreadable rather than merely hidden from view. It does not cover the content of events you created, which is not encrypted, nor the chat messages you sent, which stay by design — see the retained categories below;
• your sign-in mapping is released, so signing up again creates a genuinely new account rather than restoring the old one;
• your nearby-event alert settings are removed;
• your profile pictures are deleted from file storage.

Deleting the key is immediate, but copies of data made before it do not all vanish at once. In practice:

We would rather give you the real numbers than say "immediately" and be wrong.

A few things deliberately remain, and we would rather tell you than let you assume otherwise:

1. Messages you sent, and files attached to them, stay in those conversations, with you shown as an anonymised sender. Other people are still part of those chats, and removing your half would rewrite their record of a conversation they took part in.
2. Events you created stay, with their content. Events that have not yet happened are cancelled; ones already past remain, and their name, description, place and participant-only note are kept as written, because event content is not encrypted the way your account data is. We keep past events indefinitely, because an event is not only yours: it is the record of something several people attended, and the others are entitled to their own history of it, the way you are entitled to yours. If a specific past event of yours contains something you want removed, write to us.
3. A phone record at Firebase, which sends the verification SMS, may linger briefly before our server deletes it. The app deletes that record itself the moment your number is verified, and our server deletes it again within about an hour of you deleting your account, withdrawing the number or replacing it, in case the first attempt failed. To do that, our server has to hold the number itself for a few minutes — up to about an hour — in a row whose only purpose is telling the deletion job which number to release; the row goes once the job has run. The same happens when you withdraw or replace a verified number.
4. Crash diagnostics already sent, if you had switched them on. They are not linked to your account, so we cannot pick yours out to delete them; they clear on the 90-day cycle described below. Anything still waiting on your device is deleted when you sign out or delete the account.
5. The blocks you placed, as a record carrying your identifier and nothing readable about you. This is deliberate and it is not about you: if you blocked someone because of how they behaved, that is evidence about them, and our moderation reads how many people have blocked a user when weighing a report against them. Deleting your blocks when you leave would quietly clear that.

Crash diagnostics are kept for 90 days by Firebase Crashlytics, which is its retention period and not one we can configure. Collection happens only if you turned it on. Switching it off in Settings → Diagnostics stops any further collection at once and deletes the reports still waiting on your device. Reports already uploaded are removed starting 90 days after they were collected, and we cannot pull an individual person's out before then: a crash report carries no account identifier, only a random identifier for the installation, which neither you nor we can look up. That is the consequence of keeping crash data unlinked from your account, and it is the one erasure request we cannot action by identifying your data — see Your rights.

Reports, appeals and moderation records are kept for five years after the decision is final, and for as long as an appeal is still possible before that. The text in them — the reason given, an appeal, and the written reasoning behind the decision — is encrypted under a key of its own and erased at the end of that period; the outcome (what was decided, when, by whom) is kept. They outlive the account by design, because a moderation decision has to stay auditable after the account it concerned is gone.

Files attached to chat messages — photos and videos — are kept for four weeks from the day they were sent, then deleted from our storage, even while the message itself stays; after that the attachment is no longer available in the conversation. A file is deleted sooner if you delete the message it was attached to.

Your rights

You can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or receive it in a portable form. The one exception is uploaded crash diagnostics, which are not linked to your account and so cannot be identified as yours; they are deleted on Firebase's own 90-day cycle instead (see How long we keep things). Where we rely on consent you can withdraw it at any time — switching off nearby-event alerts is an example, and withdrawal does not affect what we did while consent was in place.

Three of these you can exercise yourself, without writing to us: nearby-event alerts and crash reports are switches in Settings, and you can remove your phone verification from your profile. All three rest on consent, so turning one off withdraws it and takes effect immediately.

Deleting your account in the app already satisfies erasure for everything except the categories above.

To exercise any of these, write to privacy-where@googlegroups.com. We reply within one month, as the GDPR requires. If you are unhappy with the outcome you can complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr), or to the authority where you live.

Children

Where is for adults. You must be at least 18 to use it.

We ask for your date of birth when you sign up, and our servers refuse one that makes you younger than 18 — the check is on the server, not only in the app, so an altered or outdated app cannot get past it. If we learn that an account belongs to someone under 18 we delete it. If you believe a child is using Where, write to privacy-where@googlegroups.com and we will act on it.

Security

Traffic between the app and our servers is encrypted in transit, with a publicly trusted certificate. Your account data in our records is encrypted under a key of your own, so destroying it makes that data unreadable. Each chat message's text is encrypted under a key of its own, which is destroyed when the message is deleted — a deleted message is unreadable rather than merely hidden. Access to production systems is restricted to the people who operate the service. Two things sit outside that per-message protection: a backup taken before a deletion keeps what it held until it is pruned, and message text quoted into an abuse report is held with that report rather than with the message.

Changes to this policy

If we change this policy in a way that matters to you, we will tell you in the app before the new version takes effect, and the new effective date will be shown at the top of this page. The previous version stays available at https://where-app.io/legal/archive. Continuing to use Where after the effective date means you accept the current version.