WhenUp
1. Introduction
WhenUp ("WhenUp", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use the WhenUp mobile application and related services (the "Service"), how we use that information, with whom we share it, and the choices you have.
This policy applies to all users of the Service. By creating an account or otherwise using the Service you acknowledge that you have read and understood this Privacy Policy. The current version is always available within the app under Profile → Privacy Policy and at whenupapp.com/privacy.
2. Information We Collect
We collect information you provide directly and information generated automatically by your use of the Service.
Account and Profile Information
When you create an account you provide your email address, a username, and a display name. You may optionally add a profile photo and a short bio. We also record your device timezone, which is used to display availability and plan times correctly.
Availability Data
You may share your personal availability by selecting hours on specific dates. These availability slots are stored and, depending on your privacy settings, may be visible to your friends or to everyone. You control this setting at any time from your profile.
Plans, Events, and Social Interactions
When you create or join a plan we store the plan details (title, description, dates, location, status), your membership and RSVP, any date or activity options you propose, and your votes on options proposed by others. Messages sent in a plan chat are stored and visible to all plan members.
Friend requests you send or receive, accepted friendships, and any users you block are stored to power the social features of the Service.
Profile Photos
If you choose to add a profile photo, the image you select is uploaded to secure cloud storage and associated with your account. We access your device photo library only when you initiate the photo-selection action; we do not scan or index your photos.
Push Notification Tokens
When you enable push notifications, we store a device-specific token (generated by Expo's push notification service) to deliver plan invitations, RSVP updates, friend requests, and event reminders. This token does not identify you personally but is linked to your account. You can revoke it at any time by disabling notifications in your device settings or in the app.
Usage and Analytics Data
We collect anonymized event data to understand how the Service is used and to improve it. This includes events such as creating a plan, accepting a friend request, or casting a vote. We link these events to a pseudonymous user identifier and your username for analytical purposes.
Payment and Subscription Information
If you subscribe to WhenUp Pro, payment processing is handled entirely by Apple App Store or Google Play. We never receive or store your payment card details. We receive confirmation of your subscription status and entitlements via a third-party subscription management service (RevenueCat).
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Service.
- Create and manage your account and authenticate your identity.
- Display your availability to friends or other users according to your privacy settings.
- Enable you to create plans, invite participants, vote on options, and coordinate meeting times.
- Send push notifications for plan invitations, RSVPs, friend requests, and reminders.
- Process and manage your subscription status and grant access to premium features.
- Analyze usage patterns to understand which features are valuable and identify areas for improvement.
- Respond to your support requests and communicate with you about your account.
- Detect, investigate, and prevent fraudulent or abusive activity.
- Comply with our legal obligations.
4. Third-Party Services
The Service relies on the following third-party providers. Each operates under its own privacy policy and security standards.
Supabase
All user data — accounts, availability, plans, friendships, messages, photos, and push tokens — is stored in a Supabase database hosted in the European Union (West EU / Ireland region). Supabase provides authentication, real-time data synchronization, and file storage. Data is encrypted in transit (TLS) and at rest. Supabase privacy policy: supabase.com/privacy.
PostHog
We use PostHog for product analytics. PostHog receives pseudonymous event data (e.g., "user created a plan") linked to a user ID and username. No sensitive personal data such as availability slots, plan details, or messages is sent to PostHog. PostHog privacy policy: posthog.com/privacy.
RevenueCat
RevenueCat manages in-app subscription entitlements on our behalf. It receives your app store receipt and subscription state; it does not receive your payment card details. RevenueCat privacy policy: revenuecat.com/privacy.
Expo / Push Notification Infrastructure
Push notifications are routed through Expo's push notification service, which in turn delivers them via Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) depending on your device. These services may process your device token as part of delivery. Expo privacy policy: expo.dev/privacy.
5. How We Share Your Information
We do not sell your personal information. We share information only in the following circumstances:
- With other WhenUp users: your display name, username, and profile photo are visible to users you connect with. Your availability is visible according to your privacy settings. Plan details are visible to plan members.
- With service providers: Supabase, PostHog, RevenueCat, and Expo receive data only to the extent necessary to deliver the Service, as described in Section 4.
- For legal compliance: we may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of WhenUp, our users, or the public.
- In a business transfer: if WhenUp is acquired, merged, or transfers its assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.
6. Push Notifications
With your permission, we send push notifications for events including plan invitations, friend requests, RSVP changes, vote nudges, and event reminders. You may withdraw permission at any time through your device's notification settings or by toggling notifications off in the WhenUp app (Profile → Notifications). Disabling notifications will not affect your access to the Service, but you may miss time-sensitive plan updates.
7. Your Availability Privacy Controls
You have direct control over who can see your availability:
- Friends only (default): only accepted friends can see your available hours.
- Everyone: any authenticated WhenUp user can see your available hours.
- Private: only you can see your availability. You may also generate a time-limited share link to grant access to a specific person without them needing a WhenUp account.
You can change this setting at any time from your profile. Changing to Private immediately revokes access for friends and public viewers.
8. Data Retention
We retain your personal data for as long as your account is active and for a reasonable period afterward to comply with legal obligations or resolve disputes.
If you delete your account (Profile → Account → Delete account), we permanently delete your profile, availability data, plan memberships, and friend relationships from our active systems. Messages you sent in plan chats are soft-deleted but may persist in a redacted form. Anonymized or aggregated usage statistics that cannot reasonably identify you may be retained indefinitely for product improvement purposes.
Push notification tokens are removed from our systems when you sign out or delete your account, or when you disable notifications.
9. Data Security
We implement technical and organizational measures to protect your information, including TLS encryption for all data in transit, encryption at rest in our database, row-level security policies that restrict database access to the data owner's session, and access controls that prevent one user from reading another user's private data.
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at whenupapp@gmail.com and change your password.
10. Your Privacy Rights
Depending on your location, you may have the following rights with respect to your personal data:
- Access: request a copy of the personal data we hold about you.
- Correction: request that we correct inaccurate or incomplete data.
- Deletion: request that we delete your personal data. You can also delete your account directly from within the app.
- Restriction: request that we limit the processing of your data in certain circumstances.
- Portability: request a machine-readable copy of your data where technically feasible.
- Objection: object to processing based on legitimate interests.
To exercise any of these rights, contact us at whenupapp@gmail.com. We will respond within 30 days. If you are in the European Economic Area (EEA), you also have the right to lodge a complaint with your local data protection authority.
11. California Privacy Rights (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights:
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
- Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions. You can also delete your account directly from within the app.
- Right to Correct: You may request that we correct inaccurate personal information we have collected about you.
- Right to Opt-Out of Sale or Sharing: We do not sell your personal information to third parties, nor do we share it for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond the purposes permitted by the CPRA.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
To exercise your California privacy rights, please contact us at whenupapp@gmail.com with the subject "California Privacy Rights Request". We will respond within 45 days as required by law. You may also designate an authorized agent to make a request on your behalf.
12. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with their information, please contact us at whenupapp@gmail.com and we will delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the "Last Updated" date above and, where appropriate, notify you via email or an in-app notification.
Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree, you should stop using the Service and may delete your account.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team at:
We will endeavor to respond to all privacy-related inquiries within 30 days.