Privacy policy

1. Introduction

WhenUp ("WhenUp", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use the WhenUp mobile application and related services (the "Service"), how we use that information, with whom we share it, and the choices you have.

This policy applies to all users of the Service. By creating an account or otherwise using the Service you acknowledge that you have read and understood this Privacy Policy. The current version is always available within the app under Profile → Privacy Policy and at whenupapp.com/privacy.

2. Information we collect

We collect information you provide directly and information generated automatically by your use of the Service.

Account and profile information

When you create an account you provide your email address, a username, and a display name. You may optionally add a profile photo. We also record your device timezone, which is used to display availability and plan times correctly.

Availability data

You may share your personal availability by selecting hours on specific dates. These availability slots are stored and, depending on your privacy settings, may be visible to your accepted friends or only to you. You control this setting at any time from the Availability tab.

Plans, events, and social interactions

When you create or join a plan we store the plan details (title, description, dates, location, status), your membership and RSVP, any date or activity options you propose, and your votes on options proposed by others. Messages sent in a plan chat are stored and visible to all plan members.

Friend requests you send or receive, accepted friendships, and any users you block are stored to power the social features of the Service.

Profile photos

If you choose to add a profile photo, the image you select is uploaded to secure cloud storage and associated with your account. We access your device photo library only when you initiate the photo-selection action; we do not scan or index your photos.

Push notification tokens

When you enable push notifications, we store a device-specific token (generated by Expo's push notification service) to deliver plan invitations, RSVP updates, friend requests, and event reminders. This token and an installation identifier are linked to your account. You can revoke it at any time by disabling notifications in your device settings or in the app.

Usage and analytics data

We collect pseudonymous event data to understand how the Service is used and to improve it. This includes events such as creating a plan, accepting a friend request, or casting a vote. We link these events to a pseudonymous internal user identifier for analytical purposes.

Payment and subscription information

If you subscribe to WhenUp Pro, payment processing is handled entirely by Apple App Store or Google Play. We never receive or store your payment card details. We receive confirmation of your subscription status and entitlements via a third-party subscription management service (RevenueCat).

3. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Create and manage your account and authenticate your identity.
• Display your availability to friends or other users according to your privacy settings.
• Enable you to create plans, invite participants, vote on options, and coordinate meeting times.
• Send push notifications for plan invitations, RSVPs, friend requests, and reminders.
• Process and manage your subscription status and grant access to premium features.
• Analyze usage patterns to understand which features are valuable and identify areas for improvement.
• Respond to your support requests and communicate with you about your account.
• Detect, investigate, and prevent fraudulent or abusive activity.
• Comply with our legal obligations.

4. Third-party services

The Service relies on the following third-party providers. Each operates under its own privacy policy and security standards.

Supabase

All user data — accounts, availability, plans, friendships, messages, photos, and push tokens — is stored in a Supabase database hosted in the European Union (West EU / Ireland region). Supabase provides authentication, real-time data synchronization, and file storage. Data is encrypted in transit (TLS) and at rest. Supabase privacy policy: supabase.com/privacy.

PostHog

We use PostHog for product analytics. PostHog receives pseudonymous event data (e.g., "user created a plan") linked to an internal user ID. No sensitive personal data such as availability slots, plan details, or messages is sent to PostHog. PostHog privacy policy: posthog.com/privacy.

Sentry

We use Sentry for crash and error diagnostics. It may receive stack traces, application and device information, and an internal account ID. Request details, usernames and console breadcrumb contents are removed by our error filter. Sentry privacy policy: sentry.io/privacy.

RevenueCat

RevenueCat manages in-app subscription entitlements on our behalf. It receives your app store receipt and subscription state; it does not receive your payment card details. RevenueCat privacy policy: revenuecat.com/privacy.

Expo / push notification infrastructure

Push notifications are routed through Expo's push notification service, which in turn delivers them via Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) depending on your device. These services may process device tokens and notification content, including plan titles and invitation details, as part of delivery. Expo privacy policy: expo.dev/privacy.

5. How we share your information

We do not sell your personal information. We share information only in the following circumstances:

• With other WhenUp users: your display name, username, and profile photo are searchable and visible to authenticated WhenUp users. Your availability is visible according to your privacy settings. Plan details are visible to plan members.
• With service providers: Supabase, PostHog, Sentry, RevenueCat, and Expo receive data only to the extent necessary to deliver the Service, as described in Section 4.
• For legal compliance: we may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of WhenUp, our users, or the public.
• In a business transfer: if WhenUp is acquired, merged, or transfers its assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

6. Push notifications

With your permission, we send push notifications for events including plan invitations, friend requests, RSVP changes, vote nudges, and event reminders. You may withdraw permission at any time through your device's notification settings or by toggling notifications off in the WhenUp app (Profile → Notifications). Disabling notifications will not affect your access to the Service, but you may miss time-sensitive plan updates.

7. Your availability privacy controls

You have direct control over who can see your availability:

• Visible to friends (default): only accepted friends can see your available hours. Blocked users never can.
• Only me: only you can see your availability. You may also create a share link for a period you choose; anyone who holds that link can see your availability for that period only, until the period ends.

You can change this setting at any time from the Availability tab. Switching to Only me immediately revokes access for friends. Share links stay active until the end of their period, and are never usable by people in a block relationship with you.

8. Data retention

We retain your personal data for as long as your account is active and for a reasonable period afterward to comply with legal obligations or resolve disputes.

If you delete your account (Profile → Account → Delete account), we permanently delete your profile, availability data, plan memberships, and friend relationships from our active systems. Messages you sent in plan chats are redacted: bodies and reactions are removed, while a deleted-message marker can remain. Profile photos are queued for deletion from storage. Shared plans may remain for other participants, with ownership transferred when possible. Anonymized or aggregated usage statistics that cannot reasonably identify you may be retained indefinitely for product improvement purposes.

Signing out unregisters the current installation; account deletion removes its device registrations. Disabling notifications in WhenUp stops delivery. Device permission revocations synchronize when you reopen the app. Pseudonymous analytics and diagnostic records follow provider retention settings; contact us to request deletion of associated records.

9. Data security

We implement technical and organizational measures to protect your information, including TLS encryption for all data in transit, encryption at rest in our database, row-level security policies that restrict database access to the data owner's session, and access controls that prevent one user from reading another user's private data.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at hello@whenupapp.com and change your password.

10. Your privacy rights

Depending on your location, you may have the following rights with respect to your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data. You can also delete your account directly from within the app.
• Restriction: request that we limit the processing of your data in certain circumstances.
• Portability: request a machine-readable copy of your data where technically feasible.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@whenupapp.com. We will respond within 30 days. If you are in the European Economic Area (EEA), you also have the right to lodge a complaint with your local data protection authority.

11. California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions. You can also delete your account directly from within the app.
• Right to Correct: You may request that we correct inaccurate personal information we have collected about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information to third parties, nor do we share it for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond the purposes permitted by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise your California privacy rights, please contact us at hello@whenupapp.com with the subject "California Privacy Rights Request". We will respond within 45 days as required by law. You may also designate an authorized agent to make a request on your behalf.

12. Children's privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with their information, please contact us at hello@whenupapp.com and we will delete it promptly.

13. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you via email or an in-app notification.

Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree, you should stop using the Service and may delete your account.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team at:

We will endeavor to respond to all privacy-related inquiries within 30 days.