Privacy Policy
Last updated: 5 September 2026
WhosFree shows university students when they and their friends are free between classes. This policy describes exactly what the app collects, where it goes, how long it is kept, and how to delete it. It describes how WhosFree actually works, not what it might do one day.
The short version
- There is no sign-up. No email address, no password, no phone number.
- Your timetable is visible only to people you have swapped codes with, and that is enforced by the database rather than by the app.
- There is no analytics, no tracking, no advertising, and nothing is sold or shared for marketing.
- A timetable photo you choose to scan is sent to Anthropic to be read, and is not stored anywhere.
- The map is off until you switch it on, shows you only to friends you pick, keeps one position rather than a history, and never runs in the background.
- You can delete your account and everything attached to it from inside the app.
1Who we are
WhosFree is an independent iOS app, built and operated by a single developer. For anything in this policy, including a request about your own data, the contact is:
Email: affansyed711@gmail.com
2There is no sign-up
WhosFree never asks for an email address, a password, or a phone number. The first time the app talks to our server it creates an anonymous account: a random identifier and nothing else. It is not linked to your Apple ID, your email address, or any other service, and we have no way to work out who you are from it.
The token that keeps you signed in is held in the iOS Keychain on your device.
3What we store on our server
Nothing leaves your phone until you share your code with someone. From that point the following is stored so that friends can see it and so that limits can be enforced:
| What | Why |
|---|---|
| Display name, and school if you enter one | So friends know who you are |
| Avatar emoji | Shown wherever you appear |
| Profile photo, if you set one | Shown to friends you’ve added |
| Your classes: name, room, days and times | The whole point of the app |
| Your share code | So a scan can find you |
| Who you’ve added as a friend | To decide whose schedule you may read |
| Your position, while the map is switched on | To show you to the friends you chose |
| Which friends may see your position | To decide who the map shows you to |
| Whether you have marked yourself free during a class | So friends see you as free when you say you are |
| How early your classes really end | So friends’ phones work out your free time correctly |
| Whether bumps are switched on | So we know not to send you one |
| Device push token, if you allow notifications | To deliver a bump |
| A record of bumps: who sent one, to whom, and when | To enforce the rate limit |
| A per-day count of timetable scans you’ve run | To enforce usage limits and control cost |
Who can see it. Only people whose share code you have redeemed, or who have redeemed yours. This is enforced by row-level security in the database itself, not by the app, so it holds even if the app is modified. Nobody else, including other WhosFree users, can read your schedule, your name, or your photo.
Bumps are on unless you turn them off, so onboarding is where iOS asks for notification permission. If you decline, no push token is ever stored.
4What stays only on your device
These never reach our server:
- Your availability setting, including “Always busy”
- Your light or dark theme preference
- The cached copy of your friends’ schedules that lets the app work offline
5Timetable photos
If you photograph a timetable, the image is sent to Anthropic to be read and turned into a list of classes. WhosFree does not store the image: it is not written to our database or to any file storage, and it is discarded once the classes come back. Anthropic’s handling of it is governed by their own policies. We keep only a count of how many scans you have run, so limits can be applied.
If you would rather no photo left your phone, you can type your classes in by hand instead. Both options are offered wherever you add a class.
6Your profile photo
Your photo is stored on your phone and, once you have shared your code, on our server so friends you have added can see it. It is never included in a share code or a QR code, and it is never sent to anyone who is not your friend.
7Where you are
The map is off by default and does nothing until you switch it on. It is never switched on for you, and adding a friend does not switch it on.
While it is on, your phone sends your position to our server so the friends you have chosen can see it. That includes while the app is closed, which is the point: a map that only knows where somebody was the last time they opened their phone is worse than misleading. iOS asks you for this separately, as “Always”, and you can refuse it -- sharing then works only while the app is open.
It updates when you move, not constantly. Your phone reports a new position after about 50 metres, so sitting still sends nothing at all. We are not watching a live feed.
Only the friends you pick. Turning the map on starts you sharing with the friends you have at that moment, and you can remove any of them. Someone added later is not included unless you add them. Being able to see your timetable does not mean being able to see where you are.
One position, not a trail. We keep your latest position only, overwritten each time it changes. There is no history of where you have been, and we could not produce one.
Turning it off deletes it. Switching the map off removes your stored position and the list of who could see it from the server straight away. It does not wait for your phone, and it does not depend on your phone being online.
The map is drawn by Apple Maps, which is part of iOS.
8Who else receives data
| Service | What it receives |
|---|---|
| Supabase | Hosts the database and the anonymous accounts. Everything listed above as stored on our server lives there. |
| Anthropic | A timetable photo, only when you ask for one to be scanned. |
| Expo | Relays a bump to Apple, addressed by your push token. |
| Apple | Delivers the notification to your device, and distributes the app. |
We do not sell your personal information, and we do not share it for advertising or any other marketing purpose.
9What we do not do
- No analytics, no tracking, no advertising SDKs, and no advertising identifier
- No access to your contacts, calendar, microphone, or health data
- No location unless you switch the map on yourself, and never while the app is closed
- No access to your photo library beyond the single image you explicitly pick
- No profiling, and no automated decisions made about you
- No payment information of any kind: the app is free and has no purchases
10Legal bases for processing
If you are in the United Kingdom or the European Economic Area, we rely on:
- Contract, to provide the service you asked for: storing your timetable and showing it to the friends you chose.
- Consent, for the things you opt into: sharing your code, allowing notifications, sending a photo to be read, and showing your position on the map. Each can be withdrawn, by removing a friend, turning bumps off, switching the map off, or simply not scanning.
- Legitimate interests, to keep the service working and affordable: rate limits, scan limits, and preventing abuse.
11How long we keep it
Your profile, classes, friendships and push token are kept while your account exists, and are replaced as you edit them. Bump records and daily scan counts are kept while your account exists so the limits they enforce cannot be reset by deleting history.
Your position is kept only while the map is switched on. Switching it off deletes it, and so does deleting your account.
When you delete your account, all of it goes at once, including the anonymous account itself. There is nothing left over and no anonymised remainder, because we keep no analytics to anonymise.
12Deleting everything
Open You → Delete account and data. This removes your profile, classes, friendships, push token, position, map audience, bump records and scan counts from our server, deletes the anonymous account, and clears everything on your phone. It cannot be undone, and there is no backup we can restore from.
Deleting the app without doing this removes only the copy on your phone. Your profile would stay on the server for friends to see, so use the button first.
13Your rights
At any time you can:
- Delete your account and everything attached to it, from You → Delete account and data.
- Correct anything we hold, by editing it in the app. What you see is what is stored.
- Withdraw consent, by turning bumps off, removing a friend, or declining notification permission.
- Request a copy of your information, or ask us to restrict or object to processing, by email.
Because the account is anonymous, we can only act on a request that comes from the app itself or that identifies your account by its share code. We have no other way to tell one account from another, which is by design.
If you are in the UK or the EEA you have these rights under the UK GDPR and GDPR, including the right to complain to your local supervisory authority (in the UK, the Information Commissioner’s Office). California residents have comparable rights under the CCPA, including the right to know, to delete, and to opt out of the sale or sharing of personal information, which we do not do. We will never treat you differently for exercising any of them.
14Security
Everything is sent over encrypted connections and stored by Supabase with encryption at rest. Access to your schedule is restricted at the database level by row-level security, so a friendship row is what grants it and nothing else. Your session token is kept in the iOS Keychain. We store no passwords and no payment details. No system can promise absolute security, but there is very little here to lose: no email address, no password, and no way to identify you.
15Children
WhosFree is intended for university students and is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information through the app, email us and we will delete it. If you are between 13 and 18, please use WhosFree with the involvement of a parent or guardian.
16Changes to this policy
If we change how WhosFree handles personal information, we will update this page and revise the date at the top. Where the change is significant, it will also be noted in the app.
17Contact
Questions, requests, or privacy concerns: affansyed711@gmail.com