Privacy policy

1. Controllers

to who is operated by Julian Kaufmann and Sebastian Frankl as a civil-law partnership (GbR). The partnership is not registered in the partnership register. The partners jointly represent and operate the partnership:

Julian Kaufmann and Sebastian Frankl
to who — civil-law partnership (GbR)
Stifterweg 112
89075 Ulm
Germany
Email: support@towho.app

2. Technical delivery of the website

The website is delivered through Cloudflare Pages and Workers. When it is accessed, Cloudflare processes technical connection data such as IP address, time, requested URL, HTTP headers and browser or device information to deliver and protect the website and diagnose errors.

Cloudflare Web Analytics is enabled for towho.app with the setting “Enable, excluding visitor data in the EU”. The analytics beacon therefore excludes visitors in the EU. This is separate from technical request handling. Worker observability is enabled in the Worker code; its logs may contain execution details, errors and explicitly logged messages. Cloudflare documents standard Workers Logs retention of three days on Free and seven days on Paid plans. Technical request and log data may be processed globally under the account configuration.

3. Supabase

to who uses Supabase for authentication, the PostgreSQL database, Realtime features, Edge Functions and file storage. Depending on the feature, Supabase processes account and profile identifiers, content, roles, interactions, location-related data, messages, notifications and technical session data. The project is in the Central EU region (Frankfurt), eu-central-1. The Supabase dashboard currently lists no database backup; separately created backups or exports may have different storage locations and retention periods. Support and subprocessor activities may take place outside this project region. See Supabase’s data processing terms and subprocessor list.

4. Registration, sign-in and guest use

The app and website use the same Supabase user account. Registration is available with an email address and password or through Google or Apple. During initial setup, users provide a unique profile name, first name, last name, phone number and date of birth. Email-and-password accounts are fully set up only after the email address is confirmed. The server checks the date of birth against the minimum age of 16, but does not verify it against an official document. The phone number is required and stored for account security/verification purposes; no SMS-code check is currently performed. The accepted Terms version and acceptance timestamp are stored on the user account.

Visitors can browse the app before registering. The app automatically creates an anonymous Supabase Auth session with its own UUID. The session is stored locally in AsyncStorage and allows access to features made available to guests. Event impressions and detail views may be associated with this UUID for reach measurement. It contains no name or email address by itself, but can recognise the same guest over time and is therefore pseudonymous. Supabase does not automatically delete anonymous Auth accounts; they remain until deleted or linked to a registration.

Registered accounts also involve an Auth UUID, email address, password hash, sign-in provider, session data and authentication metadata. For Google or Apple sign-in, data needed for OAuth is exchanged between the provider, Supabase and to who. Apple may provide a Private Relay address instead of the user's personal email address; confirmation emails to this address are forwarded through Apple's relay.

Confirmation and security emails are delivered through Supabase Auth and its configured SMTP delivery provider.

5. Profiles, roles and Creator applications

Depending on use, to who may process profile name, first and last name, description, avatar, interests, date of birth, gender selection, phone number, roles, suspension status, Creator memberships and To-Who Partner status. First and last names are accessible only to the account holder in their account settings and authorised admins in the admin panel; they are not public profile fields. Phone numbers are not shown on public profiles. To-Who Partner status is assigned manually and independently of Instagram confirmation to a user or organizer profile, and displayed as a public badge on that profile. Other optional profile details are processed only when provided. Creator and admin access is limited using roles and relationships stored in Supabase.

Creator applications are submitted in the signed-in dashboard. The Instagram access check uses the submitted username, a random single-use code (stored only as a server-side hash and valid for 48 hours) and the confirmation timestamp. An Admin or Owner manually matches the DM sender and code in to who’s official Instagram inbox; no Meta/Instagram API integration is currently enabled. Confirmation proves access to that Instagram account only, not identity. The Instagram check is used only for the Creator application and does not grant To-Who Partner status. It does not grant Creator status; an Admin or Owner reviews the application separately.

6. Events, organizers and published content

To create and display events, to who processes data including titles, descriptions, times, prices, tags, venues, addresses and coordinates, bonus information, maximum attendance, organizer relationships, event images and menu images. Organizer profiles may also contain descriptions, contact details, a website and social media addresses. Published details and media may be publicly visible.

7. Community, friends, attendance and chats

Friendships, favorites, attendance, tickets or attendance status, ratings, direct messages and event chats may involve internal user and event IDs, relationships, messages, timestamps, memberships and status information. Realtime delivers new messages and notifications to authorised accounts.

Users may voluntarily share live location in a direct chat. The user ID is used as a Presence key, and latitude, longitude and a timestamp are sent through Supabase Realtime Presence to the chat partner approximately every five seconds or after relevant movement. The audited code does not create a historical location table from this data; transmission stops when sharing is switched off or the chat is left.

Registered users may choose to share a friend link. It contains their Auth UUID and opens their profile in the app so others can send a friendship request.

8. Reports, blocking and moderation

Community safety functions may process the reporting user, reported user, organizer, event or content, reason, description, affected chat, review status, internal notes and decisions. Measures may include content removal, warning, temporary suspension or permanent suspension; stages may be skipped depending on severity. A review may be requested at support@towho.app. Users can appeal moderation decisions in the app. The appeal is linked to the user account and the specific moderation decision; its status and handling are stored. Open cases remain until completion; completed cases are generally deleted after three months. The measure remains documented until it ends; the related decision and necessary case evidence are kept for a further three months. Certain chat and moderation records may remain without a direct profile link after account deletion. Julian Kaufmann and Sebastian Frankl handle reports and appeals manually and can access the data needed to do so. When an event is deleted, it disappears from the app immediately. A private minimal record containing the event ID, creator ID, deleting person where available, deletion time, event title and start time is kept for at least 48 hours and until the next daily cleanup after that period. If an open or still-retained moderation case relates to it, the record is kept until the case or measure ends and for a further three months.

9. Location, maps and directions

• The current location may be shown locally on the map after operating-system permission.
• Nearby search sends current coordinates and a radius to Supabase; no permanent location history was found in the audited function path.
• When an event venue is created, the entered address is searched through Photon using OpenStreetMap data; the resulting location and coordinates are stored.
• The mobile map uses Google Maps. External directions use Apple Maps or Google Maps on iOS and Google Maps on Android.

Non-location features and manual city selection remain available without location permission.

10. Event analytics and audience statistics

The app records event impressions, detail views, shares, favorites and attendance together with event ID, source and time. The backend call uses the Supabase Auth UUID as a persistent visitor_id. Registered users are additionally linked through an internal user_id.

This processing is not fully anonymous: guests can be recognised through the anonymous Auth UUID, and registered users are linked to an account in the backend. Creators receive aggregate reach, source, funnel and returning-visitor metrics. Age, gender and interest statistics are calculated from participant profiles and displayed only as aggregates once at least five distinct participants are present.

Individual analytics events in the Supabase table event_analytics_event are automatically deleted after 24 months. Account deletion also removes events whose visitor_id or user_id matches the deleted account’s Auth UUID. The processing supports reach measurement and aggregate statistics for organizers and is based on legitimate interests under Article 6(1)(f) GDPR. Users may object for reasons relating to their particular situation. Favorites, attendance and profile data follow their respective feature and deletion rules.

The iOS app also uses the expo-observe SDK with EAS Observe for technical performance and error diagnostics. Data sent includes app startup, loading and interactive timings; app/release and device/system context; network, battery and thermal metrics; summarized network-request metrics; unhandled JavaScript errors; and native iOS crash reports. The app also sends a technical event containing profile-loading duration and success status. A stable, pseudonymous EAS client identifier distinguishes an app installation across launches and updates; our app code does not send a Supabase account ID or profile data to this service. Error reports may contain technical error messages and stack traces. Metrics collected offline may be queued and sent later. Expo states that metrics, logs and traces are deleted after 90 days; because deletion runs monthly, data may remain for up to 120 days.

11. Notifications and push

In-app notifications involve recipient ID, message, event or source reference, read status and preferences in Supabase. Once operating-system push is voluntarily enabled, to who stores the Expo push token, user ID, platform, activation state, last contact and delivery/request information. Push content is sent to the Expo Push Service.

Push can be disabled in app settings, which removes the stored token. Entries in the Supabase delivery log push_delivery_log are automatically deleted after 30 days. No automatic age-based deletion is currently configured for stored in-app platform notifications and their read statuses. Expo may apply separate retention periods for push delivery.

12. Device permissions and local features

Location, camera, photo library, calendar and notification permissions are requested only for the relevant feature. No camera image upload was found in the QR scanner path. When adding an event to a calendar, the app writes event title, time, location and description to a calendar selected on the device. Further synchronisation depends on the user’s device account.

13. Images and Supabase Storage

Selected avatar, event, menu and organizer images are checked for file type and size and uploaded to the Supabase Storage buckets avatars, event-images or organizer-images. Public content images may be available through public URLs. to who does not currently use AI image editing.

Selected published event images and screenshots of the To-Who app showing event content may also be used on To-Who's own social media profiles and in paid social media ads. This use is limited to promoting To-Who and its platform, not unrelated external companies or products. The selected social media or advertising platforms may receive the content and any personal information shown in it and process it under their own terms. The rights and permissions of creators and people depicted must be checked before each use.

When an event is deleted, event and map images remain in a storage deletion queue for three days. After that period, the app removes them during its next cleanup run. Cleanup runs when a registered user starts or resumes the app, or opens the admin area; if no cleanup run occurs, removal may happen later. Avatar and organizer images follow separate deletion processes. Provider backups and technical caches may follow separate retention periods.

⚖️ Legal review required: Confirm the legal basis, required usage rights and permissions for using event images and app screenshots on To-Who's own social media profiles and in paid ads.

14. Password reset and account deletion

Password reset uses Supabase Auth and processes the email address, recovery link or code, a temporary recovery session and the new password. The website and app use their designated redirect and deep-link flows.

Users may delete their account at any time without a notice period. Account deletion processes the current Auth session, reauthentication, a confirmation phrase, account ID and, where applicable, the avatar path. The server checks that the session is no more than ten minutes old and then deletes the Auth user, cascading personal records and analytics events linked to the account through visitor_id or user_id. The former user no longer appears publicly under their previous profile; retained content displays “Deleted User” instead of the username and profile image. Certain chat and moderation records may remain without a direct profile link. Sole owners of an organizer profile must transfer ownership first.

Upcoming events created by the account that are not assigned to an organizer profile are also deleted. Events assigned to an organizer profile remain.

15. Cookies, browser and app storage

The website uses Supabase browser storage for persistent Auth sessions and short-lived sessionStorage markers for password recovery and deletion reauthentication. The app stores the session, language, selected city and optionally the Expo push token in AsyncStorage.

No to who marketing cookies or Cloudflare Web Analytics beacon were found in the audited website code.

16. Instagram account confirmation for Creator applications

In the Creator dashboard, a user can generate a one-time code and send it by Instagram DM to to who’s official account. Julian Kaufmann and Sebastian Frankl have access to the official Instagram inbox and manually match the DM sender and code to the open application. No Meta/Instagram API integration is enabled. The code is single-use and valid for 48 hours. Confirmation proves access to that account only; both partners review Creator applications and make decisions manually.

17. Contact, social media and external links

The contact form processes the optional name, email address and message so we can respond to the inquiry. The website does not store these details in a database; it sends them by email through Resend to support@towho.app. Resend also processes delivery and technical data. Instagram, TikTok, WhatsApp and map links transfer data to the target provider only after a click. No social SDK, embedded feed or pixel is included. When to who itself publishes selected content on its own social media profiles or in paid ads, the respective platforms receive that content and process it under their own terms.

18. Recipients and possible international transfers

Depending on the feature, Cloudflare receives website requests and Worker logs; Supabase receives Auth, database, Realtime and Storage data; Resend receives delivery data for Auth emails and contact-form names, sender addresses and message text; Photon by Komoot receives address searches; Google receives data for OAuth sign-in and mobile maps; Apple receives data for OAuth sign-in and may forward Private Relay emails; Meta/Instagram receives Creator confirmation DMs; and Expo receives push tokens and push messages. Social media and advertising platforms receive selected event content or app screenshots when to who publishes them. If users open external map, social, messaging or email apps, data is transferred to the selected provider.

Supabase stores primary project and backup data in Frankfurt; support and subprocessor processing may take place outside that region. Cloudflare may process technical request data globally under the account configuration. Other providers may process data outside the EEA under their applicable terms and transfer mechanisms. Current provider agreements, subprocessors and transfer mechanisms are described in the providers’ privacy and contract documents.

19. Retention

Individual analytics events in event_analytics_event are automatically deleted after 24 months. Entries in the Supabase push delivery log push_delivery_log are automatically deleted after 30 days. Cloudflare Workers Logs are retained for three days on Free and seven days on Paid plans; Supabase service logs follow the project plan. These periods do not include separate provider backups. Retention for contact emails and Resend logs depends on account settings and has not been verified locally.

Chat histories, including messages and edit history, are deleted when no message has been sent, edited or deleted in the conversation for three months. A chat linked to an open or still-retained case remains until the case-retention period ends; that period normally expires three months after case closure or the end of the measure. Open or reviewing reports and appeals are kept until they are resolved. Closed moderation reports, appeals and decisions are deleted three months after resolution. Measures and necessary evidence remain until the measure ends. Related decisions, reports and chat evidence are kept for a further three months.

Pending Creator applications are kept until they are decided or archived. After rejection or the end of Creator access, the application, Instagram username and related verification data are retained for one month and then automatically deleted. An approved application is kept while Creator access remains active.

Deleted events are removed from the app immediately. Their private minimal record (event ID, creator ID, deleting person where available, deletion time, title and start time) is normally kept for at least 48 hours and until the next daily cleanup after that period. If an open or still-retained moderation case or measure needs it, the record remains until that case or measure ends and for a further three months.

Account data follows the applicable deletion rules. Upcoming personal events without an organizer assignment are deleted in the account deletion flow; events assigned to organizer profiles may remain.

20. Legal bases

Account and registration data and use of core features requested by the user are processed under Article 6(1)(b) GDPR. Security, abuse prevention, moderation and the reach measurement described in section 10 are based on legitimate interests under Article 6(1)(f) GDPR. Statutory retention or documentation duties are based on Article 6(1)(c) GDPR. Location, calendar, camera, photo and push features are used only when the user requests them and grants the required device permission.

⚖️ Legal review required: Determine the legal basis, balancing of interests and whether separate consent is required for To-Who's use of event images and app screenshots in its own promotion and paid ads, plus the legal basis and retention period for contact requests.

21. Data subject rights

Subject to applicable law, individuals may request access, rectification, erasure, restriction and portability of their personal data and may object to processing. Consent may be withdrawn for the future. Individuals also have the right to lodge a complaint with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

Requests may be sent to support@towho.app. Julian Kaufmann and Sebastian Frankl handle these requests jointly and manually.

22. Required information and automated decisions

Registration requires a profile name, first name, last name, phone number, email address and date of birth. A password is required only for email-and-password sign-in. The phone number is stored for account security/verification purposes but is not currently checked using an SMS code. Other required information depends on the feature used. The system sorts and aggregates event and usage data but does not make legally significant decisions based solely on automated processing. Julian Kaufmann and Sebastian Frankl manually review Creator applications and moderation decisions.

23. Changes

This policy must be updated when features, providers, data flows, legal bases or retention periods change. The published version is authoritative.