WhichOne

Effective date: August 31, 2026

1. General Information

This Privacy Policy describes how WhichOne collects, uses and protects your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Italian data protection law.

2. Personal Data Collected

3. Legal Bases for Processing

• Performance of a Contract (Art. 6.1.b GDPR): Email/phone number for account access, content for the operation of polls and feeds; push token for the notifications you enable through the system permission
• Legal Obligation (Art. 6.1.c GDPR): Retention of logs for security and investigation of unlawful activity; reporting of CSAM to the competent authorities
• Legitimate Interest (Art. 6.1.f GDPR): Content moderation, fraud and abuse prevention, crash diagnostics and minimal usage statistics (at most 8 named events, with no advertising identifiers and no sharing with third parties for marketing purposes). You can object at any time by writing to support@whichone.social (Art. 21)

4. Purposes of Processing

• Providing the service (account access, polls, feeds, messages)
• Age verification (18+) through the date of birth declared at registration
• Content moderation and enforcement of community rules
• Sending push notifications (activity, messages, follows)
• Analytics and service improvements (Firebase Analytics, Crashlytics)
• Security and abuse prevention (access logs, fraud detection)
• Legal compliance (reporting of unlawful content, CSAM)

5. Data Retention

• Active account: Retained for as long as the account exists
• Content after account deletion: Deleted within 30 days (except where legal obligations apply: logs, CSAM reports, evidence of unlawful activity)
• Access / security logs: Retained for 12 months for investigations and compliance
• Analytics: User-level data retained in Firebase for up to 14 months, then aggregated only
• Crash data: Retained for 90 days in Crashlytics

6. Data Recipients (Processors)

Amazon Web Services (AWS)

• Services: Cognito (authentication), AppSync (GraphQL API), DynamoDB (database), S3 (media storage)
• Location: Frankfurt data centers (eu-central-1)
• Transfers outside the EU: None — AWS EU infrastructure is located in the EU

Google Cloud (Firebase)

• Services: Cloud Messaging (FCM — push notifications), Analytics, Crashlytics
• Location: USA (transfer outside the EU)
• Safeguards: EU–US adequacy decision for the Data Privacy Framework (Google LLC is DPF-certified), with Standard Contractual Clauses (SCC) as an additional safeguard

Federated Identity Providers

• Sign in with Apple / Google: Your email is shared via OAuth 2.0 on first sign-in; no further processing with Apple/Google

7. Your Rights (Arts. 15-22 GDPR)

Right of Access (Art. 15)

You can request a copy of all personal data we hold about you.

Right to Rectification (Art. 16)

You can ask for inaccurate data to be corrected (name, email, date of birth).

Right to Erasure (Art. 17)

You can request deletion of your data; delete your account in Settings → Delete account or send a request to support@whichone.social.

Right to Restriction (Art. 18)

You can request a temporary freeze of processing.

Right to Data Portability (Art. 20)

You can receive your data in a structured, commonly used, machine-readable format (JSON).

Right to Object (Art. 21)

You can object to processing based on legitimate interest, including usage measurement, by writing to support@whichone.social. The app does not profile you for marketing purposes.

Automated Decision-Making (Art. 22)

We do not use fully automated decisions that produce legal effects concerning you.

All requests should be sent to support@whichone.social, indicating the email address or phone number associated with your account; we may ask for additional elements (for example an identity document) only where necessary to verify your identity. We will respond within 30 days.

8. Complaints to the Supervisory Authority

If you believe the processing of your data violates the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

• Phone: +39 06 696771
• Email: garante@gpdp.it
• Website: www.gpdp.it

9. Minors

WhichOne is restricted to users aged 18 or older. We do not collect data from minors. If we discover that an account was created by a minor, we will delete it immediately and contact the parents where possible. Protecting minors is a priority (see the Child Safety page).

10. Security

We implement security measures to protect your data:

• TLS encryption for all communications (HTTPS)
• Expiring JWT tokens for authentication
• AWS credentials restricted to the services that need them
• Passwordless authentication: access via one-time codes (OTP) or federated providers (Apple, Google), no passwords stored
• Logs and backups managed on AWS services (point-in-time recovery, media versioning)

However, no system is perfect. If you suspect a breach, report it to support@whichone.social.

11. Cookies and Similar Technologies

The WhichOne app does not use cookies. It uses JWT tokens stored locally on the device (iOS Keychain / Android Keystore).

12. Changes to This Policy

We may update this Policy at any time. Changes will be published here with the date of update. Continued use constitutes acceptance.

13. Contact

For privacy questions, write to support@whichone.social.