Privacy Policy

1. Controller

Munichon GmbH & Co. KG, Rudolf-Diesel-Ring 17, 82054 Sauerlach, Germany
Email: info@munichon.com

2. Account and profile

For your account, we store your first and last name, phone number, optionally your email address, a password (only encrypted as a hash), and voluntarily a profile photo, “What do you do?”, “About me”, your skills and what you’re looking for. Purpose: providing the app (Art. 6(1)(b) GDPR). To verify your details, we send you a code by email or SMS.

3. Address book matching

The app only reads your address book with your permission. Phone numbers and email addresses are converted into checksums (SHA-256 hashes) on your device; only these checksums are sent to our server, not names or plain-text numbers. The server compares them with existing accounts and only stores which WhoKnows users are in your address book – not the checksums of your other contacts. Purpose: showing you which of your contacts use WhoKnows and what they can do (Art. 6(1)(b) and (f) GDPR; legitimate interest in the core feature with minimal data processing for non-users).

4. What others see about you

Your direct contacts (who have your number or email in their address book) see your name, your photo, your skills, “About me” and ratings.

Contacts of your contacts (2nd and 3rd degree) only see you with your explicit consent (Art. 6(1)(a) GDPR), which you give under Profile → Privacy:

• “Show my profile in the extended network”: first name, initial of your last name, photo, “About me”, skills and ratings.
• “Share my phone number”: additionally your phone number.

Without consent, they only see your skills, without your name and photo, and can reach out to you through your mutual contact. Your consent is voluntary and can be withdrawn at any time with effect for the future. We store the time and version of each consent as proof.

5. AI-powered search

When you search in your own words, we send your search query and job titles – no names or contact details – to Anthropic PBC (USA) to find matching professions. Legal basis: Art. 6(1)(b) GDPR; the transfer to the USA is based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. Ratings

Ratings and comments are visible to your contacts and – only with the consent of the person rated – to their extended network, along with your first name.

7. Reporting and blocking

You can report profiles and block people. For a report, we store who reported whom, the reason, any text you choose to add and the time. We review reports to prevent abuse and enforce the Terms of Use (Art. 6(1)(b) and (f) GDPR). The reported person is not told who reported them. For a block, we store who blocked whom; you then no longer see each other. You can unblock people under Profile → Privacy.

8. Notifications, SMS and email

For push notifications, we use Firebase Cloud Messaging (Google Ireland Ltd.); a device token is stored for this purpose. Push notifications can be turned off under Privacy. We send verification codes by email via our mail server and by SMS via seven communications GmbH & Co. KG (Willestr. 4–6, 24103 Kiel, Germany); the provider receives your number and the code for this purpose.

9. Purchases

You buy WhoKnows Pro through the App Store (Apple) or Google Play (Google). We don’t receive any payment data, only a purchase confirmation, which we verify with the respective store (Art. 6(1)(b) GDPR).

10. Hosting and server log files

We run the app server and website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Helsinki (Finland, EU). We have a data processing agreement with Hetzner (Art. 28 GDPR).

Each time the server is accessed, the IP address, time, requested address and device or browser information are processed for technical reasons. We also use the IP address briefly to limit abuse such as repeated login attempts. We delete server log files after 30 days. Legal basis: Art. 6(1)(f) GDPR (security and operation).

11. Retention period

We store your data as long as your account exists. If you delete your account in the app (Profile → ⋯ → Delete account), your profile, photo, contact links, blocks, your ratings, consent records, purchase confirmations and device tokens are deleted. They disappear from our backups within 14 days at the latest. Invoices for purchases are kept by Apple or Google. We keep reports for as long as necessary to handle them and to protect against repeat violations. If you delete your account, a report you made remains without any link to you; if the reported person deletes their account, the report is deleted.

12. This website

When you visit whoknowsapp.com, our web server processes technically necessary data (IP address, time, page requested, browser) in server log files in order to deliver the website and protect it against abuse (Art. 6(1)(f) GDPR). We delete the log files after 30 days. The website does not set cookies, does not use tracking and does not load content from third parties; fonts are hosted on our own server.

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), as well as the right to withdraw consent you have given (Art. 7(3) GDPR). Write to us at info@munichon.com. You can also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Security

Data is transmitted encrypted (HTTPS); we only store passwords as a hash.

The German version of this privacy policy is legally binding.