Privacy Policy — WhatDate
Last updated: 31 October 2026
Applies to: WhatDate for Android, version 0.56.0 and later, and WhatDate for iPhone (differences in "On iPhone" below)
The short version
Without Friends, your WhatDates stay on your phone. Nothing you create leaves it unless you act: you share something, send an invite, make a backup, or turn on a feature described below and use it.
When you use Friends, two different kinds of data can travel, and this policy always says which:
- Your WhatDates (and your profile): only the ones you share, only to the friends you choose. Sent online, they are end-to-end encrypted, so the relay that carries them cannot read them.
- Friends connection data: what lets two phones find and trust each other. That is public keys, a random installation ID, the friendship handshake, your handle if you choose one, and the sealed (end-to-end-encrypted) envelopes the relay carries. What is used depends on how you connect: nearby, by invite, or online.
Neither kind leaves without your action or your consent: going online is a setting you choose, and it can be undone at any time.
- There is no conventional email/phone/password account. Online Friends can create a pseudonymous installation identity and, if you choose one, a handle.
- No analytics, crash reporting, or behavioral tracking in WhatDate. Online Friends does process the limited technical records needed to route encrypted friendship traffic. Nearby sharing runs through Google Play services on your phone, which keeps its own usage statistics (see Third-party components).
- Your reminder content is local by default. It leaves only when you deliberately share it or choose another feature described below. WhatDates you mark Friends or Public sync with friends you added in person when your phones are together. After you enable Online Friends and allow Internet access, background relay traffic can deliver/reconcile the friendship and shares you already initiated.
Is there an account?
Not in the conventional sign-up sense.
You do not need an email address, phone number, password, or real-name registration to use WhatDate. Online Friends does, however, create a pseudonymous installation record so the relay can authenticate an installation, route encrypted messages, enforce limits, and maintain friendship state. If you choose a handle such as @alex, that handle is also stored by the relay for exact-match discovery. A handle is optional: you can add friends and share with them without one. Releasing, changing or losing a handle does not end your friendships or the WhatDates you share as links; the handle only stops being a way to find you.
When you add a friend, the phones exchange cryptographic public keys. A friend relationship therefore binds two WhatDate cryptographic identities. A handle or safety code is not proof of a person's legal identity.
What is stored, and where
Everything you put into WhatDate is stored on your phone. Copies leave it only in the ways listed under "What leaves your phone, and when", each started by you:
- your reminders and events — titles, notes, dates, times, repeat rules, tags
- anything you attach to them — photos, links, locations
- your reminder settings, sounds, and preferences
- your profile — the name, photo, and optional birthday you set (and your phone's brand until you set a name)
- your friends list and the nicknames you give them
This is kept in a database on your phone that is encrypted, with the key held in your phone's own secure hardware storage. If you turn on Biometric app lock, it also needs your fingerprint or face to open.
We have also switched off Android's automatic cloud backup for WhatDate. Your phone will not quietly copy your WhatDate data to Google Drive. The only backups are the ones you set up yourself (see below).
When you configure an action reminder to open an app at a scheduled time, WhatDate queries your installed applications locally to let you choose the target app. This list is queried on demand, is never saved in any database, and is never transmitted off your phone.
What leaves your phone, and when
This is the complete list of intended data flows. Reminder content is never uploaded merely because the app is installed. Some Online Friends network operations run in the background after you have enabled Internet access and initiated a friendship/share so delivery, acknowledgements, expiry, and reconciliation can complete.
Claiming or checking a handle while Offline only is on (online Android edition). When you tap Claim @name, Check current handle or Check claim status in the handle sheet, WhatDate may register this installation if necessary, claim the selected public handle, or check the installation's current handle. These requests carry Friends connection data only: the chosen handle, installation identifier, public agreement keys and the authentication the relay needs. The server also receives ordinary connection metadata such as the IP address. No WhatDates, profile or private keys are sent. The permission lasts only for that foreground action, up to 30 seconds, and ends on dismissal, leaving the app, or a setting change. Offline only remains on; queued sharing, incoming requests and background online activity stay paused. Opening the sheet, typing a name or receiving an invite grants no connection permission. A claim whose response is lost needs an explicit later check/retry; it is not sent automatically.
1a. Sharing with a friend you added in person
What leaves: the WhatDates you created and marked Friends or Public, any WhatDate you send to that friend, and your profile (section 3), plus the Friends connection data that pairing needs (public keys and the signed handshake). A WhatDate you send to a friend yourself carries its photos, resized and with location data removed; the automatic delivery lists a WhatDate's photos but does not send them. Reminders marked Private are never sent.
Where it goes: straight to your friend's phone over Bluetooth or Wi-Fi, using Android's Nearby Connections, which Google Play services on your phone carries out.
When: while "Deliver when we're near each other" is on and your phones are near each other — including while WhatDate is in the background, with a notification showing — and only with friends you added through WhatDate's nearby pairing: in person with a code, or with a nearby invite you exchanged through another app.
This is phone-to-phone. It does not use the internet and does not pass through any server of ours. Google Play services keeps its own usage statistics about these connections; see Third-party components.
1b. Sharing with a friend you added online
What leaves: the WhatDate you share with that friend — and, if you shared it as a link, its later changes and its removal — encrypted on your phone before it leaves, with a key only your friend's phone can unlock. Where it goes: to a minimal relay server we run, which holds the sealed message until your friend's phone picks it up. The relay cannot read the contents — it only sees an opaque encrypted blob with a delivery address. When: when you share a WhatDate with a friend you added online (by handle or online invite), while Offline only is off. If your phone is offline at that moment, the delivery waits and goes when you are back online. Photos do not go through the relay. The WhatDate arrives with a list of its photos, and before it is sent the app offers to send it as a file instead, which carries them.
Once your friend's phone picks up the message, its encrypted contents are erased from the relay. Uncollected messages expire and are deleted within 24 hours. More about the relay is in the dedicated section below.
2. Sharing a reminder as a message
What leaves: the reminder you chose to share, as a file or a link. The file of a Friends or Public reminder includes its photos, resized and with location data removed.
Where it goes: into whichever app you pick to send it — WhatsApp, email, Signal, whatever you choose.
When: only when you tap Share and choose an app.
Once you hand it to another app, that app's own privacy policy applies to it, not ours. We have no control over, and no visibility into, what happens after that.
3. Your profile (your name, photo, optional birthday, and your phone's brand until you set a name)
What leaves: the display name, photo, and birthday you choose in Settings → Profile. The birth year is optional; without it friends do not see your age. Until you set a name, your profile also carries your phone's brand (for example 'Lava' or 'Samsung', never the model or the phone's own name), so friends can tell you apart.
Where it goes: only to people you have added as friends, so they see who a reminder came from. It travels the same ways as your WhatDates — phone-to-phone with friends you added in person, or encrypted through the relay with friends you added online.
When: when you send someone an invite, and when your profile reaches friends you already have.
Your name is included in an invite so the other person can see who is asking. Your birthday is sent only in a signed profile to established friends. Their phone makes a private birthday reminder from it; if you remove your birthday, that linked reminder is withdrawn. A friend can delete their reminder to stop receiving it. The relay server never sees your name, photo, or birthday — relay deliveries are encrypted. If you choose to send a profile file through another app, that app can access the file and its own privacy policy applies.
4. Link previews
What leaves: the web address (URL) you saved, sent to that website.
Where it goes: directly to the website itself — for example, if you save a link to a news article, WhatDate asks that news site for the page title and picture.
When: only if you are using the online version of the app and "Offline only" is off. It starts on, so link previews stay off unless you choose "Online - over the internet" when WhatDate first asks how you will share, or turn Offline only off later.
When this happens, that website can see your phone's IP address, the same as if you had opened the link in your browser. WhatDate sends no cookies, no account, and no identifier with the request — only the address and a label saying the request came from WhatDate. Nothing about the fetch comes back to us.
5. Voice input
What leaves: what you say, while you are using the microphone button.
Where it goes: to the speech recognition service built into your phone. On most Android phones that is Google's, and it may process your speech on Google's servers, under Google's privacy policy, not ours.
When: only while you are actively using the voice button. The microphone is not open at any other time.
WhatDate never receives, records, or stores your audio. It only gets back the text and turns it into a reminder. This part of Android is outside our control, which is why we are telling you about it plainly — if you would rather it never happen, don't use the voice button.
6. Backups you make yourself
What leaves: a backup file containing everything WhatDate keeps, including Private WhatDates, your attachments, and the private keys that identify you to your friends (so a restore keeps your friendships).
Where it goes: to the folder you choose — on your phone, an SD card, or a cloud drive's folder if you pick one.
When: when you make a backup yourself, and — only if you turn on automatic backup in Settings → Backup — automatically after you make changes (at most every 10 minutes while you use WhatDate) and when you leave the app.
The file is encrypted with a password you choose, using strong encryption (AES-256-GCM). We cannot recover that password, and neither can anyone else. If you lose it, that backup cannot be opened, by you or by us. For automatic backups, your phone keeps the password in its own secure storage so it can write them; the password never leaves your phone and is never put inside a backup.
If you choose a cloud drive's folder, that cloud provider's privacy policy then applies to the file — though the contents stay encrypted with your password.
That's everything.
The safety-report flow described below is a separate, explicit exception: it sends only the report package you review and choose to submit. Operating systems, networks, websites you contact, and third-party apps you deliberately hand data to may process their own connection metadata under their own policies.
The relay server — what it knows and what it doesn't
When you use the online version and add friends online, WhatDate uses a small relay server to help your phones find each other and deliver encrypted messages when you are apart. Here is exactly what the relay handles:
What the relay holds:
- A pseudonymous installation ID for your WhatDate installation (not intentionally tied by WhatDate to your phone number, email address, contacts, or real name).
- Your handle, if you chose one (e.g.
@alex). For ordinary friendship routing, this is a human-readable field; an explicitly submitted safety report has the separate human-readable fields described below. - Public cryptographic keys, so your friend's phone can encrypt messages that only your phone can open.
- Encrypted message blobs in transit — sealed on the sender's phone, unsealed only on the receiver's phone.
- Opaque IDs that link two friends' installations for delivery routing.
- For an online invite link you share: the link's public part (its opaque IDs, your signed public key bundle and its expiry), kept under a short code so the link can be short. The secret that lets someone accept the invite is never sent to the relay; it stays in the link itself.
- Technical records needed to run and secure the relay: a log of operations (what kind, which installation ID, which opaque record, and when), rate-limit counters, message timing, size and count, and the network information any server sees, such as the IP address of a connection. The relay's database does not store IP addresses.
What the ordinary friendship relay never holds in readable form:
- Your name, photo, or profile.
- Your ordinary reminders — their titles, notes, dates, times, tags, attachments, or any content. The only exception is content you separately and explicitly select for an abuse report, as described below.
- Your phone number, email address, contacts, or real-name identity supplied by WhatDate. The server can still receive ordinary network metadata such as the source IP address of a connection.
- Your private encryption keys. They are never sent to the relay or to friends. The only copy that ever leaves your phone is inside a password-encrypted backup you make yourself.
How long things stay:
- Encrypted messages: the encrypted contents are erased as soon as the receiver's phone picks them up. A small delivery record without the contents (opaque IDs and times) is kept for 7 days so a message is never delivered twice. Uncollected messages expire and are deleted within 24 hours.
- Invites you create: deleted 7 days after they expire if no one used them.
- A short invite link's public part: deleted as soon as the invite is used or expires, and never kept longer than 24 hours. Opening a short link asks the relay for that public part once; the relay keeps no access log.
- The operations log: 30 days. Records that stop one request being applied twice: 2 days.
- Friend request records: expire within 30 days unless a specific abuse/security/legal-preservation reason requires the relevant record to be retained longer.
- Active friendship routing/key records: remain while the friendship is active because the relay needs them to route and authenticate encrypted traffic.
- Revoked friendship rows: the full routing record is retained for 30 days after revocation, then deleted. A one-way SHA-256 reservation of each random relationship/mailbox ID remains to prevent ID reuse; it contains no peer bundle or routing metadata.
- Handles: stay active while you use WhatDate; released if unused for 180 days, then held in a 30-day anti-impersonation quarantine before anyone else can take them.
- Preservation holds: an operator can hold one exactly identified record for an abuse, security, or legal reason, which delays its deletion for at most 180 days per hold.
- Server logs: the web server in front of the relay keeps no access log. Its error log, which can include the IP address of a connection that caused an error, is deleted after 14 days. The relay's own service log records only the kind of request and its result — no IP addresses or IDs — and is kept for 7 days.
Reports and blocking
You can choose to submit a safety report about a friend, request, or received WhatDate. Before an Online report is sent, WhatDate shows the report package for your review. It contains the category you choose, your optional note, the sender's cryptographic DID and handle when available, a reference ID and timestamp when available, and only the WhatDate title, statement, and date if you separately check the evidence option. Nothing else from your reminders, contacts, or friend list is attached. The report is not end-to-end encrypted: authorized relay operators can read the submitted report package to review it. Reports and selected evidence are stored separately from encrypted delivery and ordinarily deleted 180 days after receipt, unless an exact, documented preservation hold applies.
Online report submission happens only when you confirm it while WhatDate network access is allowed. With Offline only enabled, or in the Offline build, WhatDate does not upload or queue the report; it offers a system chooser so you can decide whether to send the report text through another app. That app and its recipient then handle it under their own policies. Opening the chooser does not submit a report to WhatDate.
Blocking is a separate choice from removing a friend. It blocks that cryptographic identity from future local intake and, in Online mode when allowed, asks the relay to stop routes it can enforce. It cannot erase content already delivered to another device. A single report does not automatically ban another user's account; service-wide restrictions require human review.
For ordinary friend delivery, the relay is a blind postman: it carries sealed reminder envelopes without reading their contents. The relay still sees the limited routing and connection metadata described above. WhatDate does not intentionally build a phone-number/email/real-name directory that maps those pseudonymous IDs to a civil identity.
What is never shared
Some things are local-only by design and are never included in anything shared, even when you share the reminder they belong to. All of them are included in your own password-encrypted backups (section 6), which go only where you choose:
- Reminders marked Private. These are never put into any share, any invite, or any transfer to a friend.
- Files and locations you attach to a reminder, and the photos on a Private reminder. These stay on your device and are never sent to friends. Photos on a Friends or Public reminder go with it only when it is shared (sections 1 and 2), as a smaller copy without location data. (Attachments are included in your own encrypted backups, which go only where you choose.)
- Your notes about who shared what with you, and your reminder history.
Permissions, and what each is for
The table lists Android permissions; iPhone permissions are in "On iPhone" below.
| Permission | Why WhatDate asks |
|---|---|
| Notifications | To show your reminders when they are due. |
| Alarms & reminders | To go off at the exact time you set, even when the phone is idle. |
| Full-screen alarms | To display urgent or private alarms over the lock screen like an incoming phone call. |
| Start at boot | To put your reminders back in place after you restart your phone. |
| Run in the background | To keep a nearby sync with a friend going while WhatDate is not on screen. A notification shows while it runs. |
| Keep the phone awake | Briefly, so a reminder fires and a nearby sync finishes while the screen is off. |
| Ignore battery optimizations | WhatDate asks you to exempt it, so Android doesn't delay or stop its reminders. Nothing is sent because of it. |
| Bluetooth & nearby Wi-Fi | To hand WhatDates to a friend's phone directly when you are together. |
| Network & Wi-Fi state | Nearby sharing needs to see and switch Wi-Fi connections to reach a friend's phone directly. The online version also checks for a connection before sending a waiting delivery. |
| Location | Only because Android requires it to scan for nearby devices over Bluetooth. WhatDate does not read, use, or store where you are for this. You can separately attach a location to a reminder yourself — that stays on your phone. |
| Camera | To scan a friend's QR code, and to take a profile photo, if you choose to. The code is read on your phone. |
| Microphone | Only while you are using the voice button. |
| Music & audio (older phones: storage) | Only when you pick a reminder sound yourself. Photos you attach are chosen through Android's photo picker, which gives WhatDate only the photo you pick. |
| Fingerprint / face | Only if you turn on Biometric app lock, to unlock the app. |
| Internet (online version only) | See below. |
The two versions of WhatDate
There are two builds of this app:
- The offline version has no internet permission at all. Android itself will not let WhatDate open a network connection, whatever the app tries to do. Link previews and Online Friends do not exist in it. Friends you add in person share phone-to-phone over Bluetooth/Wi-Fi.
- The online version has internet permission, used for link previews and Online Friends. The first time you open it, WhatDate asks how you will share: Offline only - use nearby (selected unless you change it) keeps "Offline only" on; Online - over the internet turns it off. You can change this at any time in Settings → Offline only. With Offline only on, WhatDate's online activity is paused. The one exception is a handle Claim or Check you tap yourself (described above): it connects once, for that action only. Direct friendships still work phone-to-phone; online friends you already have are kept and their relay requests/updates remain paused until you enable online activity.
On iPhone
The iPhone app follows this policy, with these differences:
- No nearby radio sharing. You add friends with a QR code or an invite link, and share WhatDates as signed files through the apps you choose.
- Online Friends is not available on iPhone yet, and neither is claiming a handle. The iPhone app does not contact WhatDate's relay.
- Voice input is recognised on the iPhone itself. If on-device recognition is not available, voice input is off; your audio is never sent anywhere.
- Backups. WhatDate's data is excluded from iCloud and device backups, and its keys stay in this iPhone's Keychain. The only backups are the password-encrypted files you make yourself.
- Permissions are asked only when you use the feature: notifications (reminders), alarms (Private reminders that ring like an alarm), camera (photos for reminders), microphone and speech recognition (voice input), and Face ID (App lock).
Children
WhatDate is not aimed at children under 13. It does not require a phone number, email address, contact upload, or real-name registration. Online Friends nevertheless processes the limited pseudonymous/technical records described in this policy.
Your rights, and deleting your data
Your local reminders remain under your control:
- To see it: open the app.
- To delete one local item: delete it in the app. Deleted items sit in Recently Deleted for 30 days so you can undo a mistake, then they are permanently removed from this installation.
- To delete local app data: uninstall WhatDate. That removes the app's data from your phone. Any backup files you saved yourself, including automatic backups, will still exist wherever you put them — delete those separately if you want them gone.
- To release your handle: use the handle release control. The handle enters the documented quarantine before it can be reused.
- If you uninstall: Android removes WhatDate's local app data, but uninstalling does not send a reliable deletion signal to the relay. Relay records follow the retention periods above; an abuse report you submitted is ordinarily retained for 180 days unless a specific preservation hold applies. An inactive handle can lapse after 180 days under the current design.
- For relay-data/privacy questions: contact contact@whatdate.app. The current handle is an installation-bound pseudonymous identity, not a phone/email/password account.
WhatDate cannot remotely erase WhatDates or other material already delivered to another person's device, copied, exported, screenshotted, backed up, or retained by an offline/modified client.
Third-party components
WhatDate includes standard software libraries for things like QR codes (ZXing), encryption (Google Tink), the encrypted database (SQLCipher), and Android's own Jetpack libraries for the camera, storage, and background work. These run entirely on your phone. None of them collect data about you or send anything to their makers.
Nearby sharing, optional Google Play ratings, and update-availability checks rely on software outside WhatDate. For nearby sharing, Google Play services, part of Android on most phones, carries out Nearby Connections. Google says it collects usage statistics for Nearby Connections — connection speed and reliability, together with your device model, country, Android build, and the name of the app using it — to improve the service, and that you can control this in your phone's Settings → Google → Usage & diagnostics. Google describes these as performance details, not the content you send. This applies to both versions of WhatDate, because Google Play services is a separate part of your phone with its own internet access, governed by Google's privacy policy.
Ratings (Online version installed from Google Play). Now and then WhatDate may ask Google Play to show its rating sheet. Google Play draws it, and any rating or review you give goes to Google under Google's privacy policy. WhatDate receives nothing back, not even whether the sheet appeared. The Offline version does not include this.
Update checks (Online version installed from Google Play). At most once a day while you are using Home, WhatDate may ask Google Play whether a newer version of WhatDate is available. Google Play receives the ordinary app/package and device information needed to answer that request under Google's privacy policy. WhatDate does not send your reminders, profile, friends, or other WhatDate content. If an update exists, WhatDate shows an Update app now / Later prompt; choosing Update app now opens the WhatDate listing in Google Play. The Offline version does not include this check.
WhatDate contains no analytics, no crash reporting, and no tracking libraries of any kind.
Changes to this policy
If this policy changes, the "Last updated" date at the top will change with it. If we ever change what leaves your phone, whether your WhatDates or Friends connection data, we will say so plainly here rather than burying it.
30 October 2026: photos attached to a Friends or Public WhatDate now go with it when you share it, so it can arrive as an invitation. They are sent as a smaller copy with location data removed; photos on a Private WhatDate, files and locations still never leave your phone. The copy inside the app (Settings → Privacy Policy) and the public copy are made from the same text, and a release is not built while they differ.
31 October 2026: an online invite link can now be shared as a short link. To make that possible, the relay keeps the link's public part (opaque IDs, your signed public key bundle and the expiry, which anyone you send the link to could already see) under a short code until the invite is used or expires, at most 24 hours. The secret in the link is not sent to the relay. Opening a short link makes one request to the relay, only while Offline only is off.
Contact
Questions about this policy: contact@whatdate.app