WhoHas — Privacy policy

1 Introduction

Whohas is a personal lending tracker app developed by an independent developer. It helps you keep track of items you have lent to friends, family, and colleagues — including what was lent, to whom, and when it is due back.

The short version: your data stays on your device. Whohas does not operate any servers, does not collect usage analytics, and does not sell or share your personal data. The only outgoing network activity is for in-app purchases (RevenueCat) and font loading (Google Fonts).

By using the App you agree to the practices described in this policy.

2 Data Stored on Your Device

All app data is stored locally on your device only in a SQLite database and the app’s local documents directory. None of this data is transmitted to our servers — we operate none.

Contact Information

When you add a person to the app, you may optionally enter their name, email address, phone number, notes, and a photo. This information is entered manually by you and is used solely to display lending records within the app.

Item Catalogue

Item name and category
Item description
Item photo (stored locally)
Date added to catalogue

Lending Records

Which item was lent
Who it was lent to
Date lent
Return deadline (optional)
Notification preferences per lending (stored locally)

Preferences

Language selection and date format preference are stored locally via the device’s standard SharedPreferences mechanism.

What We Do NOT Collect

Location data
Device or ad identifiers
Usage analytics
Crash reports
Browsing behaviour
Contacts from your address book
Biometric data
Any data via our own servers

3 Device Permissions

Permission	Why it is needed
Camera	To photograph items you are cataloguing or to take a portrait photo of a contact. The camera is only active when you explicitly open it within the app.
Photo Library	To let you choose an existing photo from your gallery for an item or contact. No images are uploaded anywhere.
Notifications	To deliver local return-date reminders you configure per lending record. All notifications are scheduled and fired entirely on your device — no push notification server or third-party messaging service is used.
Exact Alarm Scheduling (Android)	To ensure return-date reminders fire at precisely 9:00 AM on the scheduled day rather than being deferred by the system. Required on Android 12 and above for time-sensitive local notifications.
Receive Boot Completed (Android)	To reschedule pending local notifications after a device restart. No data is collected, processed, or transmitted during this process.
Internet	Required for in-app purchase verification via RevenueCat and for loading font files from Google Fonts at startup.
File Storage (Android)	To write and read the JSON backup file when you use the manual backup or restore feature. Files are saved to your device’s documents directory only.

You can revoke any permission at any time in your device settings. Revoking camera or photo library access disables photo features; revoking notification permission disables return-date reminders. The rest of the app continues to function normally in both cases.

4 Local Notifications

How reminders work

When you lend an item and set a return deadline, you can optionally enable one or more reminders for that specific lending record. The available reminder types are:

Day before return — a reminder the day before the deadline
Day of return — a reminder on the day the item is due back
Overdue nudge — a follow-up reminder 3 days after the deadline has passed

All reminders fire at 9:00 AM local time on the scheduled day. Your notification preferences are stored as part of the lending record in the local database on your device.

All notifications are local. Whohas uses your device’s built-in alarm and notification system exclusively. No push notification server, no Firebase Cloud Messaging, no third-party messaging SDK, and no network connection are involved in delivering reminders. Notification scheduling data never leaves your device.

What notification content contains

Each notification contains only the item name and the borrower’s first name — both of which are data you entered into the app yourself and which are stored locally on your device. No other data is included in notification content.

Rescheduling after device restart

On Android, the app listens for the device boot event solely to reschedule pending local notifications after a restart. No data is collected, processed, or transmitted during this process.

Cancellation

Notifications for a lending record are automatically cancelled when you mark the item as returned within the app. You can also adjust or disable notification preferences for any lending record by editing it, or revoke notification permission entirely in your device settings at any time.

5 Third-Party Services

Whohas integrates two third-party services. No other SDKs, analytics tools, or advertising networks are included.

RevenueCat (purchases_flutter SDK)

Used to process and verify the one-time “WhoHas Plus” in-app purchase. RevenueCat receives an anonymous app user ID and purchase or entitlement data sufficient to confirm your purchase status. RevenueCat does not receive your name, contact list, items, lending records, or notification data.

RevenueCat privacy policy: revenuecat.com/privacy

Google Fonts

The app loads the DM Sans typeface from Google’s font servers at startup. This request includes your device’s IP address and standard HTTP headers. No app data is included.

Google privacy policy: policies.google.com/privacy

Note: Google Sign-In and Google APIs are declared in the app’s dependency manifest but are not implemented or called in any version of the app. No Google account authentication occurs.

6 Backup & Restore

Whohas includes a manual backup feature that exports all your data (items, contacts, lending records, and notification preferences) as a single JSON file saved to your device’s local documents directory.

The backup file stays on your device unless you choose to share it via the OS share sheet (for example, by emailing it to yourself or saving it to a cloud drive of your choice).
We never receive, access, or store backup files.
You can restore a previous backup at any time from within the app, which will replace the current local database.

If you share a backup file via a third-party service (e.g. iCloud Drive, Google Drive, email), that service’s own privacy policy applies to how they store and process that file.

We do not sell, rent, trade, or otherwise share your personal data with any third party, except as described in Section 5 (RevenueCat and Google Fonts) above, which is limited to what is technically necessary for those services to function.

We may disclose information if required to do so by law or in response to a valid legal request. Since we hold no user data on our servers, any such request would yield nothing on our end.

8 Data Retention

All data persists locally on your device for as long as you use the app or until you delete it:

Individual items, contacts, and lending records can be deleted at any time from within the app.
Pending notifications are cancelled automatically when a lending record is marked as returned or deleted.
All local data is permanently removed when you uninstall the app.
RevenueCat retains purchase records according to their own retention policy. Your Plus entitlement status can be restored at any time using the “Restore purchase” option in the app.

9 Your Rights

Because we do not collect or hold personal data on our own servers, many standard data rights (access, rectification, portability, erasure) are exercisable directly within the app itself — you are in full control at all times:

Access & export: use the Backup feature to export all your data as a JSON file at any time.
Edit: all contacts, items, and notification preferences can be edited directly within the app.
Delete: individual records can be deleted from within the app; all data is erased on uninstall.
Notifications: notification preferences can be changed per lending record at any time, or disabled entirely by revoking notification permission in your device settings.

If you are located in the European Union, you have rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA). In both cases, since we hold no data on our end, your primary point of control is the app itself.

For any questions about data held by RevenueCat or Google, please contact those providers directly through their respective privacy portals.

10 Children’s Privacy

Whohas is not directed at children under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal data from children. The app performs no age verification, but its purpose — tracking borrowed personal belongings — is intended for an adult audience.

If you believe a child has entered personal information of others through the app, you can delete that data directly within the app or by uninstalling it.

11 Security

Because all data is stored locally on your device and no data is transmitted to our servers, the primary security layer is your device’s own security model — screen lock, device encryption, and operating system sandboxing.

Photos you take or select within the app are stored in the app’s sandboxed documents directory, which is not accessible to other apps. We recommend keeping your device’s operating system up to date to benefit from the latest security patches.

12 Changes to This Policy

We may update this Privacy Policy as the app evolves or if legal requirements change. Any changes will be reflected on this page with an updated effective date.

If we introduce data collection practices that are materially different from those described here, we will notify users through an in-app notice or through the app store update notes, and where required by law, obtain your consent before proceeding.

13 Contact

Questions, concerns, or requests regarding this Privacy Policy? Please get in touch:

✉ neywa.blake@gmail.com

Whohas · Independent developer · Czech Republic

This policy applies to the Android and iOS versions of the app.