WhoWears Privacy Policy

Effective Date: September 8, 2026 Last Updated: October 12, 2026

1. The Short Version

The WhoWears iPhone app has no accounts. You are never asked for a name, an email address, or a password in the app, and there is nothing in the app that could hold one. The website's optional feedback board uses a browser key to recognize your guest activity, as described in Section 7.

The roster lives on your phone and lookups happen there. Typing a number, or saying it, reaches no server at all. The app talks to our servers only to fetch and update squad data, and to send a problem report if you write one.

Subscriptions are bought through Apple, and managed for us by RevenueCat, which knows your purchases and a random ID, never your name, email, or payment details (Section 3.4).

2. What Stays on Your Phone

The app keeps the following in its own storage on your device. None of it is sent to us.

• Squad data — rosters, fixtures, statistics, and player photographs for the teams you follow.
• Your settings — your starred teams and your preferences.
• Your leagues and plan — the leagues you picked and a random ID for your subscription. These are also saved in your own iCloud account, so they come back if you reinstall or use another device. We can't read your iCloud.
• A local usage log — used to tune how the keypad feels. It holds no personal information and is never sent anywhere.
• An app verification key — see Section 3.

Deleting the app removes all of it, except your leagues and subscription ID, which stay in your iCloud account so a reinstall gets them back. The app can also clear its stored data from Settings.

3. What Reaches Our Servers

3.1 Squad Data Requests

The app downloads squad data from our servers. Those requests carry no account and nothing else identifying you.

3.2 Device Attestation

The app uses Apple App Attest to prove it is a genuine copy of WhoWears, so our content goes to the app and not to scrapers. This creates a key on your device that is used for that purpose only. Deleting the app discards it.

3.3 IP Addresses

As with any internet request, our servers see the IP address you connect from. We use it briefly to limit abuse, and our infrastructure provider handles it as part of delivering and protecting the service.

3.4 Purchases (Apple and RevenueCat)

Subscriptions are sold and billed by Apple through the App Store. We never see your payment details, name, or Apple ID.

RevenueCat (RevenueCat, Inc.) manages subscriptions for us. It receives your App Store purchase history for WhoWears and the random ID described in Section 2, never your name or email. We use it to know which plan is active.

4. Voice Lookups

Holding the microphone key runs speech recognition entirely on your device.

• Audio never leaves your phone, and is never saved. Only the recognized number is used, and only to perform the lookup.
• If your device or language cannot recognize speech on-device, the microphone key is hidden rather than falling back to a server.
• The microphone is live only while you hold the key.

5. Problem Reports

If you use "Something wrong?" to report an error, we receive your message and what you were looking at. It carries no name, email address, or device identifier, so we have no way to reply to you.

Reports are stored so we can correct the data.

6. Diagnostics and Product Analytics

The app reports problems and usage to two services.

6.1 Crash and Error Diagnostics (Sentry)

We use Sentry (Functional Software, Inc.) to learn when the app crashes or something fails. A report holds technical details about the failure, such as an error code and the app and iOS version. It never includes your identity or what you said or typed.

6.2 Product Analytics (PostHog)

We use PostHog to see how the app is used: which features people use, whether a lookup found a player and how long it took, where people stop in the introduction, and how the plans screen performs. Each record is tied to a random identifier created on your device, not to you. A lookup record includes the jersey number and the team and player involved. A purchase record never includes a price, a receipt, or anything about your Apple ID.

The app sends only a fixed list of fields and discards everything else before sending. It never reads your Apple ID, advertising identifier, or device serial number. Automatic capture, session replay, geographic lookup, and personal profiles are all disabled.

6.3 No Tracking

WhoWears does not track you across apps or websites and uses no advertising identifiers. Nothing is shared for advertising.

7. The Website

Most of whowears.app consists of static pages. It loads no advertising scripts.

Two Google services are involved, both governed by Google's own privacy policy:

• Google Analytics shows us which pages people visit. It uses cookies and receives usage and connection data, including an approximate location from your IP address. It covers the website, not the app.
• Google Fonts supplies the typefaces, so your browser contacts Google to load them.

The optional /fni/ page embeds a trial feedback board run by UserSignal. You can post suggestions, comment, and vote without an account. What you submit goes to UserSignal, along with normal connection data, and may appear publicly once reviewed. Your browser stores a random key so the board can recognize you and let you use its Download my data and Erase my activity controls. The board uses Cloudflare Turnstile to guard against abuse. Please avoid including sensitive personal information in feedback.

8. Who Else Sees Anything

• Cloudflare — hosts and delivers our content and website, and therefore processes connection data including IP addresses.
• UserSignal — hosts the optional feedback board and processes the guest activity described in Section 7.
• Google — receives website usage data through Google Analytics and font requests through Google Fonts, as described in Section 7. Neither applies to the app.
• Apple — distributes the app through TestFlight and the App Store, sells and bills subscriptions, stores your league picks in your iCloud account, operates App Attest, and provides on-device speech recognition. Apple's own collection through TestFlight and the App Store is governed by Apple's privacy policy, not this one.
• RevenueCat — manages subscriptions, and receives the purchase history and random app user ID described in Section 3.4.
• Sentry and PostHog — the data described in Section 6.

Squad data flows toward you: our data providers receive nothing about you, because the app never contacts them. We do not sell personal data, and we do not share it for advertising.

We may disclose information if required by law or valid legal process.

9. Retention

• Data on your device stays until you delete it or the app clears a roster you have not used in a long time.
• Problem reports are kept while they are useful for correcting the data.
• IP-based abuse records and server logs are short-lived.
• Google Analytics keeps website usage data for a limited period.
• Feedback board activity stays until you erase it or a moderator removes it.

10. Your Choices

Because we hold no account for you, most control sits on your device:

• Clear the app's stored data from Settings, or delete the app to remove everything on the phone, including its attestation key.
• Deny or revoke microphone and speech-recognition permission in iOS Settings; the rest of the app works without them.
• Choose not to send problem reports. They're only sent when you write and submit one.
• Block or clear cookies in your browser, or install Google's Analytics opt-out add-on, to keep your website visits out of Google Analytics. The website works the same either way.
• On the feedback board, use Download my data or Erase my activity while this browser still holds your guest key. Clearing the key alone does not erase your contributions.

If you believe we hold information about you and want to ask about it, write to support@whowears.app. Be aware that with no account and no identifier tied to you, we may be unable to locate anything. For anything about your subscription, include the ID from Settings › Subscription.

11. Security

All network traffic uses HTTPS, and the app stores no password or account secret. No system can guarantee absolute security.

12. Children

WhoWears is not directed at children under 13, and we do not knowingly collect information from them. The app holds nothing that identifies a child. Please do not submit a child's personal information to the feedback board.

13. International

We operate from the United States, and our infrastructure providers process data in the United States and in other countries where they run their networks. By using the Service you consent to that processing.

14. Changes to This Policy

We may update this policy. The "Last Updated" date above reflects the most recent revision. If the app ever begins collecting something this policy does not describe, we will update it before that build ships.

15. Contact

Email: support@whowears.app