Privacy Policy

Version privacy.v1 · effective 2026-09-28 · WhoIsThis.online is operated by ABFS Inc. (“we”). This policy covers the Android app online.whoisthis.whoisthis, the API at api.whoisthis.online, and this website.

1. The short version

• Your People Library — the people you save, their face samples, labels, notes, encounters, and the face templates your phone computes — stays on your phone. We never receive it, and it is excluded from cloud backup.
• On-phone recognition works fully offline and sends nothing.
• Only when you start an online lookup does your phone send a temporary face crop or scene to our API, which passes it to third-party search and AI suppliers for processing and deletes the temporary image afterwards.
• We keep job, billing, and audit records about your account; we keep anonymous public search results returned by suppliers; we do not cache research about named people.
• You can delete your account from the app at any time.

2. Data that never leaves your phone

Camera frames, the photos you pick, detected faces, the people you save, their labels and notes, encounter history, and locally computed face templates are processed and stored only on your device, in the app's private storage. The app performs face detection, quality checks, the age safeguard, cropping, and local matching on the device. None of this is uploaded, and no analytics or advertising SDK is included in the app.

3. Data sent when you run an online lookup

An online lookup is started only by your explicit action (or by an automatic session you have switched on for a face you targeted). For each lookup your phone sends:

• a cropped face image, or an unredacted scene with the people visible in it and the metadata your camera stored with it (for example capture time, orientation, or location);
• your signed attestation that you accepted the current terms and camera notice and are authorized to use that camera or photo source;
• a non-secret idempotency key so that one lookup is charged once.

Our API forwards the image to third-party suppliers for three purposes only: a reverse face search across publicly available web pages, visual geolocation of the scene, and research of publicly available information about the people found. Suppliers act as our processors; they are not named in the app. The temporary image is deleted from our servers after processing, and the reverse-face-search supplier deletes its copy after the search. We never derive or store a face template from your private photo on the server.

4. What we store on our servers

Account

A random account id, the public half of the key your phone generated, the terms version you accepted, your language, and a push token when the app registers one for notifications. No name, e-mail, or phone number is required.

Lookups

Job state, timestamps, attempt counts, error codes, the hedged result cards we produced, and the supplier calls made — kept for billing, dispute handling, retries, and abuse prevention.

Anonymous public results

Public web results returned by the reverse-face-search supplier (URLs, scores, thumbnails, and a template derived only from the supplier's public thumbnail) are kept without any link to an account so that the same public face does not trigger a repeated paid search. They are removed on an accepted opt-out or confirmed source removal.

Research

Research about named people is not cached; it is redone from current sources on every lookup and delivered with citations and retrieval times.

Billing

Payments are processed by Stripe. We store Stripe customer, subscription, and payment identifiers and a credit ledger. We never see your card number.

5. Permissions

• Camera — live recognition of people you have saved and, on request, online lookups. Still photos work without it.
• Internet — online lookups and billing.
• Notifications — one rich notification per recognition, updated in place as evidence arrives; optional.

The app does not request location, contacts, microphone, or storage permissions.

6. Retention and deletion

Deleting your account in the app revokes access immediately, cancels active work, and purges per-account server data within 30 days. We keep only billing, dispute, minimal anti-abuse, and deletion-audit records for the periods required by law and by our payment processor. Your phone's People Library is never erased remotely; the app offers a separate local erase.

7. People who appear in results

Anyone may ask to be excluded from online lookups or dispute a result at whoisthis.online/opt-out. An accepted request stops future lookups for that face before any search runs and purges the anonymous public results we hold about that person.

8. Children

The app is for adults (18+). If the on-device check cannot confirm that a person is an adult, no online search runs until the user confirms, for that face, that they are authorized to run the search and accept responsibility for proceeding.

9. Where data is processed

Our API and database are hosted in the United States; the website is served through a global edge network. Suppliers may process the temporary image in other countries. Transfers rely on the suppliers' standard contractual terms.

10. Changes and contact

A new version of this policy is published at its own URL and presented in the app. Questions or requests: support.