WhoDis?WhoDis Privacy Policy
Draft of 22 October 2026, for review by a lawyer before publishing. Text in [square brackets] must be filled in. It describes the app as built: an 18+ game, guest play with no sign-up, avatars from a built-in set (no photos), no ads or purchases.
1. Who we are
WhoDis is a group chat party game published by Dezynum Software Services (OPC) Private Limited, [registered address], Gurugram, Haryana, India ("we", "us"). We decide how your personal data is used, which makes us the data controller under the EU and UK GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
This policy covers the WhoDis app and the server that runs online rooms. Practice mode, where the phone plays your friends, runs only on your phone; we never receive what you type there.
2. What we collect and why
There is no account and no sign-up. Online play uses a random guest identity that lives on your phone. There are no profile photos: you pick a nickname and an avatar from the app's own set.
| Data | Where it comes from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Random player ID | Created by our server the first time you play online | Recognise your phone between sessions and keep your seat if you drop out | Contract: providing the game |
| Nickname and the avatar you picked (its name in our set, such as "animals/fox") | You | Show you to the other players in your room | Contract |
| Chat lines, questions, answers and guesses in online rooms | You | Run the round and show it to the room | Contract |
| Game results and stats (which face you wore, points, right guesses, players fooled, unanswered questions) and the days you played online | Generated by the game | Scoreboards, your stats, keeping the service running | Contract |
| Reports you make, and reports made about you, with the room's last 50 messages | You and other players | Keep players safe, enforce the Terms | Legitimate interest in a safe community |
| Anonymous usage counts: a random ID that changes every day (so it cannot follow a phone over time), a first-open marker sent once per install, app opens, rounds played and how many players, app version and platform | The app, if "Share anonymous usage stats" is on (you can turn it off in settings) | See how many people play and which version they use | Legitimate interest |
| IP address and request details in server logs | Your phone, automatically | Security and abuse prevention | Legitimate interest |
Where we rely on legitimate interest, you can object (section 5) and we will stop unless we have a compelling reason, such as investigating a safety report.
Some things stay on your phone and never reach us: your answer to the age check (only a yes or no, never your birthday), the faces you have blocked, your practice games and settings.
3. What we never collect, who sees your data, and where it lives
We do not collect your real name, email, phone number, location, contacts, photos, microphone or camera, and we do not use advertising IDs. The app has no ads and no in-app purchases, uses no third-party analytics or crash-reporting service, and we never sell or rent personal data.
Chat is shown live to the room and is not stored, except the last 50 messages that are attached to a report when someone reports a player. During a round the server never tells anyone which player is behind which face; that is shown to the room only when the round ends.
Your data is seen only by:
- Other players in your room: your nickname and avatar, what you write (under the face you wear during a round) and, when the round ends, which face you wore, your guesses and your points.
- Our team: to run the service and review safety reports.
- Service providers acting on our instructions: Contabo GmbH, which hosts our servers in India; [backup storage provider], which stores encrypted backups in [country].
- Authorities: when Indian or other applicable law requires it, or to protect someone from serious harm, including reports of child sexual abuse material as our child safety standards describe.
Our servers are in India. If you play from the EU, UK or elsewhere, your data is transferred to India. We protect those transfers with the European Commission's Standard Contractual Clauses (and the UK addendum) with our providers, and with the security measures in section 7.
4. How long we keep it
We delete data automatically when it is no longer needed.
| Data | Kept for |
|---|---|
| Live room contents (faces, live chat, questions, guesses) | Until the room closes; chat is never stored |
| Chat attached to a report | With the report |
| Reports | 12 months after the report is closed |
| Profile (player ID, nickname, avatar), stats and days played | Until you delete them, or 24 months after you last played online |
| Game results | Kept; when you delete your data, your seat is renamed "Deleted player" so other players' history stays correct |
| Anonymous usage counts | 13 months |
| Server logs with IP addresses | 14 days |
| Backups | 14 days on our server; encrypted off-site copies 30 days |
If we have banned a player ID, we keep that ID (without the nickname) for as long as the ban lasts, so the same phone cannot simply rejoin.
5. Your rights
Wherever you live, you can ask us to:
- see the personal data we hold about you and get a copy (in the app: settings, then Your data, then Download my online data);
- correct it (change your nickname or avatar when you next join a room, or write to us);
- delete it (settings, then Your data, then Delete my online data, or follow https://whodis.weyug.com/delete-account if you no longer have the app);
- stop using it for a purpose based on legitimate interest (for usage counts, just turn off "Share anonymous usage stats");
- nominate someone to exercise these rights for you if you die or become unable to (India).
We reply within 30 days. You can also complain to your data protection authority: in the EU, the authority in your country; in the UK, the ICO; in India, the Data Protection Board of India once you have first raised the complaint with us.
6. Grievance Officer (India)
[Name], Grievance Officer, Dezynum Software Services (OPC) Private Limited, [registered address], email compliance@dezynum.com. We acknowledge complaints within 24 hours and resolve them within 15 days.
7. Security
All traffic between the app and our servers is encrypted (HTTPS and secure WebSockets). Your guest identity is a signed token that only our server can issue. Backups are encrypted before they leave the server. Only our team can reach the database, through SSH keys and a firewall. If a breach puts your data at risk, we will notify you and the relevant authorities as the law requires.
8. Age limit: 18 and over
WhoDis is for adults only. Hidden identities are the heart of the game, so it is not meant for anyone under 18, and Google Play does not offer it to users it knows are under 18. Before the first online game the app asks for a month and year of birth without saying which answer is needed, works out on the phone whether the player is 18 or over, and keeps only that yes or no on the phone. Nothing about age is sent to us. Anyone under 18 cannot play online on that phone. We do not knowingly collect personal data from anyone under 18; if we learn that someone under 18 played online, we delete their data. A parent can ask us to at compliance@dezynum.com.
9. Changes and contact
We will show a notice in the app at least 14 days before a material change to this policy takes effect. Questions: compliance@dezynum.com.
EU representative (required if we target players in the EU): [name and address]. UK representative: [name and address].