Privacy policy
Last updated: May 29, 2026
This Privacy Policy describes how IRL APPS SAS collects, stores, uses, and shares the personal data of users of the WhoLiked mobile application ("the App" or "the Service"), available on the Google Play Store and the Apple App Store.
By using the Service, you agree to the terms of this policy. We update this policy from time to time. If we make significant changes, we will notify you via the App and, where applicable, seek your renewed consent.
1. Data Controller
IRL APPS SAS
35 rue du Sentier, 75002 Paris, France
Contact: support@irl-apps.com
2. Data Collected and Purposes
a. Data You Provide Directly
| Data | Purpose | Legal Basis |
|---|---|---|
| Name, email address, profile picture (when signing up via Apple, Google, or email) | Account creation and management | Performance of contract |
| Authentication tokens | To allow you to log in (we do not collect or store your passwords) | Performance of contract |
b. TikTok Integration Data
If you choose to sync your TikTok account, we collect:
| Data | Purpose | Legal Basis |
|---|---|---|
| Profile picture, username, unique ID, follower count, following count, video count, total likes | Profile display and game functionality | Performance of contract |
| List of videos you have liked, favorited, and reposted (date, CDN link, video statistics) | Game mechanic: allowing your friends to guess which liked videos are yours | Performance of contract |
We only access data you explicitly authorize and we do not collect your TikTok login credentials. This data comes from your TikTok account and is obtained with your explicit authorization at login.
c. Automatically Collected Data
| Data | Purpose | Legal Basis |
|---|---|---|
| IP address, OS, device model, OS version, technical identifiers | Security, fraud prevention, debugging | Legitimate interest |
| Usage events (interactions, session duration, feature usage) via PostHog and Firebase | Performance measurement, product improvement | Legitimate interest |
| Crash reports and technical error data via Sentry | App stability, bug detection and fixing | Legitimate interest |
| Final scores, number of games played, friendships in the app | Game history, leaderboards, social features | Performance of contract |
| In-game data (PIN, votes, guesses, results) | Maintaining game experience and fair play | Performance of contract |
| Subscription and billing data via RevenueCat | Subscription management and accounting compliance | Performance of contract + legal obligation |
d. In-App Advertising (AdMob)
WhoLiked displays ads to non-subscribed users via Google AdMob (app open ads, interstitials, rewarded ads). AdMob may collect certain personal data (advertising identifiers, IP address, usage data) to personalize ads and measure their performance.
Before any ad is displayed, your consent is collected via our Consent Management Platform (AdMob UMP), in accordance with the Transparency and Consent Framework (TCF). This choice is collected once at the first launch of the application. It can be reset by uninstalling and reinstalling the application.
If you decline, non-personalized ads may still be shown.
| Data | Purpose | Legal Basis |
|---|---|---|
| Advertising ID (IDFA/GAID), IP, usage data | Ad display and personalization, performance measurement | Consent |
e. Advertising Data (TikTok SDK)
We use the TikTok SDK to measure the performance of our advertising campaigns. Data shared with TikTok is limited to necessary events (install, open, conversion).
3. Game Data: Privacy by Design
Data exchanged during a game session (PIN, votes, guesses, TikTok data used during the game) is stored in RAM only and is automatically deleted at the end of the game. It is never saved on our servers.
However, some aggregated data is retained on your profile after the game: final scores, number of games played, and friendships with other players. This data is linked to your account and deleted when you delete your account.
4. Data Retention
| Data | Retention Period |
|---|---|
| Game data (PIN, votes, guesses) | Deleted immediately at the end of the game |
| Account data (email, profile) | Until account deletion |
| TikTok profile data (username, ID, statistics) | Until account deletion |
| Scores, games played, friendships | Until account deletion |
| Analytics data (PostHog) | Retained in pseudonymized form; link broken upon account deletion |
| Billing data (RevenueCat) | In accordance with accounting obligations (up to 10 years) |
| Crash reports (Sentry) | 90 days, then automatically deleted |
5. Sharing Your Data
We do not sell your personal data.
| Processor | Role | Data Location |
|---|---|---|
| Google AdMob (Google LLC) | In-app advertising (app open, interstitials, rewarded ads) | United States |
| Firebase (Google LLC) | Authentication, profile storage, scores and friendships | EU (eur3 — Belgium, Netherlands, Finland) |
| PostHog | Product analytics (self-hosted) | EU (United Kingdom) |
| RevenueCat, Inc. | Subscription and billing management | United States |
| Sentry | Crash reports and technical stability | EU |
| TikTok (ByteDance Ltd.) | TikTok data API + advertising SDK | United States / Singapore |
6. International Data Transfers
Most of our processors store your data within the European Union. RevenueCat and TikTok are based outside the EU. For these transfers, we implement Standard Contractual Clauses (SCCs) from the European Commission.
7. Your Rights
Under GDPR, you have the following rights:
- Right of access: obtain a copy of the data we hold about you
- Right to rectification: correct inaccurate data
- Right to erasure: request deletion of your data
- Right to restriction: restrict the use of your data
- Right to object: object to processing based on legitimate interest
- Right to portability: receive your data in a structured format
- Right to withdraw consent at any time
Contact: support@irl-apps.com — We will respond within one month.
Right to lodge a complaint: you may lodge a complaint with the CNIL: www.cnil.fr
8. Mandatory Nature of Data
Providing the data mentioned in this policy is necessary for the App to function. Without this data, you will not be able to use WhoLiked.
9. Security
- All transmissions are encrypted via HTTPS/TLS
- Access to user data is restricted to authorized team members
- Access tokens are stored locally on your device in a secure manner
- Sensitive data is pseudonymized in our analytics systems
- Monitoring and alerts via Sentry
10. Minimum Age
The App is intended for users aged 13 and over. We do not knowingly collect data from children under 13.
11. California Residents
If you are a California resident (CCPA):
- Right to know what data we collect
- Right to request deletion of your data
- Right to opt out of the sale of your data (we do not sell your data)
- Right not to be discriminated against
Contact: support@irl-apps.com
12. Policy Updates
The most recent version will always be available in the app. We will notify you of any significant changes.
13. Contact Us
Email: support@irl-apps.com
Address: IRL APPS SAS — 35 rue du Sentier, 75002 Paris, France