Privacy Policy

Someone is a private app for asking the people you trust for help. This policy explains what we collect, why, who can see it, and how to delete it. We wrote it to be read.

1. Who we are

Someone is operated by Mohammed Morchid Chellali, an individual (there is no company behind Someone yet), Frankfurt am Main, Germany (see also our Impressum). He is the controller of your personal data ("we", "us").

For privacy questions and data requests, write to privacy@needsomeone.app. For anything else: hello@needsomeone.app.

2. What we collect and why

We do not collect your precise location, health or financial data, advertising identifiers, or crash or analytics data. The city on your profile is free text you type.

3. Your phone's contacts

You can choose to add people from your phone's address book. We only access your contacts after you give the app permission, and you can turn that off at any time in your phone's settings.

Before we check anything, the app asks you. If you agree, it sends the phone numbers in your address book to our server once, to see which of those people already have a Someone account, so the app can mark them "On Someone". We use those numbers only for that check. We don't save them, we don't log them, and we don't use them to contact anyone. If you choose "Pick without checking", no numbers are sent for this check.

Nothing from your address book is saved until you pick people to add. For each person you pick, we save the name and phone number you chose and the trust level you set. This becomes part of your Circle, which only you can see. You can remove a contact at any time, and deleting your account deletes all of them. We never message or invite the people in your address book on our own, and we never sell or share your contacts.

If you have been added to someone else's phonebook, we hold your phone number and the name they gave you as part of their data. That name is private to them and is not shown to anyone else.

4. Who sees what

• Your Circle is private. Nobody can browse it, and nobody can see who else you know. Your phonebook, your private labels and your Lists are visible only to you. The existence of a List is never visible to the people on it.
• Asks are not public. An Ask reaches only the people you choose, by trust tier (Close, Trusted, Known), by extended reach if you pick it, or by direct assignment to named people. Strangers never see it.
• Hands are blind. People who offer help do not see each other. If you accept more than one, a Crew Reveal introduces them only if each person agrees.
• Chat is 1:1. Only the two people in a conversation can read it. We do not read your messages in the ordinary course of running the service. We see a message only if it is reported to us (the report includes a copy of the reported message), or where the law requires it.
• Reviews are private to the relationship, not a public rating.
• Blocking is mutual and silent: neither person can see the other, and the blocked person gets no notice.
• Feedback and reports are seen by us and by people we authorise to handle them.

Once something has been shown to someone, we cannot make them forget it. Deleting your account removes your content from the platform, but not what another person already read or remembered.

5. Who processes data for us

We use a small number of service providers who act on our instructions and may not use your data for their own purposes. [TO CONFIRM: data processing agreements signed with each provider below]

Apple (App Store, TestFlight) and Google (Play) process data under their own policies when you download or update the app.

We do not sell your data, and we do not share it with advertisers, data brokers or marketing partners. We may disclose data if the law requires it or to protect people from harm.

6. How long we keep data

• Your account data is kept while your account is active.
• Deleting your account is immediate and permanent. In the app, go to You → Account → Delete account and confirm. We delete your profile, phonebook, Asks, Hands, Words, reviews, reports and blocks you made, chat conversations, push tokens, photos (profile and Ask photos, including the stored files), feedback you sent (including screenshots), sign-in records and sign-in codes in one step. There is no soft delete and nothing to restore. If you cannot open the app, use our delete-account page and we will process your request within 5 business days after verifying it.
• Chat: a conversation is deleted when either participant deletes their account, including the messages the other person sent.
• Reports about another person stay on file after that person's account is deleted (including the copy of a reported message), so we can show we acted on them.
• Sign-in codes expire after 5 minutes and are stored only as hashes. Sessions end after 90 days without use, and are revoked when you sign out or delete your account. Expired codes and session records cannot be used again; they are stored hashed and removed when you delete your account.
• Server logs are limited to application and web-server logs. They are rotated by size (at most three files of 10 MB per service), so older entries are overwritten automatically. Web-server logs contain IP address, time, request line and browser or app identifier; they do not contain request bodies, so message text, phone numbers sent for the contacts check and other submitted content are not in them. Our application logs mask phone numbers and other identifiers. While SMS delivery is being set up, sign-in codes may be written to the protected server log instead of being sent by text message; they expire after 5 minutes either way.
• Waitlist emails: when you unsubscribe, we stop emailing you and keep only a note that you unsubscribed, so we don't contact you again. Ask us at privacy@needsomeone.app and we delete your address completely.
• Backups: we take a nightly database backup and keep each one for 14 days. Deleted data can remain in these backups until they expire, at most 14 days after deletion. [TO CONFIRM: whether backups are also copied off-server, and where]

7. Security

All traffic between the app and our servers uses HTTPS. Sign-in uses one-time codes, with rate limits and abuse controls on code requests. Sign-in codes and session tokens are stored hashed on our server. Session tokens are kept in your phone's secure storage and are rotated when refreshed. Access to the server is restricted to the person who operates it. Photos are checked and re-encoded on upload. No system is perfectly secure, and we cannot guarantee absolute security. [TO CONFIRM: disk / database encryption at rest on the server — not claimed until confirmed]

8. Children

Someone is for people aged 16 and over (or the age of digital consent in your country, if higher). It is not directed at children, and we do not knowingly collect data from anyone under 16. You confirm you are 16 or older when you accept our Terms. If we learn that a user is under 16, we will delete the account and its data. If you believe someone under 16 has an account, contact privacy@needsomeone.app.

9. Your rights

If you are in the EU, EEA or UK (and, in many cases, elsewhere, including California), you have the right to:

• access the data we hold about you and get a copy;
• correct it (you can edit your profile and phonebook in the app);
• delete it (in the app, immediately: see section 6);
• export it in a portable format (by email request; there is no in-app export yet);
• object to or restrict processing based on our legitimate interests;
• withdraw consent at any time (revoke contacts, photos or notification permissions in your phone settings; switch off feedback technical details; unsubscribe from emails). Withdrawal does not affect earlier processing;
• complain to a data protection authority. [TO CONFIRM: name of the competent authority for the operator's location]

To use any of these, write to privacy@needsomeone.app. We will answer within one month. We may ask you to confirm you control the phone number. We do not carry out automated decision-making that has legal or similarly significant effects on you.

10. International transfers

Our servers are in Germany. Some providers may process data outside the EU or EEA: Expo, Apple and Google (push notifications and app updates), Mailjet, Cloudflare and our SMS provider. Where they do, we rely on EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework. [TO CONFIRM: each provider's transfer mechanism, and whether the SMS route leaves the EU]

11. Changes to this policy

If we change what we collect or how we use it, we will update this page and the date above. For material changes, we will let you know before they take effect, for example in the app.

12. Contact

Mohammed Morchid Chellali, Frankfurt am Main, Germany
Privacy and data requests: privacy@needsomeone.app
General: hello@needsomeone.app
Legal operator details: Impressum