This Privacy Policy explains what personal data GWIA ("we," "us," or "our") collects, how we use it, how long we keep it, and what rights you have. By using the GWIA mobile application, you agree to the practices described here. Our data infrastructure is hosted at Supabase (EU-West-1, Frankfurt).
GWIA is strictly for users aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you may not create an account or use the app. If we become aware that a user is under 18, we will immediately suspend their account and delete all associated data.
• Gender (for question defaults — not displayed to others) • Age (exact, private — used only for accuracy scoring of evaluators) • Occupation category (private — used only for accuracy scoring) • Country of origin (private — used only for accuracy scoring) • City (private — used only for accuracy scoring) Important: This profile information is never shown to other users. It exists solely to calculate how accurately other users guessed about you.
When you submit a photo for evaluation, that photo is stored on our servers. Photos may contain biometric data (facial images). Under EU GDPR, facial images that allow identification of a natural person are classified as biometric data — a special category requiring explicit consent. By uploading a photo, you explicitly consent to: • Storage of your photo on our servers in Frankfurt, Germany (EU) • Your photo being shown anonymously to other GWIA users for structured evaluation • Aggregated, anonymized results from those evaluations being shown to you Individual evaluators' answers about your photo — their specific guesses, ratings, and comments — are never shown to any other user, and are never linked to the evaluator's identity when shown to you. Only you see the combined results, and only in aggregated form.
• Device type and operating system version • App session timestamps • Evaluation activity (questions answered, points earned) • Crash logs and performance data We do not use advertising trackers. We do not share usage data with third-party advertisers.
Profile data (age, occupation, origin, city): Used exclusively to calculate evaluator accuracy scores. Never shown to other users. Never used for profiling, advertising, or third-party data sharing. Photos: Stored and displayed anonymously to other users for structured question-based evaluation. Used to generate your impression profile and trend data. Usage data: Used to improve app performance, prevent abuse, and calculate ranking and badge systems.
Photos: Retained for as long as your account is active or until you delete the individual photo. Deleted photos are removed from our servers within 30 days. Account deletion: When you delete your account, all of the following are permanently deleted within 30 days: your profile information, all photos you uploaded, all evaluation data linked to your account, your points and badge history. Evaluations you gave others: Your anonymous evaluation responses (e.g. age guesses, mood choices) may be retained in aggregated form for accuracy statistics but cannot be linked back to your identity after account deletion. We do not sell, rent, or trade your data to third parties.
For users in the European Economic Area (EEA), we process your data under the following legal bases: • Explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) — for photo upload and biometric data processing • Contract performance (Article 6(1)(b)) — for account management and app functionality • Legitimate interests (Article 6(1)(f)) — for fraud prevention and security You may withdraw your consent at any time by deleting your photos or your account. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
You have the following rights regarding your personal data: • Right of access — request a copy of the data we hold about you • Right to rectification — correct inaccurate profile data • Right to erasure ('right to be forgotten') — delete your account and all associated data • Right to restriction — request we limit processing of your data • Right to data portability — receive your data in a structured, machine-readable format • Right to object — object to processing based on legitimate interests To exercise any of these rights, contact us at privacy@gwia.app. We will respond within 30 days. If you are in the EU/EEA and believe we are not handling your data lawfully, you have the right to lodge a complaint with your local data protection authority.
Your data is stored on Supabase infrastructure in Frankfurt, Germany, which is certified to ISO 27001 and SOC 2 Type II standards. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We restrict access to personal data to employees and contractors who need it to operate the service. No third party has access to your photos or private profile data.
GWIA is not directed at children under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately at privacy@gwia.app and we will investigate and delete the account within 72 hours.
We may update this Privacy Policy as the app evolves. If we make material changes (especially to how we handle photos or biometric data), we will notify you via in-app notice at least 14 days before the change takes effect. Continued use after notification constitutes acceptance.
For privacy questions, data requests, or to report a concern: Email: privacy@gwia.app Operator: gwia.app Data location: Frankfurt, Germany (EU)
