WhatsMyName: Username Search — Privacy Policy

Effective date: 4 October 2026
App: WhatsMyName: Username Search (Android, package whatsmyname.app.us)
Developer: Hadi Dev Lab
Developer contact: use Settings › Send feedback in the app. Email: hadi7786x@gmail.com.
Terms of Use: https://whatsmyname-app.vercel.app/terms

Summary

• No account, no scan server. You never sign up. Scans do not go through any server of ours, and we (the developer) never receive the usernames you type or the results you get.
• Scans run on your phone. Your phone contacts public websites directly to check whether a username exists there. Profiles you open are shown in the app's built-in browser (or your own browser, if you choose).
• The app shows ads from Google AdMob. To show and measure ads, Google's ad software in the app sends device information (such as your advertising ID and IP address) to Google. Where the law requires it (for example in the EEA, the UK and Switzerland), you are asked for consent first and can change your choice at any time in Settings › Ad privacy settings. Section 5 explains this in full.
• Free scans and rewards are counted on your phone only. Your daily scan count and any unlocks you earn by watching an ad are stored on the device and never sent to us.
• Crash reports are on by default; usage statistics are off. If the app crashes, a technical crash report goes to Google Firebase Crashlytics so we can fix it. You can turn this off at any time in Settings › Privacy & legal › Crash reports. Where Google's consent form is shown (for example in the EEA and the UK), crash reports stay off until you have answered that form, and they stay off if you decline (section 6).
• Push notifications are on by default. To deliver them, the app registers your device with Firebase Cloud Messaging and stores a notification token, a random anonymous ID, your app language and the app version in our Firebase database. You can turn notifications off in the app or in Android settings (section 10).
• Your agreement to the terms is recorded. When you accept the Privacy Policy and Terms of Use, the app saves which version you accepted and when, on your phone and, when Firebase is available, in the same anonymous device record, as proof of acceptance (section 10).
• Nothing is sold in the app at the moment. Purchases are not offered in this version. If optional purchases are offered in a future version, Google Play processes them and we never see your payment details (section 11).
• We receive feedback only if you send it. If you use Send feedback, we receive your message, plus your email address only if you type it (section 8).
• App settings come from Google Firebase. The app downloads settings such as the daily number of free scans from Firebase Remote Config. This does not include anything about you or your searches (section 7).
• We never sell your searches. The only data that leaves your phone for a company other than the websites you check is described in sections 4 to 12.

1. What the app does

You type one username. The app checks it against about 3,150 public websites, using open-source site lists from the WhatsMyName project (CC BY-SA 4.0, Micah Hoffman), Sherlock (MIT) and Maigret (MIT). For each site it requests the public profile address for that username and reads the reply to decide whether an account appears to exist. Results are shown on screen as they arrive. Adult (NSFW) sites are excluded from this version of the app.

Results are leads to verify, not facts. Websites change, return placeholders, and produce false positives. Open a result to check it yourself.

The app is free and supported by ads. It includes a number of free scans per day. If you want more, or want to use the extra tools (Deep search, Export and the "Also check" follow-up scans) for an hour, you can choose to watch a short ad. Watching an ad is always optional. Purchases are not offered at the moment (section 11).

The app is not affiliated with the WhatsMyName, Sherlock or Maigret projects.

2. Information processed on your device

Everything below stays on your phone unless you choose to send it somewhere (for example with Export).

• The username you type. Used to build the profile addresses that are checked. It is sent to each checked website as part of that address, because that is how the check works (see section 4). It is never sent to us or to our advertising partner.
• Pages returned by websites. The app reads each reply (status code and page content, capped in size) in memory to decide "found", "not found", "blocked" or "unknown". If you use Deep search, the app also reads public profile details from found accounts, such as display name, profile picture, short bio, links, account creation date and a location the account owner published themselves. These results are kept in memory only and are discarded when you start a new scan or close the app.
• Recent searches. The last usernames you searched are saved in the app's private storage so you can pick them again from the search box. You can delete them at any time in Settings › Data › Clear recent handles. They are also removed when you clear the app's data or uninstall it.
• Settings. Your preferences (theme, selected sources and categories, timeout, concurrency and similar) are saved in the app's private storage.
• Free scans and rewards. The app keeps a small record in its private storage: how many scans you have used today, the information it needs so that scanning the same username again on the same day, right after your last scan of it, is not counted twice, how many extra scans you have earned, and when an unlock of the extra tools expires. It is used only to apply the daily limit and your rewards. It is never sent to us or to Google, and it is removed when you clear the app's data or uninstall it.
• Pro status. Purchases are not offered at the moment. If optional purchases are offered in a future version and you buy Pro, the app keeps an on/off flag in its private storage that says Pro is active, and which plan it is. It is checked again with Google Play when the app starts or is reopened. It is never sent to us.
• Notification settings. Whether notifications are on, and notifications the app schedules for itself on your phone (local notifications), are kept on the device.
• Terms acceptance. The version of the Privacy Policy and Terms of Use you last accepted, and when, so the app knows whether to ask you again after they change. A copy is also kept with your anonymous device record (section 10).
• Your ad consent choice. If you are shown Google's consent form, your choice is saved on the device by Google's consent software so that you are not asked again every time. You can change it in Settings › Ad privacy settings.
• Icon and image cache. Website icons and profile pictures are cached in the app's cache folder so they load faster (icons are kept for up to 30 days). You can empty it in Settings › Data › Clear icon & image cache.
• In-app browser data. Websites you open in the app's built-in browser can store cookies, site data and a page cache on your phone, as in any browser. This stays in the app's private storage; we cannot read it and it is never sent to us. It is deleted when you clear the app's data or uninstall the app.
• Review and feedback counters. The app counts completed scans and app sessions and remembers when it last asked Google Play to show the rating prompt, and when you last sent feedback (to limit sending to 3 messages per hour). These stay on the device.
• Exports. If you tap Export, the app writes a JSON or CSV file to its temporary folder and passes it to the Android share sheet. Where it goes next is your choice.
• Android backup. If Android's own backup is turned on for your Google account, Android may include the app's settings, recent searches and scan counters in that backup. That backup belongs to your Google account; we have no access to it.

3. What we never collect

We, the developer, do not collect, receive or store:

• your name, phone number or any account details (there are no accounts);
• your email address, unless you type it into Send feedback yourself (section 8);
• the usernames you search, the results you get, or the pages you open in the in-app browser;
• your contacts, photos, files, precise location, or messages.

The app does not ask for location permission and never reads your GPS position. Ads are not based on the usernames you search or on your scan results.

The app needs Internet access to contact the websites being checked and to load ads. Android also grants the related "view network connections" permission. Because the app shows ads, it also declares the Android advertising ID permission (AD_ID), which lets Google's ad software read your resettable advertising ID (see section 5). On Android 13 and later the app asks for the notifications permission so it can show notifications (section 10); you can refuse, and the app works the same. The Google Play billing permission lets the app offer Pro through Google Play (section 11).

4. Websites and services your phone contacts

Checked websites. During a scan your phone connects directly to each website being checked, up to about 3,150 of them. As with visiting a page in a browser, each website can see your IP address, the time of the request, the requested address (which contains the username you typed) and standard technical headers such as the browser identifier. Each website's own privacy policy applies to what it does with that information. We do not control these websites. If you do not want them to see your IP address, use a VPN or a network you trust.

Deep search (optional). When Deep search is on, the app makes extra requests for accounts that were found: it may ask the public APIs of some platforms (for example GitHub, Mastodon, Bluesky, Keybase, dev.to, Codeberg/Gitea, Discourse and Lemmy forums, Hacker News, Steam, Chess.com, Lichess, Gravatar and Roblox) for public profile details about that username, and it downloads profile pictures from the sites that host them. The same visibility applies: those services see your IP address and the username requested.

Website icons. To show each platform's logo, the app requests icons from DuckDuckGo's icon service (icons.duckduckgo.com) and, if that has none, from Google's favicon service (www.google.com/s2/favicons). Only the website's domain name (for example github.com) is sent, never the username you searched. These services can see your IP address.

Opening a result (in-app browser). By default, a profile you open is shown in the app's built-in browser, which uses Android System WebView. The website you open, and any other sites that page loads, can see your IP address and the page you visit, and can set their own cookies and site data, exactly as in a normal browser; their own privacy policies apply. The app does not read or collect what you do on those pages. Links that belong to another app (for example an email address or a store link) are handed to that app. If the in-app browser banner is switched on (it is off by default), a banner ad is shown below the browser toolbar, outside the web page (section 5); the ad software is not given the page address or its content. You can choose to open profiles in your own browser instead in Settings › Open profiles in › External browser; that browser's privacy settings then apply.

Ads. The app loads ads from Google AdMob, as described in section 5.

Google Firebase. The app contacts Google Firebase for app settings (section 7), for feedback you choose to send (section 8), for crash reports unless you turn them off (section 6), for push notifications while they are on (section 10), and to check that requests come from a genuine copy of the app (Firebase App Check, section 12).

Google Play. The app uses Google Play's In-App Review and In-App Updates features (section 9), Google Play Billing (section 11; purchases are not offered at the moment) and Google Play Integrity for App Check (section 12).

5. Advertising (Google AdMob)

Who. The app shows ads provided by Google AdMob, a service of Google LLC (in the EEA, the UK and Switzerland: Google Ireland Limited). Ads appear as a banner at the bottom of the results screen, as banners at the end of the recent searches and guide lists and, only if switched on (it is off by default), below the toolbar of the in-app browser; as ads marked "Ad" within the results list, on the home screen below the recent searches and at the bottom of a result's detail view; as an occasional full-screen ad when you leave the results screen (at most one after every few completed scans, never before or while a scan is running and never when the app starts); as a full-screen ad when you come back to the app after a long break (never when the app is first opened); and as "Watch a short ad" videos that you choose to start in exchange for a reward (extra scans or Pro tools for a limited time). No ads are shown during the first-run introduction or on the consent form.

What Google's ad software collects. To request, show and measure ads and to prevent ad fraud, the Google Mobile Ads SDK in the app automatically sends to Google:

• Device and advertising identifiers: your Android advertising ID, the app set ID and similar identifiers;
• IP address, which Google may use to estimate your general location (such as your city or country; not your precise location);
• Device and app information: device model, Android version, language, screen size, app version and network type;
• Ad interactions: which ads were shown, whether you tapped or closed them, and whether you watched a rewarded ad to the end;
• Diagnostic information about ad loading and app performance.

This information goes directly from your phone to Google. We do not receive it, apart from aggregated, non-identifying reports (such as how many ads were shown) in our AdMob account. The app never sends Google the usernames you search, your results or your recent searches.

Purposes. Google uses this data to show ads, to limit how often you see the same ad, to measure ad performance, for analytics, and to detect and prevent fraud and abuse. If you allow personalized ads, Google may also use it to show ads based on your interests. Google acts as an independent controller of this data. See how Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites and Google's Privacy Policy: https://policies.google.com/privacy.

Personalized and non-personalized ads. Personalized ads use information such as your advertising ID and past activity to choose ads that may interest you. Non-personalized ads are chosen from general context such as the app itself and your approximate location (from your IP address), and do not use your past behaviour, although Google may still use identifiers to limit how often ads repeat, measure them and prevent fraud. If you do not give consent where consent is required, the app asks Google for non-personalized or limited ads only.

Consent (EEA, UK and Switzerland, and where else required). When required by law, the app shows Google's consent form before any ad is requested. It is presented by Google's User Messaging Platform, a consent tool certified under the IAB Transparency & Consent Framework, and lists Google and its ad technology partners. You can accept, decline or choose purposes individually. You can review or change your choice at any time in Settings › Ad privacy settings (this entry appears in regions where it applies). The app works the same whichever choice you make.

US state privacy laws. Under some US state laws (for example in California), sending device identifiers to an ad network for personalized ads can count as "selling" or "sharing" personal information. We do not sell your searches or results. To opt out of personalized ads, use the Android settings below, or Settings › Ad privacy settings in the app where it is shown.

Your advertising ID. You can reset or delete your advertising ID at any time in Android: Settings › Privacy › Ads (on some phones Settings › Google › Ads), then Reset advertising ID or Delete advertising ID. After you delete it, apps receive a string of zeros instead of an ID and ads are not personalized with it. Google explains this at https://support.google.com/googleplay/android-developer/answer/6048248 and https://support.google.com/My-Ad-Center-Help/answer/12155764. You can also manage ad personalization for your Google account at https://myadcenter.google.com.

Rewards. When you choose "Watch a short ad", the reward (extra scans for the day, or one hour of access to Deep search, Export and "Also check" scans) is given only after Google confirms that you watched the ad. Rewards have no cash value, cannot be transferred, and are recorded only on your phone (section 2). If you clear the app's data or reinstall it, unused rewards are lost.

6. Crash reports (on by default) and usage statistics (off)

Crash reports are on by default. When the app crashes or hits a serious error, it sends a crash report to Firebase Crashlytics, a Google service, so we can find and fix the problem. You can turn this off at any time in Settings › Privacy & legal › Crash reports; collection stops immediately and stays off until you turn it on again. If you do not see the switch, reporting is not available in your version and nothing is sent.

Consent in the EEA, the UK and other regions where it is required. If Google's consent form (section 5) is shown to you, crash reports stay off until you have answered that form, and they are turned on only if you agree to the first purpose in that form, storing or accessing information on your device. If you choose Do not consent, or do not agree to that purpose, crash reports stay off; if you later withdraw that consent in Settings › Ad privacy settings, they are turned off. They also stay off whenever the app cannot confirm your consent status (for example on a first start without an internet connection). Whatever you chose in the form, you can turn crash reports off at any time with the switch above.

What a crash report contains: the error message and stack trace (which part of the app's code failed), the app version, the device model, the Android version, the state of the app and device at the time of the crash (such as free memory and disk space, screen orientation and whether the app was in the foreground), the time of the crash, and a random installation identifier created by Firebase (Firebase installation ID). Crash reports do not include the usernames you search, your results, the pages you open or anything you type.

How long it is kept. Crashlytics keeps crash reports for 90 days and then deletes them automatically.

Usage statistics are off by default. The app includes Google Analytics for Firebase, but it is switched off and this version sends no usage statistics. If a later version lets you turn usage statistics on, they will stay off unless you do, and this policy will be updated first. If turned on, Analytics would record its standard automatic events (first open, session start, engagement time, app and Android updates) with device model, Android version, language, an approximate country derived from your IP address and a random app-instance identifier, plus one event per completed scan containing just two numbers (sites checked, accounts found). It is set up never to collect the advertising ID, and its data is kept for 2 months.

Why. Only to find and fix crashes and to understand whether the app works reliably. Not for advertising, not for profiling, never sold.

Firebase data is sent over encrypted connections (HTTPS) and processed by Google as our service provider. See Google's Firebase privacy information at https://firebase.google.com/support/privacy.

7. App settings (Firebase Remote Config)

The app downloads its settings from Google Firebase Remote Config when it starts (at most about twice a day) and may receive updates while it is open. These settings control things like the number of free scans per day, how often ads appear, whether the in-app browser shows a banner, when the rating prompt may appear, the minimum supported app version, the current version of the Privacy Policy and Terms of Use (with an optional short note about what changed) and short notices shown in the app. The same values apply to everyone.

To fetch them, the Firebase SDK sends Google a random Firebase installation ID, the app's package name and version, and your device's language, country setting, time zone and Android version. It never sends the usernames you search, your results or anything you type, and it does not use the advertising ID. This happens whether or not crash reports are on, because the app needs these settings to work; if the settings cannot be fetched, the app uses built-in defaults. Google processes this data as our service provider.

8. Feedback you send us (Cloud Firestore)

Only if you send it. Settings › Send feedback lets you send us a message. Nothing is sent until you tap Send. What we receive:

• the category you pick (bug, idea, site or other) and the message you type;
• your email address, only if you type one, so we can reply;
• the app version;
• if Include app version and device language is ticked (it is by default; untick it to leave these out): the platform (Android), your app language and the app's visual style;
• the time the message was received.

Optional result ratings (1–5 stars and an optional comment), sent without the searched username. With a rating we also receive the number of sites found and checked, whether Deep search was on, the app version, your app language and the time; nothing is sent unless you tap a star.

Where it is stored. Messages are stored in Google Cloud Firestore, part of our Firebase project, in Google Cloud's europe-west3 region (Frankfurt, Germany). Google processes it as our service provider. As with any internet connection, Google's servers see your IP address when the message is sent; it is not stored with your message. The app cannot read messages back; only we can.

What we use it for. Only to read and answer your message and to fix and improve the app. We never sell it, never use it for advertising and never share it except with Google as our hosting provider.

How long we keep it. Until we have dealt with it and no longer need it. You can ask us to delete your message (and your email address) at any time through Settings → Send feedback in the app; tell us roughly when you sent it and from which email address, if you gave one.

Do not include passwords or other sensitive information in feedback.

9. Google Play In-App Review and In-App Updates

Rating prompt. After some successful scans the app may ask Google Play to show its standard "Rate this app" prompt (at most once every 90 days, and Google Play decides whether it actually appears). The prompt is run entirely by Google Play. We do not see whether it was shown or what you rated; any review you post is public on Google Play under your Google account and is governed by Google's terms and privacy policy.

Updates. When the app starts, it asks Google Play whether a newer version is available. If one is, Google Play downloads and installs it, either in the background (you then tap Restart) or, if your version is no longer supported, through Google Play's full-screen update screen. An unsupported version shows an Update required screen until it is updated; its button opens Google Play's update screen or, if that is not available, the app's Google Play page. These checks are handled by the Google Play Store app on your phone under Google's privacy policy; the app sends us nothing.

10. Push notifications (Firebase Cloud Messaging)

On by default. The app can show notifications: news about the app that we send, and reminders the app creates itself (see "Local notifications" below). On Android 13 and later, Android first asks whether to allow notifications; if you refuse, none are shown. You can turn notifications off at any time in the app's Settings or in Android's settings for the app.

What is stored and where. To deliver notifications we send, the app signs in to Firebase Anonymous Authentication, which creates a random user ID that is not linked to your name, email address or Google account, and registers with Firebase Cloud Messaging (FCM), which gives this installation of the app a notification token. The app then subscribes to two notification topics (one for everyone and one for your app language) and stores one document in our Cloud Firestore database (devices collection, region europe-west3, Frankfurt, Germany), named after that anonymous ID, containing:

• the FCM notification token;
• the platform (Android);
• your app language (locale), so notifications can be sent in your language;
• the app version;
• the notification topics the app is subscribed to (none while notifications are off);
• whether notifications are switched on;
• the time the document was last updated;
• if you have accepted the Privacy Policy and Terms of Use: the version you accepted and the time you accepted it (set by our server).

The anonymous sign-in and this document are created when the app starts with Firebase available (or when you accept the Privacy Policy and Terms of Use, if that happens first), also if notifications are off (the document then records that they are off), and the document is refreshed each time the app starts (its last-updated time is then the time you last opened the app) and when you change the notification setting or the app language. Only your installation of the app can read or change its own document; other users cannot see it. When the Firebase SDKs connect, Google's servers also see your IP address and basic technical details (app version, SDK version, Android version), as with any internet request; Firebase Authentication uses the IP address to prevent abuse.

Purpose. The notification fields are used only to deliver notifications to your device. The terms-acceptance fields (version and time) are kept only as proof that you accepted the Privacy Policy and Terms of Use, and which version. The token and anonymous ID are not used for advertising, not linked to your searches and never sold. Google processes this data as our service provider.

Local notifications. Some notifications are created by the app itself on your phone: that a scan finished while the app was in the background, that your free scans are back after the daily limit, and that an unlock you earned by watching an ad is about to end. They are scheduled and shown on the device, contain only what the app already has on the phone, and send nothing to us. Turning notifications off cancels them.

How long it is kept. When you turn notifications off, the app unsubscribes from all topics, cancels its reminders and updates the document to record that notifications are off; the document, including the token, is not deleted. Uninstalling the app or clearing its data makes the token stop working (Firebase invalidates it), but it does not delete the document automatically. The document stays in our database until we delete it: you can ask us to through Settings → Send feedback in the app. Because the registration is anonymous and not linked to your name or email, tell us roughly when you installed or last used the app and your app language; if we cannot tell which registration is yours, we will tell you. We also delete registrations whose token no longer works when we find them.

11. Purchases (Google Play Billing)

Purchases are not offered at the moment: nothing is sold in the app, and Pro tools are unlocked only for a limited time by watching an optional rewarded ad. The app still contains Google Play Billing and, on your device, asks Google Play whether a Pro purchase exists on your Google account. If optional purchases are offered in a future version, Google Play processes them under Google Play's terms and privacy policy; we never see your card or other payment details, your name or your Google account, and your purchase history is handled by Google Play. The app stores only a local flag that Pro is active (section 2). We run no server, and no purchase information is sent to us or to anyone else. Refunds and cancellations of any such purchase follow Google Play's policies.

12. App integrity check (Firebase App Check)

To protect our Firebase services (such as feedback and notification registration) from abuse, the app uses Firebase App Check with Google Play Integrity. Google Play checks on your device whether requests come from a genuine copy of the app on a genuine Android device, and Firebase receives only a short-lived pass/fail token. Firebase also receives basic technical details (Android version and SDK versions). No personal data about you, your searches or your results is involved, and we do not receive any device details from this check. Google processes this under its own terms and privacy policy.

13. Children

The app is not directed at children and is intended for adults (18+). It is not part of Google Play's Families program, and ads are not intended for children. We do not knowingly collect personal information from anyone, including children. If you believe a child has used the app and you want to know what to do, contact us.

14. Acceptable use

Use the app only to look up usernames you have a legitimate reason to research, such as your own accounts, brand protection, security research or checking a handle before registering it. You must not use it to stalk, harass, threaten, intimidate, dox or otherwise harm anyone, or in any way that breaks the law or a website's terms.

WhatsMyName is not a consumer reporting agency. Results must not be used to make decisions about anyone's eligibility for credit, employment, housing, insurance, or any other purpose covered by the U.S. Fair Credit Reporting Act (FCRA) or similar laws.

15. Data retention

The only personal data we, the developer, keep is feedback you choose to send (section 8), which we keep until we no longer need it or until you ask us to delete it, and the anonymous device record described in section 10 (notification registration and terms acceptance), kept as described there. Data that Google collects for ads is kept and deleted under Google's own policies (see section 5). Crash reports and (if you turned them on) usage statistics are deleted automatically as described in section 6. Purchase records are kept by Google Play under Google's policies (section 11). Data on your phone stays until you delete it: clear recent searches in Settings › Data › Clear recent handles, clear the cache in Settings › Data › Clear icon & image cache, or remove everything on the phone (including scan counters, rewards, the Pro flag, your consent choice and in-app browser cookies and site data) by clearing the app's data or uninstalling it.

16. Your rights and choices

Apart from feedback you send us and the anonymous notification registration (section 10), we do not hold personal data about you. If you have sent feedback, you can ask us for a copy of it, or to correct or delete it, through Settings → Send feedback in the app. For ad data, use the controls in section 5: Settings › Ad privacy settings in the app, reset or delete your advertising ID in Android, and Google's tools at https://myadcenter.google.com. Requests about data Google holds as an independent controller can be made to Google through https://policies.google.com/privacy. Crash and usage reports, and app-settings requests, carry only a random identifier and no account, so we cannot link them to you; turning the Crash reports switch off stops crash reports, and they expire as described in section 6. Section 10 explains how to stop notifications and have your notification registration deleted. You can always contact us through Settings → Send feedback in the app with any privacy request or question, and we will answer within 30 days. If you are in the EEA or UK you also have the right to complain to your local data protection authority.

17. Security

Checks use a browser-grade network stack (Chromium's Cronet), and connections to websites that support HTTPS are encrypted. Google's ad software, Firebase (including feedback, notification registration and App Check) and Google Play send their data over encrypted connections. Feedback can only be added to our database, not read back, by the app; each installation can access only its own notification registration. Data kept on your phone is stored in the app's private storage, which other apps cannot read.

18. Changes to this policy

If this policy changes, we will update this page and its effective date. Significant changes will also be noted in the app's release notes. When a change needs your agreement, the app shows the updated Privacy Policy and Terms of Use on a screen that asks you to accept them before you continue using the app; the version and time you accept are recorded as described in sections 2 and 10.

19. Contact

Developer: Hadi Dev Lab.

Contact: use Settings › Send feedback in the app. Email: hadi7786x@gmail.com.