How contact sync works
White Coat World offers a “Find friends” feature that checks your phone or email contacts against the list of people who already use WCW. This page explains exactly what happens, in plain language.
What we ask for
With your explicit permission, your device shares the email addresses, phone numbers, and names from your contact list with the WCW app. You can pick any subset — you do not have to share everything.
What we do with it
- We compare your contacts against existing WCW user accounts.
- If a match exists, we surface that person as a suggested follow in your “People you might know” feed.
- We only ever show public profiles. If the matched user has a private account, you will not be told they’re on WCW from contact sync. Their privacy comes first.
- The match is one-way: the other person is not notified that you have them in your contacts.
What we do NOT do
- We never sell, share, or send your contacts to advertisers, data brokers, or any third party.
- We never show anyone “Sarah has you in her contacts” or similar shadow-profile signals.
- We never accept uploaded address books from outside your device (no CSV uploads, no third-party imports).
Retention & on-device hashing
Contact matching is now done with cryptographic hashing on your device. The app fetches a shared public salt, computes SHA-256(`salt|email`) and SHA-256(`salt|phone`) for each contact locally, and only sends those hash values to our servers. We compare them against a precomputed index of public users' email/phone hashes (refreshed hourly) and return any matches. Your raw contact names, emails, and phone numbers never leave your device.
Forget my matches
You can clear any contact-match state at any time from Settings → Privacy → Forget my contact matches. Account deletion also clears it automatically.
Children
Contact sync is not available to users under 13 (COPPA). WCW is built for high-school and older applicants, but we enforce the gate at the API.
Legal basis
We process your contacts only with your explicit, granular consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time using the “Forget my matches” button. We do not rely on legitimate-interest grounds for contact processing.
Questions
Email privacy@whitecoatworld.com with any concern. We respond to GDPR/CCPA right-to-be-forgotten requests within 30 days.