Privacy Policy

Last updated: 6 October 2026

Knock is a friends-only photo app for iPhone. This page says what Knock stores about you, why, where it is kept, for how long, and what you can do about it. It covers the Knock app and this website, itsknock.com.

Who is responsible

Knock is made and run by Marc Overbeck, Basel, Switzerland, who is responsible for your personal data (the "controller") under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Where this page says "we", it means Marc Overbeck. Write to support@itsknock.com.

What Knock stores, and why

You sign in with Apple. Knock has no passwords and never asks for your phone number or your contacts. It stores only what it needs to work:

• Your Apple sign-in. The identifier Apple gives us for you, so that we recognise you. Apple may also pass us an email address; if you chose to hide your email, that is a relay address made by Apple.
• Your first name, your username and, if you add one, a profile photo, so that people know who you are and can find you.
• Photos you take in the app, to show them to the friends they are meant for.
• Messages. Private text messages between you and one friend, always about a photo.
• Reactions. One emoji per photo, shown only to the person who took the photo.
• Friends. Who your friends are, and open friend requests and invitations, so that Knock knows who may see what.
• Knocks. Who asked whom, so that the answer reaches the people who asked.
• Your iPhone's push token. The address Apple gives your device, so that we can send you notifications.
• Who you looked up. When you find someone by their exact username, Knock remembers that for one day, so that you can see their profile photo and ask to be their friend. When you open an invitation link, Knock remembers that until the invitation is used or runs out, for the same reason.

You cannot use Knock without signing in with Apple and having a first name and a username. Everything else is up to you.

As with any internet service, our servers also process technical data such as your IP address and the time of each request, to answer it and to keep the service secure. If you write to us, we receive your email address and your message, and use them to answer you.

Knock has no advertising, no analytics or tracking tools and no crash-reporting tools, in the app or on this website. This website sets no cookies. Your data is not sold.

Legal basis

The GDPR asks for a legal basis for each use of your data. The same purposes apply under Swiss law.

• Providing Knock to you (everything in the list above): our contract with you, Art. 6 para. 1 lit. b GDPR.
• Keeping Knock safe and running (technical data, your emails to us): our legitimate interest in a safe and working service, Art. 6 para. 1 lit. f GDPR.
• Complying with the law (for example a lawful demand from an authority): legal obligation, Art. 6 para. 1 lit. c GDPR.

We use your data for nothing else. Knock does no profiling, and no decision about you is made by software alone.

Who can see what

Knock is for friends only. Friendship is mutual, and you can have at most 24 friends. Your photos, messages and reactions are never public.

• An answer goes to the friends who asked. You can leave any of them out before it is sent.
• A photo in your Museum (one you kept, or took when nobody had knocked) is seen by your friends. You can leave individual friends out, photo by photo.
• A message is seen by you and the friend you are writing with. A reaction is seen only by the person who took the photo.
• Who knocked on you stays hidden until you answer.
• Your username. Everyone on Knock has a username. Anyone on Knock who knows your exact username can find you. They see your first name and profile photo, and can ask to be your friend.
• Friends of your friends can see your first name, your profile photo and which friends you share, and can ask to be your friend.

What a friend has received cannot be taken back. We cannot recall the copy on their phone, and we cannot prevent anyone from taking a screenshot.

Who else handles your data, and where

• Supabase (Supabase Pte. Ltd, Singapore) provides our database, sign-in and file storage. Your data is stored in its Zurich, Switzerland region.
• Apple (Apple Inc., USA) provides Sign in with Apple and delivers push notifications, for which it receives your push token and the notification itself. Apple also hosts our mailbox, support@itsknock.com, in iCloud Mail, and so carries the emails you send us. Apple acts under its own privacy policy.
• Vercel (Vercel Inc., USA) hosts this website and processes the technical data of each visit.

An authority or a court receives data only when the law requires it. Nobody else receives your data from us.

Being stored in Zurich does not mean that your data never leaves Switzerland. Supabase is a company in Singapore, and its terms allow it to process data wherever it or the companies it works with have facilities, for example to operate and support the service. Apple and Vercel are US companies and process data there and in other countries.

Switzerland and the EU/EEA recognise each other's data protection as adequate. Singapore and the United States are not generally recognised in that way. Our agreement with Supabase includes its data processing addendum, which contains the EU standard contractual clauses, adapted for Swiss law; you can ask us for a copy. Vercel states that it is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework. Notifications can only reach an iPhone through Apple, so passing them on is necessary to provide the service to you.

How long we keep it

• An answer is removed from our servers 7 days after the photo was taken, unless you keep it in your Museum.
• Photos in your Museum stay until you remove them or delete your account.
• A knock is deleted when it is answered, or after 24 hours if it is not.
• Messages stay until you or the friend you wrote with deletes their account. Once the two of you are no longer friends, they are no longer shown.
• Your account (Apple sign-in, first name, username, profile photo, friends, push token) stays until you delete it.
• Emails you send us are kept only as long as we need them to deal with your request.

When you delete your account, everything is removed. Supabase makes daily backups, so a backup may still hold deleted data until that backup is itself removed.

Your rights

You can ask us to tell you what we store about you and give you a copy, to correct it, to delete it, to hand it over in a common electronic format, and to stop or limit a particular use. Write to support@itsknock.com. We answer within 30 days.

You can also complain to a data protection authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC). In the EU or EEA it is the authority of the country where you live.

Deleting your account

Deleting an account is not in the app yet. Until it is, write to support@itsknock.com and we delete it for you, within 30 days at the latest. Delete your account says how, and what is removed.

Age

Knock is for people aged 16 and over. If we learn that someone younger has an account, we delete it. If you are a parent or guardian and think your child is using Knock below that age, please write to us.

Security

Data travels encrypted between your phone and our servers, and photos are kept in private storage that only hands them to people who are allowed to see them.

The earlier Knock app

Before this app there was an earlier Knock app with its own accounts, and this website had a waiting list that stored email addresses. Both are switched off, and what they stored is no longer used. If you used either one and want to know what is still stored about you, or want it deleted, write to support@itsknock.com.

Changes

When this policy changes, we update this page and the date at the top. If a change matters for how your data is used, we will tell you before it applies.

Contact