Login

Last updated: 17 October 2026

This Privacy Policy explains how Secret Message (“we“, “us“) handles personal data when you use our website secretmessage.link (the “Site“) and the Secret Message mobile app for Android and iOS (the “App“), including Secret Message Premium. Together we call these the “Service“.

We process personal data in line with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act“) and other applicable law. By using the Service you agree to this policy. If you do not agree, please do not use the Service.

1. Who we are and how to contact us

Secret Message is the data fiduciary (the party responsible for your data) for the Service. For any privacy question, request or complaint, write to:

Grievance & privacy contact: gaflagames@gmail.com
Please put “Privacy” in the subject line. We aim to reply within 7 days and to resolve grievances within 30 days.

2. Summary

  • No login, no email, no phone number. The App creates an anonymous guest account. You only give us a display name.
  • Senders stay anonymous. When someone sends you a message we store only the message text and the time it was sent, not who sent it.
  • We do not sell your personal data.
  • The free App shows ads from Google AdMob. Premium removes them.
  • You can delete your account and messages at any time in the App (Profile → Delete account).

3. Data we collect

3.1 Data you give us

  • Display name – the name you enter when you create your link. We generate a username and a personal link from it, and both are shown publicly on your link page.
  • Messages you receive – the message text, the date and time, and whether you have read it or marked it as a favourite.
  • Messages you send – if you send an anonymous message to someone, we store the text and time so the recipient can read it. We do not link it to you.
  • Reports – if you report a message, we store a copy of the message, the reason you chose and the time, so our moderators can review it.
  • Support emails – if you write to us, we keep your email address and what you tell us so we can reply.
  • Website accounts – if you create a board on the Site, we store the name, the link and the PIN you choose (the PIN is stored as a hash, not in plain text), plus the messages you receive.

3.2 Data created when you use the App

  • Account ID and access key – a numeric account ID and a random secret key that identify your guest account. The key is stored on your device; we store only a hashed copy on our server.
  • Push notification token – if you allow notifications, a token from Firebase Cloud Messaging so we can tell you about new messages. You can turn notifications off at any time in your phone’s settings.
  • Usage analytics – through Google Firebase Analytics: screens viewed, actions such as sharing a link or opening a message, app version, device model, operating system, language, approximate location (country/region, derived from IP address), an app instance identifier and your numeric account ID. We use this to understand how the App is used and to fix problems. It never includes the content of your messages.
  • Advertising data (free version only) – Google AdMob may collect your device’s advertising ID, IP address, device information and how you interact with ads, to show and measure ads. Where the law requires it, we ask for your consent first through Google’s consent form, and you can change your choice later in Profile → Privacy options. You can also reset or delete your advertising ID in your phone’s settings.
  • Purchase data (Premium only) – see section 6.
  • Technical logs – like any web service, our servers keep standard logs (IP address, time of request, device/browser type) for security and to fix errors.

3.3 Data collected on the website

The Site uses cookies and similar technologies, Google Analytics, and advertising partners. These may collect your IP address, browser and device information, and the pages you visit. You can block or delete cookies in your browser settings, but some features may then stop working. The Site does not respond to “Do Not Track” signals.

3.4 What we do not collect

We do not ask for or collect your email address, phone number, password, contacts, photos, precise location, or the identity of people who send you messages. We do not receive your card, UPI or bank details. Payments are handled entirely by Google Play or the Apple App Store.

4. Why we use your data

Purpose Data used
Create your link and deliver anonymous messages to you Display name, username, account ID, messages
Notify you about new messages Push token, account ID
Provide Premium, and restore it and your account when you reinstall Account ID, purchase records
Keep the Service safe: handle reports, prevent abuse, spam and illegal activity Reports, messages, technical logs
Show ads in the free version Advertising data (with consent where required)
Understand usage and improve the Service Analytics data
Answer your questions and requests Support emails
Meet legal obligations (for example tax records and lawful requests from authorities) Purchase records, and other data where the law requires it

We process this data with your consent, which you give by creating an account and using the Service and which you can withdraw at any time (see section 9), or for legitimate uses permitted by the DPDP Act, such as complying with the law.

5. Who we share data with

We share personal data only with service providers that help us run the Service. They act on our instructions and may not use it for their own purposes, except where their own privacy policies apply to data they collect directly:

  • Google LLC – Firebase Analytics and Cloud Messaging, AdMob advertising, Google Play billing and in-app reviews (Google Privacy Policy).
  • Apple Inc. – App Store billing on iOS.
  • RevenueCat, Inc. – manages Premium subscription status. It receives only your numeric account ID and purchase records, never your name, link, messages or advertising ID.
  • Our hosting provider – stores our servers and database.

We may also disclose data if the law requires it, in response to a valid request from a court or government authority, to protect someone from serious harm, or as part of a merger or sale of our business (in which case this policy will continue to apply). We never sell your personal data.

Public information: your display name and link page are public, so anyone with your link can see them. The messages you receive are private to you unless you choose to share them, for example as a story image.

6. Secret Message Premium

What we process. If you buy Premium, we process your account ID, the plan you chose, its status (active, cancelled, expired), its start and renewal dates, and the store’s transaction ID. We do not receive your payment details, name or email address from the store.

Why. To check whether your subscription is active, remove ads, unlock Premium features, and restore Premium if you reinstall the App.

Recovering your account. There is no login, so if you reinstall the App or move to a new phone, tapping “Restore purchases” lets the store tell us that your Premium subscription now belongs to the new installation. We then move your old link and messages to the new installation and close the old one. Anyone who restores purchases while signed in to the same Google Play or Apple account will receive them, so keep that store account to yourself. Free accounts cannot be recovered this way.

Cancelling. The store bills you, not us. Cancel in Google Play → Payments & subscriptions → Subscriptions, or on iPhone in Settings → your name → Subscriptions. Deleting your Secret Message account does not cancel your subscription. Refunds are handled by the store under its refund policy.

7. Where your data is stored

Our servers are operated by our hosting provider. Google and RevenueCat process data in the United States and other countries where they operate. When data is transferred outside India, we do so only as permitted under the DPDP Act and any rules made under it. These providers use industry-standard safeguards.

8. How long we keep data

  • Account, link and messages – until you delete them or your account. A message you delete is removed straight away.
  • Accounts left unused – uninstalling the App does not delete your account. Because there is no login, a free account can no longer be reached after you uninstall. We may delete accounts that have had no activity for 24 months.
  • Reports – up to 12 months after the report, or longer if needed for a legal process.
  • Push tokens – until you delete your account or the token stops working.
  • Purchase records – while your account exists, plus up to 8 years where Indian tax law requires it.
  • Analytics data – up to 14 months in Google Analytics.
  • Technical logs – usually up to 90 days.
  • Support emails – up to 2 years after your last message.

9. Your rights and choices

Under the DPDP Act you have the right to:

  • Access a summary of the personal data we hold about you and how we use it;
  • Correct or update inaccurate data;
  • Erase your data, which you can do yourself (see section 10);
  • Withdraw consent at any time. Uninstalling or deleting your account stops all processing, except data we must keep by law. Withdrawal does not affect processing that happened before it;
  • Raise a grievance with us at the contact in section 1. If you are not satisfied with our answer, you may complain to the Data Protection Board of India;
  • Nominate another person to exercise these rights for you in the event of death or incapacity.

Other choices: turn off notifications in your phone’s settings; change ad consent in Profile → Privacy options; reset your advertising ID in your phone’s settings; block cookies in your browser.

Because accounts have no login, we may ask you to make access or correction requests from inside the App, or to prove that you own the account (for example with your username and the App on your phone), so that nobody else can obtain your data.

10. Deleting your account

  • In the App: Profile → Delete account. This permanently deletes your account, link, messages and push tokens from our database straight away. We also remove your public link page from the website within 30 days, and ask RevenueCat to delete its copy of your subscription record.
  • Without the App: email gaflagames@gmail.com with the subject “Delete my account” and your username or link. We will verify the request and delete your data within 30 days.
  • Copies in our encrypted backups are overwritten within 30 days. Data we must keep by law (such as tax records) is kept only for that purpose.
  • Deleting your account does not cancel a Premium subscription. Cancel it in the store (see section 6).

11. Security

All traffic between the App, the Site and our servers is encrypted with HTTPS. Account keys and website PINs are stored only as hashes. Access to our servers is restricted. No system is completely secure, so please keep your phone locked and do not share your store account. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

12. Age requirement

The Service is intended only for people 18 years of age or older. We do not knowingly collect personal data from anyone under 18, and we do not track children or target advertising at them. If you believe someone under 18 is using the Service, contact us and we will delete their account.

13. Safety and content

Anonymous does not mean unaccountable. Bullying, threats, sexual content, content involving minors and spam are not allowed. You can report any message in the App. We review reports and may remove content, suspend accounts and, where the law requires or someone’s safety is at risk, share information with the authorities.

14. Advertising on the Site

The Site and the free App show advertising to keep the Service free. Ads and sponsored content are clearly labelled as “Ad”, “Advertisement” or “Sponsored” and are kept separate from our own content. Some pages may contain affiliate links, which are marked as such. Advertisers have to follow applicable law and our content standards, and we may remove any ad that does not.

15. Links to other websites

The Service may link to websites and apps run by others, such as WhatsApp, Instagram or Snapchat when you share. Their privacy policies apply to what you do there.

16. Changes to this policy

We may update this policy when our Service or the law changes. We will change the “Last updated” date at the top, and for important changes we will notify you in the App or on the Site. If you keep using the Service after a change, you accept the updated policy.

17. Users outside India

The Service is run from India. If you use it from another country, your data will be processed in India and in the countries listed in section 7, where data protection laws may differ from yours. California residents may ask what personal data we have shared with third parties for direct marketing purposes. We do not share it for that purpose.