Privacy Policy

Last updated 20 October 2026

Secrets (secrets.quest, and the Secrets app) lets you share secrets as yourself or under a random alias. This page says what we keep and who can see it.

What we collect

Your account: your email address and a password (stored only as a hash), or, if you use Google, the email address Google confirms. Google also shares your name and photo when you sign in; the app does not use or show them.
Your profile: the username, avatar, display name and bio you choose.
What you do in the app: the secrets and comments you write, your reactions, saves and reposts, and the messages you send through other people's send links.
Notifications: if you allow them, the token your browser or phone gives us so we can notify you.
Limits and safety: how often you use the AI helpers, and, for send links, keyed hashes of device and network identifiers so we can stop abuse. We do not store who sent a message sent through a send link.

Anonymous posts

Other people see a random alias on an anonymous secret or comment, not your name. We still keep a private record of which account wrote it. Only an administrator can look it up, only for a reported item, one item at a time, and every look is logged.

AI helpers

To suggest a mood, a title and a summary, and to add content notes, the text of a secret is sent to an AI provider (currently Groq and Google). Only the text is sent, never your account, username or alias.

Sign in with Google

If you choose Google, we ask only for your email address and basic profile (openid, email, profile). We use them to sign you in and create your account. We do not use Google data for anything else, and we do not sell it or share it with anyone else.

Who else handles your data

Vercel hosts the website. Neon hosts our database. Resend delivers the emails that carry confirmation codes. Google and the AI providers above are used as described. Notification services from your browser or phone maker deliver notifications. We do not sell your personal information.

Confirming your email

An account you create is usable right away, but your email stays unconfirmed until you enter the code we send. If someone else later proves they own that email, the unconfirmed account and everything in it is deleted, so please use your own email and confirm it.

Keeping and deleting your data

We keep your data while your account exists. To have your account and everything in it deleted, contact us at secretsapp.global@gmail.com. Secrets you posted are removed with it. When you delete an anonymous message you received, we keep it hidden for 30 days so you can bring it back, then it is removed for good.

Security

Data is sent over HTTPS and passwords are hashed. No service is perfectly secure, so use a password you do not use elsewhere.

Children

Secrets is not for children under 13. If you think a child under 13 has an account, tell us and we will delete it.

Changes

If we change this page in a way that matters, we will update the date above and, where we can, tell you in the app.

Questions

Write to secretsapp.global@gmail.com.