Your privacy matters. We collect as little data as possible.
Welcome to Secret ("the App," "we," "us," or "our"). Secret is a mindfulness and observation app developed by Hengtong Li (an individual developer). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Secret iOS application (Bundle ID: com.lastember.Secret).
We are committed to an anonymous-first approach. You can use Secret without creating an account, providing your name, or sharing any personally identifiable information. This policy applies to all users worldwide and addresses your rights under applicable data protection laws.
The data controller responsible for your personal data is:
Hengtong Li
Email: hengtong.li@foxmail.com
We follow data minimization principles and collect only what is necessary to provide the App's functionality.
| Data | Purpose | Legal Basis |
|---|---|---|
| Anonymous User ID (Firebase Anonymous Auth) | Identify your device to sync daily Secrets and responses | Legitimate interest / Contract performance |
| Timezone | Deliver daily Secrets at appropriate local times | Legitimate interest / Contract performance |
| Locale (language/region) | Provide content in your preferred language | Legitimate interest / Contract performance |
| App version | Ensure compatibility and troubleshoot issues | Legitimate interest |
| Data | Purpose | Legal Basis |
|---|---|---|
| Notice responses (yes/no) | Track your engagement with daily Secrets | Contract performance |
| Echo text (up to 280 characters) | Allow you to reflect on your observation | Consent |
| Coarse location (city-level, coordinates rounded to ~1km) | Provide location-relevant Secrets (optional) | Consent |
| Apple ID (if you sign in) | Cross-device backup and data recovery | Consent / Contract performance |
| Push notification token | Send morning/evening reminders (optional) | Consent |
We use the collected data exclusively for the following purposes:
We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to the App's core functionality.
Under the General Data Protection Regulation (EU) 2016/679 and the UK GDPR, we process your data based on the following legal grounds:
| Data Type | Retention Period |
|---|---|
| Anonymous User ID & responses | Until you delete your account or request deletion; automatically deleted after 12 months of inactivity |
| Echo text | Until you delete your account or request deletion |
| Coarse location data | Until you delete your account or request deletion |
| Apple ID association | Until you unlink your account or request deletion |
| Push notification tokens | Until you disable notifications or delete your account |
We use the following third-party services to operate the App:
| Provider | Service | Data Processed | Location |
|---|---|---|---|
| Google LLC (Firebase) | Authentication, Cloud Firestore, Cloud Functions, AppCheck | Anonymous User ID, responses, echo text, location, device metadata | United States (with global infrastructure) |
| Apple Inc. | Sign-In with Apple, Push Notifications, In-App Purchases | Apple ID (if linked), device token, transaction data | United States (with global infrastructure) |
Your data may be transferred to and processed in the United States where Firebase servers are located. For transfers from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, we rely on:
We do not sell, rent, trade, or otherwise share your personal data with third parties for their own purposes. We do not engage in data brokering or provide data to advertisers.
Secret does not use cookies, web beacons, pixel tags, or any tracking technologies. The App does not contain any third-party analytics SDKs, advertising frameworks, or behavioral tracking tools. We do not participate in cross-app or cross-site tracking.
If you are located in the European Economic Area or the United Kingdom, you have the following rights:
If you are a California resident, under the California Consumer Privacy Act (as amended by the California Privacy Rights Act), you have the right to:
We do not sell personal information. We do not use sensitive personal information for purposes other than providing the service. In the preceding 12 months, we have not disclosed personal information for a business purpose to any third party beyond our service providers listed above.
If you are located in Canada, under the Personal Information Protection and Electronic Documents Act, you have the right to:
If you are located in Australia, under the Australian Privacy Principles, you have the right to:
If you are located in New Zealand, under the Privacy Act 2020 and the Information Privacy Principles, you have the right to:
If you are located in Japan, under the Act on the Protection of Personal Information, you have the right to:
If you are located in South Korea, under the Personal Information Protection Act, you have the right to:
We process your data for the minimum period necessary and will destroy personal information without delay when the purpose of processing has been achieved.
If you are located in Hong Kong, under the Personal Data (Privacy) Ordinance, you have the right to:
If you are located in Taiwan, under the Personal Data Protection Act, you have the right to:
If you are located in Macau SAR, you have the right to:
If you are located in Brazil, under the Lei Geral de Protecao de Dados, you have the right to:
To exercise any of the above rights, please contact us at hengtong.li@foxmail.com. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request by asking you to provide your anonymous user ID from the App's settings.
Data Export: You can export your data in JSON format directly from the App (Settings > Your Data > Export Your Data). This serves as the mechanism for data portability requests under GDPR Article 20 and equivalent provisions.
Account Deletion: You can delete your account and all associated data directly from the App (Settings > Your Data > Delete Account). Deletion is completed within 30 days. For details, see our Data Deletion page.
We implement appropriate technical and organizational measures to protect your data:
While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.
Secret is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction, such as 16 in certain EU member states). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under the applicable age, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us at hengtong.li@foxmail.com.
Secret does not track users across third-party websites or apps, and therefore does not respond to Do Not Track (DNT) signals. This is because we do not engage in any tracking to begin with.
We may update this Privacy Policy from time to time. When we make material changes, we will:
We encourage you to review this policy periodically. Your continued use of the App after changes constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will endeavor to respond to all inquiries within 30 days.