Privacy Policy
Effective September 20, 2026
Privacy by design
A Secret Yes is designed to keep your identity private unless there is a mutual match. If the person you select already has a SecretYes account, they may receive an anonymous alert that “someone has a Secret Yes for you.” That alert never includes your name, number, profile or the connection type you chose. Someone without a SecretYes account may receive one anonymous invitation text, which never says who picked them or what for, at most once every 30 days. Replying STOP ends these for good. Their full number is kept only until that text is sent or cancelled; after that only the matching hash remains. “Someone picked you” alerts are grouped into at most one summary text a day, sent at a random daytime hour in the recipient’s time zone and counting only picks that are at least a few hours old; new mutual matches appear after a random delay of a few hours. This way the timing does not point to a particular person. If a selection is removed before its alert is delivered, the alert is cancelled. We store your device’s time zone for this purpose.
Information we use
SecretYes may process your Google account identifier, email, display name, verified mobile number, age/terms confirmations, private selections, connection types, mutual-match records, and notification delivery status.
Phone-number matching
The server normalizes verified and selected phone numbers. It uses a keyed cryptographic hash for matching. A limited phone-number suffix may be retained so you can recognize entries in your own private list.
Google, Supabase and Twilio
Google is used for account sign-in. Supabase stores application data. Twilio may be used for verification, match notifications and anonymous alerts by SMS or WhatsApp. Those providers process information according to their own applicable terms and privacy practices.
When a match happens
When a mutual match happens, SecretYes records the mutual but keeps the other person’s identity and connection type locked. Match information is shown only after that user reveals the locked match. Notification wording is intentionally limited so sensitive information is less likely to appear on a lock screen.
Payments and Stripe
If you purchase a match reveal, Stripe processes the checkout and payment information. SecretYes stores limited payment records such as the match unlock, amount, currency, Stripe Checkout Session or Payment Intent identifiers, status, and timestamps so we can confirm the purchase, prevent duplicate charging, and keep that match revealed for your account. SecretYes does not need to store your full card number.
Your controls
You can remove active Secret Yeses and turn alerts (mutual matches and anonymous “someone picked you” alerts) on or off in the app. To prevent abuse, SecretYes automatically limits accounts that repeatedly add and remove people (for example by pausing adding for a few days) and stops texting a number that many accounts pick in a short time; these events are recorded for review by administrators. Match alerts are enabled by default for new accounts and can be turned off at any time in Profile. You can also permanently delete your SecretYes account from Profile. Deletion removes your active Secret Yeses, disables your public profile, clears your verified mobile and identifying account data, and removes unpaid matches. SecretYes may retain limited transaction and match records when necessary for accounting, refunds, fraud prevention, legal obligations, or to preserve another user's already completed paid reveal; retained records no longer expose the deleted user's phone number or active profile.
Reusing a verified mobile number
If you verify a mobile number that is already attached to another active SecretYes account, we ask you to confirm before moving that number. If you continue, the previous account is retired and de-identified, its active selections are removed, and the newly verified account becomes the active owner of that mobile number. The new account starts fresh and does not inherit the previous account's private selections or matches. Limited paid transaction records may remain as described above.
Administrator access
A small number of authorized SecretYes administrators can view account and selection records (including who selected whom and the connection type) to operate the service, investigate abuse and respond to safety or legal requests. Administrators may remove selections or suspend accounts that break our Terms. Administrator access and actions are restricted and logged.
Security
SecretYes uses server-side credentials for sensitive services and does not intentionally expose Supabase secret keys or Twilio authentication tokens to browser code. No internet service can guarantee absolute security.
Minors
SecretYes is for adults aged 18 and older and is not intended for minors. Do not enter a minor’s phone number into the service.
Contact and updates
For privacy questions or requests, use our Contact page and choose Safety / Privacy. We may update this policy as SecretYes develops.
This privacy policy is a practical product draft and should receive jurisdiction-specific legal review before a public launch.
Shareable SecretYes profiles
Verified users receive a random SecretYes profile identifier and can share a profile link or QR code. The public profile is designed to show only a first name and connection choices; it does not publish the user’s phone number. Users can turn the public profile off or regenerate the link, which invalidates the previous shared link.