About Secret Message

Secret Message is a free anonymous messaging site. You type a name, you get a link like secretmessageonline.com/b/your-id and a 4-digit recovery PIN, and you put the link in your Instagram or TikTok bio. People message you without creating an account, and you read it all in a private inbox. No app to install, no email address, no signup for the people writing to you.

It is an independent project, not a venture-funded startup with a press office. That shapes what gets built, how fast a bad call gets reversed, and why the copy across this site is blunt about what the product cannot do.

Who runs this

Secret Message is built and operated by Birim Ajans (Birim Web Ajansı), a web agency working since 2017 out of Maltepe, İstanbul, Türkiye. The agency builds websites, software and digital marketing for clients; Secret Message is one of its own products rather than client work. You can check the company at birimajans.com.

We are saying this plainly because a product built on anonymity should not itself be run by an anonymous operator. If a message sent through this site causes a problem, there is a registered company in a known jurisdiction to write to, reachable at [email protected] and on +90 850 307 41 95. Day-to-day the site is run by one person at the agency rather than a support department, which is why the response times on the contact page are stated in days rather than minutes.

The problem this exists to solve

People want unguarded feedback, and almost nobody gives it in public. A comment under a post is a performance for everyone else reading the comments. Take the name off and the same person tells you the song is your best one yet, or that you have been unbearable since the promotion.

The usual way to get at that was downloading an app that wanted notification permissions, contact access and eventually your card. Secret Message is a web page instead. A sender taps your link, types up to 500 characters, hits send. The how it works page covers the full flow, PIN included.

An honest account of this category

Anonymous Q&A has boomed and crashed more than once. The last wave put several apps at the top of the charts on the same mechanic used here. Then regulators arrived, and the complaints clustered around two behaviors: apps that implied or outright sold the ability to find out who sent a message, and apps that collected data from children while presenting themselves as general-audience products.

Specific cases, dates and penalty figures are left out on purpose. Getting them slightly wrong from memory would be its own small dishonesty. The pattern is the point, because it is what a new entrant is tempted to repeat: the mechanic is fun, and it is trivially monetized by lying about anonymity.

Operating principles, with the receipts

Honest about what anonymity means

Senders are anonymous to recipients, completely. You will never see a name, IP address, country, device type, hint, guess or paid unlock. It is not a roadmap item.

Senders are not anonymous in the absolute sense, and pretending otherwise is the exact failure described above. Coarse metadata, meaning IP address, country and device type, is stored server-side for rate limiting, abuse handling and lawful requests. The operator can see it. The recipient never can. The privacy policy says so plainly, and the safety page covers what happens when someone is threatened.

Moderation on day one, described accurately

Every message goes through a moderation pipeline before it reaches an inbox. The pipeline runs locally on this site's own servers. No external AI service sees your text. Three stages:

• A PII scan. Regex detection for email addresses, phone numbers, SSNs, IBANs and card numbers, so anonymous messages do not become a doxxing channel.
• A profanity wordlist. A soft signal, not an automatic block. Friends swear at each other, and a filter that cannot tell swearing from abuse just makes the product annoying.
• Severe-content pattern detection. Threats, self-harm bait, sexual violence, hate slurs and child sexual content, across English, Turkish, Arabic, Spanish, French, Filipino, Indonesian and German. Matches land in a Filtered folder instead of your inbox. Child sexual content is blocked outright and never delivered.

Now the part most sites skip. A wordlist-and-pattern system is a list of things somebody thought of in advance. It misses misspellings, coded language, new slang, inside references that only hurt because of shared history, and anything in a ninth language. Cruelty phrased politely sails through, because there is nothing in it to match. Any claim that a filter catches everything is marketing.

That limit is why every message has a report button, and why you can block a sender, mute keywords, delete anything or flip your board private. Reports are the main input for updating the patterns, so sending one is useful rather than a formality.

No reveal-the-sender products, at any price

There is real money in telling people they can unmask a sender. It is also the clearest way to break a user's trust, and it is what regulators went after. Not sold here, not hinted at. The honest answer to that question is written out in full on the blog.

Safety tools stay free

Blocking, keyword muting, reporting, deleting and privacy toggles are part of the free product permanently. Charging for the ability to not be harassed is not going to happen here.

How it is built, and why web-first matters

Secret Message is a Progressive Web App. It runs in any modern browser on iOS and Android, installs to the home screen in a tap, and supports push notifications, with no App Store involved.

That is not a tech-stack brag. When a report exposes a gap in the severe-content patterns, the fix ships the same day. No review queue sits between a known moderation problem and its fix, which is the only way a one-person operation can take safety seriously.

Messages are retained 90 days, then deleted automatically. Rate limits cap senders at 5 messages a minute and 20 per recipient per sender per day, which kills flood attacks without bothering normal use. Minimum age is 13.

How this pays for itself

Servers, domain and time cost money, and the core product is free with no signup. Vagueness about funding invites the assumption that the data is the product, so here is the plan in full.

• Advertising on the guide, blog and marketing pages. If you see an ad here, that is what pays the hosting bill. Ad partners set their own cookies, which the privacy policy covers.
• Optional cosmetic upgrades such as themes and sticker packs, planned for later. Cosmetic means cosmetic. No safety feature moves behind that line.
• Nothing else. Inbox contents are not sold, licensed or handed to data brokers, and there is no paid unmasking tier.

Editorial standards

The guides and comparisons here are written and reviewed in-house. They are not bought from a content farm, not sold as guest posts for backlinks, and not published unread.

• No invented numbers. No survey results, download counts or percentages presented as fact. A point that needs a statistic nobody can back up gets made qualitatively instead.
• No fake social proof. No invented testimonials, no fabricated case studies, no quotes from experts who do not exist.
• Feature claims are checked against the product. If a page says Secret Message does something, it does it at the time of writing.
• Competitors are described as of publication. The NGL alternative comparison reflects how those apps worked when it was written. Apps change. A stale comparison is a mistake to fix, not a position to defend.
• Corrections happen in the open. Wrong pages get fixed rather than quietly deleted.

None of it is medical, legal or crisis counseling, and it is not written in that voice. Where a topic touches self-harm or credible threats, the advice is to contact real help: the 988 Suicide & Crisis Lifeline in the US, or local emergency services. The safety page keeps that together, and what to do about a mean message covers the everyday version.

Contact

One address, read by a person: [email protected]. Use it for abuse reports, law-enforcement requests, DMCA notices, press, corrections and partnership questions. There is no ticket form; the contact page just explains which subject prefix to use and what to include so a reply does not take three rounds.

One exception: report a specific message with the button in your inbox rather than by email. It attaches the message and its context automatically, which is much faster to act on. The terms of service set out the rules, and you can start a board from the homepage.