Secret Message
My inboxGet your link

Privacy Policy

Last updated: April 29, 2026

We wrote this policy in plain English on purpose. If anything is unclear, email [email protected] and we'll respond within 7 days.

1. Who we are

Secret Message("we", "us") is an anonymous Q&A web application accessible at secretmessageonline.com.

The site is operated by Birim Ajans (Birim Web Ajansı), a web agency based in Maltepe, İstanbul, Türkiye, working since 2017 and reachable at birimajans.com. That company is the data controller for everything described below. Because it is established in Türkiye rather than the EEA, data you send us is processed outside the EEA and the UK; section 9 sets out where and on what legal basis. For any question about your data, including access, correction, export or deletion, write to [email protected].

2. What data we collect

  • Inbox data: the display name you type, an optional bio, a hash of your 4-digit PIN, and the IP address the inbox was created from. There is no account: we do not ask for or store an email address, a phone number, a password or a profile photo. If you turn on push notifications we also store the subscription token your browser issues.
  • Message content: the text of every anonymous message sent to you, up to 500 characters. Traffic to the site is encrypted in transit with HTTPS.
  • Sender metadata:the sender's IP address, recorded with the message. It is used only for rate limiting, sender blocking, and responding to lawful requests. We do not build device fingerprints, and this is never shown to the recipient.
  • Analytics: aggregated, privacy-respecting analytics via Google Analytics 4 and Microsoft Clarity (no personally identifiable information).

3. What we do NOT collect

  • We never request sender accounts, names, phone numbers, or addresses.
  • We never share sender identity with the recipient. There is no "reveal who sent it" feature, and there never will be.
  • We do not sell, rent, lease, or otherwise share your personal data with advertisers, data brokers, or AI training datasets.

4. How long we keep data

  • Anonymous messages: 90 days from receipt, then automatically deleted from primary database and backups.
  • Account data: until you delete your account, then permanently deleted within 30 days.
  • Sender metadata for safety: 180 days, then purged. Reported messages may be retained longer where legally required.

5. Anonymity is not the same as untraceability

We're going to be more direct about this than most apps in our category. "Anonymous" on Secret Messagemeans the recipient cannot identify the sender. Never the sender's name, email, IP, or device. However, if a credible threat is reported (harm against a person, threats to children, terrorism, etc.), we cooperate with law enforcement and will disclose stored metadata when legally compelled to do so. We do not promise true anonymity from authorities; we do promise it from other users. Read the safety page for details.

6. Your rights (GDPR + CCPA)

  • Right to access. Request a full export of your data via [email protected].
  • Right to deletion. Delete your account from Settings, or email us. We process within 30 days.
  • Right to correction. Edit your profile fields from Settings.
  • Right to opt out of "sale" (CCPA). We do not sell data, but you can confirm by emailing us.

7. COPPA. Under-13 use is prohibited

We do not knowingly collect data from children under 13. If you believe a minor under 13 has registered, email [email protected] and we will delete the account immediately.

8. Cookies and advertising

Essential cookies. One signed first-party cookie identifies your inbox so you do not have to re-enter your PIN on every visit. It contains a board identifier and a signature, nothing else. Without it the product cannot work, so it is set for everyone who creates a link.

Analytics cookies. Google Analytics 4 and Microsoft Clarity set cookies to measure aggregate traffic and how pages are used. We do not send message content to either of them.

Advertising cookies.This site is supported by advertising on our guide, blog and marketing pages. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info. Ad code is not loaded on message-board pages, the inbox, or the recovery screen.

9. Where your data is processed

The application and its database run on a virtual server hosted by DigitalOcean in New York, United States. Traffic is proxied through Cloudflare, which operates a global network and may terminate your connection at a location closer to you. Our other processors are Google (Analytics and advertising), Microsoft (Clarity analytics) and Cloudflare (Turnstile anti-abuse checks).

If you are in the EEA or the UK, this means your data is transferred outside your region. Those transfers rely on the standard contractual clauses published by the European Commission, and, where applicable, on the providers' certification under the EU-US Data Privacy Framework.

10. Changes to this policy

We deliberately hold no email addresses or phone numbers, so we have no way to contact you directly and will not pretend otherwise. Changes are published on this page with an updated "last updated" date at the top, and material changes to how we handle anonymity, retention or sharing are called out at the top of the page for at least 30 days. If that matters to you, check back before relying on anything here.

11. Contact