Privacy Policy

Draft notice: this policy accurately describes how OurSecretPhrase's systems actually work today. It has not been reviewed by a lawyer. Please have it reviewed for your specific jurisdiction(s) before relying on it as a binding legal document.

What we collect

When you create an account: your email address, first and last name, and — only if you choose to enter one — a phone number, tied to that specific device.

Optionally: a profile photo. If you upload one, we re-encode it from scratch on our server (strip any hidden metadata like GPS location, resize it, save it as a fresh image file) before storing it — we never store or serve your original uploaded file as-is.

If you sign in with Google, we receive your name, email, and Google account ID from Google directly. We never see your Google password.

What we never see or store

Your secret phrase. When you pair with someone, your two devices generate a shared secret directly between themselves. That secret is never sent to our servers, in any form — we could not hand it over if compelled to, and we cannot recover it if you lose it.

Because of this, losing access to all your devices means starting over with a new pairing. This is a deliberate trade-off: the alternative (us being able to recover your secret) would mean we could also read it.

Domain safety check

When you sign up, we run an automated check on your email domain's public registration record (how old the domain is, whether it can receive mail) to flag obviously suspicious sign-ups — for example, a domain registered minutes ago. This check queries public domain-registry data (the same information anyone can look up via WHOIS) and does not send your personal information anywhere. The result (a simple Safe / Questionable / Risky label) is shown only to people you pair with, never sold or shared further.

What paired contacts can see about you

Once you pair with someone, they can see: your name (or the nickname they gave you), your email address and whether it's currently verified, your profile photo if you have one, the domain-safety label above, and the phone number tied to whichever of your devices they're paired with. They cannot see your secret phrase, your password, or any device other than the one they paired with.

How we use your data

• To create and secure your account (your password is hashed — we never store it in plain text, and cannot look it up even internally).
• To send you a one-time confirmation link when you sign up, and periodically afterward (about once a week) to keep your email address verified — this is what lets your contacts trust that your email is real.
• To show your identity information to people you've paired with, as described above.
• To enforce the connection limits of your plan (Basic, Family, or Corporate).

Cookies

We use cookies and similar local storage for: signing in with Google (if you choose that option), keeping you logged into the app, and — going forward — anonymous analytics to understand how people use OurSecretPhrase. We don't run ads, and we don't use cookies to track you across other sites. When you first visit, a banner lets you accept or limit these to what's strictly necessary; you can change your choice at any time by clearing your browser's site data for oursecretphrase.com.

Who we share data with

We do not sell your data, and we do not share it with advertisers. The only outside parties involved are: Google (only if you choose to sign in with Google, or once we add analytics), our hosting provider (which stores the database and runs the servers), and, if you use a paid plan in the future, a payment processor to handle that transaction.

Where your data is stored

Our servers and database are hosted in the European Union. If you're located outside the EU, using OurSecretPhrase means your data is transferred to and processed in the EU.

How long we keep your data

We keep your account data for as long as your account is active. If you delete your account (see our account deletion page), we remove your personal information and any relationships/connections tied to your account within a reasonable period, except where we're required to retain limited records by law.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to certain uses of it. To exercise any of these rights, contact us — see below. If you're in the EU, you also have the right to lodge a complaint with your local data protection authority.

Children

OurSecretPhrase is not directed at children, and we don't knowingly collect data from children under 16. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page. Continuing to use OurSecretPhrase after a change means you accept the updated policy.

Contact us

Questions about this policy or your data: privacy@oursecretphrase.com.