Privacy

What the person you message can see

When you send someone a message, they see:

• the text of your message and your later replies;
• any voice note you send, which they can listen to. A voice can be recognised. If you choose a voice mask, it is applied on your device before anything is sent, so we never receive your unmasked voice. A mask makes a voice harder to recognise, not impossible;
• when each one was sent;
• a random nickname, such as “Anonymous Fox 42”, that is different for every conversation;
• any reaction you add to their replies.

They never see your name, email address, phone number or IP address, and we never sell or reveal who sent a message. This is true whether or not you are signed in. If they have Plus or Creator Pro, they can also get the hints described below.

What anonymous does not mean

• What you write can identify you. Details only you would know, or the way you write, can give you away.
• You are anonymous to other users, not invisible to us. We keep the limited data described below so that replies can reach you and abuse can be limited.
• If a court or law enforcement agency lawfully requires it, we may have to hand over the data we hold.

Revealing who you are

In a conversation, either person can ask to reveal. The sender’s identity is shown only if both people agree, each choice is private, and a request can be declined without the other person being told. What is revealed is a name the sender chooses, plus their username and profile photo if they have a link of their own. It applies to that one conversation. Nobody can pay to see your name: that takes your yes.

Hints

When you send someone a first message, we note a few things that don’t name you: the kind of phone or computer you used (such as “iPhone” or “Samsung Galaxy”), your country, looked up on our own server from your network address, which we don’t keep, the app you found their link in when it can be told (such as Instagram or WhatsApp), the date and time you first opened their link, and how many times you opened it. The location lookup uses GeoLite2 data created by MaxMind, available from maxmind.com. If they have Plus or Creator Pro, they see these hints once you answer a request to reveal, whether you say yes or no. Without that answer, or on the free plan, they see none of it.

We also note your phone’s model name (such as “Samsung Galaxy A15”; on an iPhone, the few models that share your screen size, such as “iPhone 12, 13, 14 or 16e”, from a cookie that lasts a day), its system version (such as “Android 14”) and your browser. With Plus or Creator Pro, they see these only if you agree to reveal who you are, and no longer if you both go back to anonymous. If you say no, they never see them.

What we store if you send a message

• Your messages, so the recipient can read them and you can see replies.
• Your voice notes, as audio files in private storage. They can only be played by you and the person you sent them to, through links that stop working after a few minutes.
• A cookie on your device holding a random secret. It is how you get back to your chats. Scripts on the page cannot read it.
• Scrambled identifiers worked out from that secret. One is specific to each person you message, and lets them block you without learning who you are. Another groups your own chats together so you can list them. Neither can be turned back into the secret, and neither is shown to anyone.
• Your network address is used, in scrambled form that changes every day, to limit how fast messages can be sent, and looked up once on our own server for the country in your hints. The address itself is not stored.
• Hints: your kind of device, its model name, system version and browser, your country, where you found the link, and when and how often you opened it, as described above. Visits are forgotten after 90 days.

If you sign in, your chats are linked to your account so you can reach them from other devices. The people you message still cannot see who you are.

What we store if you create a link

• Your name, email address and profile picture from Google, or the email address you sign in with.
• Your username, display name, colour, and the words you choose to filter.
• Your profile photo, if you add one. It is public: anyone with your link can see it. We shrink it on your phone before uploading, which also removes its location and camera details.
• The messages you receive and the replies you send.
• A scrambled record of each sender you block.

Reports

When either person reports a conversation, we save the reason and a copy of its most recent messages so that the report can be reviewed. That copy is kept even if the conversation is later deleted.

How long we keep things

• Conversations are kept until the person who received them deletes them. Deleting removes the messages and voice notes for both people.
• If you leave a conversation you sent, you lose access to it, but the recipient keeps their copy.
• The cookie lasts about 13 months and is renewed when you send.

Analytics

We count page visits and a few actions, such as a message being sent or a link being created, to understand whether the product is working. We do not record what you type, what you click, or your screen, and message text is never sent to our analytics provider.

Companies that process data for us

• Convex stores the database.
• Upstash stores voice notes and profile photos.
• If you turn on notifications, your browser's push service (run by Google, Apple or Mozilla) delivers them. A notification says that a message arrived, never what it says.
• Railway hosts the website.
• Amazon Web Services delivers sign-up and password reset emails, once they are switched on.
• Cloudflare checks that senders are people, when that is needed.
• PostHog provides analytics and error reports.

Your choices

• Link owners can pause their link, delete conversations and block senders.
• Senders can leave a conversation or report it.
• Clearing your browser’s cookies removes a guest sender’s access to their chats.
• You can delete your account from Settings. That removes your link, every conversation sent to it and your sign-in details. Messages you sent to other people stay with them, but you lose access and they are no longer linked to you.

Age

DropAsecret is for people aged 18 and over. If you are younger, do not create a link or send messages.

Changes

If we change what we collect or how we use it, we will update this page and the date at the top.