Privacy Policy

1Million Secrets · 995 Studio · Version 1.0 · Effective date: November 10, 2026

1. About this policy
2. What anonymity means
3. Information we collect
4. Why we use information
5. Legal grounds
6. Who receives information
7. Legal requests and safety
8. Advertising and your choices
9. Receiving and notifications
10. Retention and deletion
11. Security and international processing
12. Your privacy rights
13. Adults only and changes

1. About this policy

This Privacy Policy explains how 1Million Secrets (also written "One Million Secrets") handles personal information when you use its mobile app for iPhone, iPad and Android, related account services, customer support and purchase features. The app is for adults aged 18 or older. It lets an eligible user send a message to one randomly selected eligible recipient without showing either person's account identity to the other.

The operator and data controller is Tien Dang, an individual trading under the brand 995 Studio, located in the United States. 995 Studio is a brand name, not a separate incorporated company. "We", "us" and "our" mean that individual operating the service.

Privacy contact, support and safety reports: support@995studio.com · 995studio.com/one-million-secrets
Account deletion page: 995studio.com/one-million-secrets/delete-account.html

This policy is a notice about our practices, not a waiver of your privacy rights. Acknowledging it does not mean you consent to optional advertising tracking or to every possible use of your data. Where the law requires separate permission, we ask for it separately.

2. What anonymity means

Other users are not shown your name, email address, sign-in details, account identifier, profile picture, payment information, or the identity of the person on the other end of a message. Each accepted message goes to one recipient selected by the service. It is not a public post, and it is not the start of a conversation: recipients cannot reply.

The service itself is not anonymous. We keep account and message records that link messages, sender and recipient user identifiers, delivery events, reports and enforcement actions. Authorized personnel and service providers may access relevant records to operate the service, investigate abuse, resolve support issues or meet legal obligations. Messages are stored encrypted at rest by our infrastructure provider and sent over encrypted connections, but they are not end-to-end encrypted and are not inaccessible to us.

Your words may identify you even if you do not include a name. A recipient can copy, screenshot or share a message, and the app lets recipients share text they received. We cannot guarantee that a recipient will keep it confidential. Do not include phone numbers, email addresses, passwords, financial details, exact locations, or identifying information about yourself or another person. Automated filters may miss disguised contact details or harmful content.

3. Information we collect

Account information

We collect the full name you enter (required, private, never shown to other users), your email address, account user ID, account creation time, sign-in provider (Google, email and password, or Apple), email verification status, and account status. When you sign in with Google or Apple, we receive the account information that provider shares with us. Email and password credentials are handled by our authentication provider (Firebase Authentication); we never see or store your password. We also store the avatar you choose from the app's built-in set (visible only to you), your device's time zone, and the date and version of your agreement to the Terms, Privacy Policy and Community Guidelines.

Age: you confirm that you are 18 or older when you create your account, and we record that confirmation. We do not ask for your date of birth or an identity document, and we do not use a third-party age-verification provider.

Messages and activity

We store the text of messages you send (up to 2,000 characters), sender and recipient account IDs, submission and delivery times, delivery status, your sent and received history, your receiving settings, and hide and block actions. "Received" means a message was placed in the recipient's inbox, not that it was read. We also keep your daily streak and quota and credit status.

Drafts: text you are writing stays in the app's memory on your device and is not uploaded until you tap Send. It is cleared when you sign out. The app checks your draft for contact details and harmful words on your device as you type.

Reports and moderation

When you report a message, we collect the reported message and account references, your account ID, the reason category, an optional note of up to 250 characters, the submission time, report counts, and any resulting restriction (temporary or permanent ban). These records are stored in restricted, server-only form linked to both the reporter's and the reported account. The reported user never sees who reported them or the text of the reporter's note.

Credits and purchases

We keep your credit balance, a ledger of credits added and spent, rewarded-ad verification records, store transaction and product identifiers, purchase time, amount and currency when the store provides them, payment status, refunds and reversals, and whether you own the Remove ads purchase. Apple and Google process all payments. We never receive your full card number or security code.

Device and service information

To run and secure the service we process your IP address, app version, operating system, device type, app language, timestamps, authentication and security events, an app-integrity token from Firebase App Check (using Google Play Integrity on Android and Apple's App Attest or DeviceCheck on iOS), and your push notification token. Our server logs these technical details without message text, names or tokens. The app does not currently include a separate analytics or crash-reporting SDK.

Our advertising partner, Google AdMob, processes advertising identifiers (on Android), ad impressions, clicks, rewarded-ad completion events, and approximate location inferred from your IP address. See section 8.

Information stored only on your device

Your app language, dark mode and background color choices are saved on your device only and are never sent to us.

Communications and choices

We keep support correspondence, privacy requests, and records of the Terms and Privacy Policy versions you accepted and when. The app does not request access to your contacts, microphone, camera, photo library or precise location. If a future optional feature needs additional access, we will explain it and ask for any required permission first.

4. Why we use information

• To provide the service: sign you in, accept and randomly deliver messages, show your history, apply your receiving settings, show delivery status and support your account.
• For credits and purchases: verify purchases with Apple and Google, add and deduct credits, verify rewarded ads, restore Remove ads, prevent duplicate rewards and handle refunds.
• For safety: we use message text, reports and limited technical data to detect prohibited content and contact details, investigate threats and harassment, prevent fraud and ban evasion, enforce the age requirement, and protect users and the service. Text is checked automatically before it is sent, both in the app and on our server. Authorized reviewers may look at reported content. Filters and reviewers can make mistakes, and this is not continuous emergency monitoring.
• To operate and secure the service: diagnose failures, prevent abuse, and measure performance.
• To communicate with you: send notifications you allowed, and essential account, safety, purchase and policy notices.

We do not use private message content to personalize advertising, and we never send message text, your name or your email to advertising partners. We do not send marketing emails.

5. Legal grounds where required

Where a law (such as the GDPR or UK GDPR) requires a legal basis, we rely on:

• Performance of our agreement with you for essential account, delivery, history and purchase functions;
• Legal obligations for required records, such as tax and accounting records, and lawful requests;
• Legitimate interests for proportionate fraud prevention, service security, abuse review, enforcement of our rules, and defense of legal claims, after weighing your rights;
• Consent for push notifications and any optional tracking or other processing that legally requires consent; and
• Vital interests in a genuine emergency where that ground is available.

You can withdraw consent to notifications in your device settings or in Account → Settings → Notifications, and you can withdraw other consent by contacting support@995studio.com. Withdrawal does not affect earlier lawful processing.

Sensitive information. Please do not include sensitive information such as health details, sex life or sexual orientation, religious or philosophical beliefs, political opinions, racial or ethnic origin, government identifiers, or information about alleged crimes. If you choose to include it in a message, we process it only to deliver, store and moderate that message as you asked, and we do not use it to profile you or infer anything about you. Sending a message to one stranger does not make it public.

6. Who receives information

Message recipients receive the message text and its delivery time, without your account identity.

Service providers process data for us under their terms with us:

Apple and Google also process information connected with app distribution, purchases and platform services under their own privacy policies (Apple, Google). Google may act as an independent controller for some advertising data; see how Google uses information from apps that use its services.

We may share limited information with professional advisers, insurers and service providers helping with legal or security matters, under confidentiality. If the service is transferred to someone else, relevant records may be transferred subject to applicable law and any required notice or consent; a transfer does not authorize unrestricted reuse of private messages.

7. Legal requests and safety disclosures

We may preserve or disclose relevant account, message, report, device and transaction records when required by valid legal process or applicable law, or when a lawful, necessary and proportionate disclosure is justified to address a serious safety threat, prevent fraud, protect legal rights or respond to an emergency.

We assess the legal basis and scope of each request and disclose only what is reasonably necessary. A request from police does not automatically entitle them to all account information, and cross-border requests must meet applicable legal requirements.

We may tell you about a request when legally required or otherwise appropriate. We may delay or omit notice where the law prohibits it, or permits withholding it to protect a person, preserve an investigation or avoid undermining a lawful request.

8. Advertising and your choices

The free version shows banner ads at the bottom of the Inbox and Sent screens. Watching a rewarded ad is optional and earns one credit after Google confirms the ad was completed, up to three rewarded ads per calendar day in your account's time zone. Choosing not to watch ads never removes your free daily send.

The one-time Remove ads purchase removes banner ads from your account while the service and your entitlement remain available. You can still choose to watch rewarded ads. Remove ads does not change the security, purchase or performance processing described above.

How ads use your data. Google AdMob uses device and network information to show ads, limit fraud, measure performance and verify rewards.

• On iPhone and iPad, the app does not ask for App Tracking Transparency permission, so it does not access your device's advertising identifier (IDFA) or track you across other companies' apps and websites.
• On Android, AdMob may use your device's advertising ID and may show personalized ads. You can delete or reset your advertising ID, or opt out of ads personalization, in your device's Settings (Google → Ads, or Security & privacy → Privacy → Ads, depending on your device). You can also manage Google ad personalization at My Ad Center.

Sale and sharing. We do not sell personal information for money, and we never sell, share or disclose message content for advertising. However, allowing Google AdMob to use advertising identifiers and related data to show personalized ads may count as "sharing" for cross-context behavioral advertising or "targeted advertising" under some US state privacy laws, such as California's. The categories involved are device identifiers, internet or network activity (ad interactions) and approximate location from IP address, and the recipient is Google. To opt out, use the Android settings above, or email support@995studio.com with the subject "Opt out of sharing" and we will help.

9. Receiving controls and notifications

You choose whether to receive messages automatically when you set up your account, and you can turn Receive automatically on or off at any time in Account → Settings. Turning it off stops new matches and cancels any free receive still waiting; a message already delivered before your change stays in your inbox. It does not erase existing messages or recall copies already delivered. If you use Receive more with automatic mode and turn it off, a credit for a request still waiting for a message is returned to you right away.

Notification permission can be changed in your device settings and in Account → Settings → Notifications. Notifications never contain message text. They say only that a message arrived (for example "A message found you") or that your account status changed, though they can still be seen on a lock screen or shared device. Turning notifications off does not turn off receiving; use the separate receiving setting.

Block stops future matching between you and that anonymous sender without revealing their identity, and the sender is not told. Hide removes a message from your inbox on all your devices; it does not delete our record of the message. These are separate controls.

10. Retention and deletion

We keep information only as long as needed for the purpose it was collected, subject to legal obligations and proportionate safety needs.

How to delete your account: in the app go to Account → Settings → Delete account, or follow the steps on our account deletion page. Uninstalling the app, hiding messages, signing out or turning off receiving does not delete your account. We confirm requests with a recent sign-in or by replying from the email address on the account; we do not ask for identity documents.

What deletion does: your sign-in account is deleted; your name and profile are erased; your sent and received history, notices, payment history view and devices are removed; messages you sent that are still waiting are withdrawn; and the text of messages you sent that were already delivered is erased from recipients' inboxes. We keep only the limited records described in the table above, with restricted access. Unused credits are lost when you delete your account; store refunds are handled by Apple or Google.

Copies made outside the service, such as screenshots or shared text, are beyond our control. We keep only genuinely anonymized statistics as non-personal data; replacing a name with an ID is not anonymization.

11. Security and international processing

Our safeguards include: encrypted connections (TLS) between the app and our servers; storage encrypted at rest by Google Cloud; sign-in through Firebase Authentication so we never store passwords; app-integrity checks with Firebase App Check; database rules that block apps from reading other users' data or writing data directly; server-side verification of every purchase and reward; least-privilege service accounts; and server logs that leave out message text, names and tokens. No internet service is completely secure. Keep your sign-in details private, and tell support@995studio.com right away if you think your account has been compromised. If a breach affects your personal information, we will notify you and the authorities where the law requires.

Your data is processed in the United States, where our Google Cloud servers are located, and by Apple and Google wherever they operate. Where transfer rules apply (for example for users in the European Economic Area, United Kingdom or Switzerland), we rely on our providers' Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another lawful mechanism. Contact us for information about these safeguards. Accepting the Terms is not a substitute for a lawful international-transfer mechanism.

12. Your privacy rights

Depending on where you live, you may have the right to:

• access, or get a copy of, your personal information, including in a portable format;
• correct inaccurate information (you can change your name in the app once every 3 days);
• delete your information;
• restrict or object to certain processing;
• withdraw consent;
• opt out of sale, sharing or targeted advertising (see section 8);
• limit the use of sensitive information; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects.

To make a request, email support@995studio.com with the subject "Privacy request", from the email address on your account if you can. We verify your identity proportionately, respond within the deadline set by applicable law (for example one month under the GDPR, or 45 days under California law), and explain any lawful refusal, extension or fee. An authorized agent may act for you where the law permits and their authority is verified. We will not discriminate against you for exercising your privacy rights.

If we deny your request, you can appeal by replying to our decision with the subject "Privacy appeal". We will review it and answer within the time required by applicable law. If you are not satisfied, you may contact your state Attorney General or other regulator.

Users in the EEA, UK and Switzerland may complain to their local data-protection authority, and other users may complain to their local privacy or consumer regulator. You do not have to contact us first if the law lets you complain directly.

Automated decisions. Two parts of the service make decisions automatically:

• Content filter: the app and our server check messages for contact details and listed harmful words. Text that matches cannot be sent, and you can edit it and try again. If our server rejects a message, your free send is restored or your credit is returned.
• Report thresholds: reports are counted when they are accepted. At 3 counted reports an account's sending and receiving are banned for 3 days, at 4 for 7 days, and at 5 permanently. These bans take effect automatically, without a person reviewing each report first.

If you believe an automated decision about you was wrong, email support@995studio.com. A person will read your message and we will correct verified errors, such as a technical fault or reports we find were invalid or coordinated.

13. Adults only and policy changes

1Million Secrets is not intended for anyone under 18, even where a local digital-consent age is lower. Do not create an account or use the service if you are under 18. If we learn an account belongs to someone under 18, we restrict access and delete the data or keep only what the law requires. To report suspected underage use, contact us without sending unnecessary information about the child.

We may update this policy to reflect real changes to the app or the law, and the effective date and version will change. For material changes, we will notify you in the app before they take effect and ask for new consent where the law requires it. Continued use alone is not consent to new optional tracking or sensitive-data processing.

Contact

Tien Dang, trading as 995 Studio
United States
support@995studio.com