The controller of your data is CODER MINDERS TECHNOLOGY LTDA (CNPJ 56.048.072/0001-63), the company behind O Amigo Secreto, which you can contact at the email listed at the end of this page. We process your information in compliance with the GDPR and with Brazil's LGPD data protection law. You have the right to access, correct, export and delete your data, as well as to withdraw consent at any time. We collect only what is necessary to run the draw, the wishlists and the chat, and we never sell your personal information.
1. Data We Collect
Account Information
- Email (for authentication)
- Name (for group identification)
- Profile photo, country and state (optional; if you leave the country blank, we may suggest one based on your connection)
Usage Data
- Groups you participate in
- Draw results (private)
- Anonymous chat messages
- Wishlist
- First-party product events, such as invite opened, signup, group creation, and draw completion
People in your family (optional)
- Nicknames of children and teens you add in My family
- Wishlists, group participation, and messages of these people, managed by you
- Date and version of the authorization you gave
2. How We Use Your Data
- Authentication: Allow secure access to your account
- Features: Run draws, send messages, manage groups
- Communication: Send notifications about activities in your groups
- Support: Answer your questions and requests
- Product improvement: Use first-party analytics to understand which steps work and where the experience needs improvement, and see which countries and states groups come from to prioritize languages and expansion
3. Data Security
- Encryption: All data is transmitted via HTTPS
- Passwords: Stored with bcrypt hash
- Tokens: JWT authentication with expiration
- Draws: Results visible only to the participant
4. Your Rights
- Access: Request a copy of your data
- Correction: Update incorrect information
- Deletion: Request removal of your account and data
- Portability: Download a JSON copy of your data from the app
- Withdrawal and objection: Withdraw optional marketing measurement consent at any time and object to the country suggestion by turning it off in the app
- Parents and guardians: access, correct, export, and delete at any time the data of the children and teens you added, directly in the app, in My family.
5. Data Sharing
We do not sell your data. We share what is necessary with your group participants, essential providers, and when required by law. Conversion events are sent to Meta only after explicit in-app consent; they may include a hashed account identifier and, when applicable, a hashed email, never messages or wishlists. Withdrawal cancels pending or retrying deliveries. The country suggestion never sends your IP address to third parties: the lookup runs on our own server, using an IP geolocation database from DB-IP (db-ip.com) under the CC BY 4.0 license. The nickname of a child or teen added in My family is shown only to participants of the groups you add them to. Texts sent to these people go through automated moderation by OpenAI, in the United States, before they are delivered.
6. Cookies and Tracking
The website and app use local storage and first-party analytics to understand feature usage. With separate website consent, Google Analytics uses _ga cookies; this choice can be changed in the footer. We do not track your precise location or collect data from other apps. If you haven't provided your country, we may estimate only your country (and, in Brazil, your state) from your connection: we use the country that Cloudflare, our network provider, detects on the request, or the IP address from your most recent session or signup. We do this based on our legitimate interest (LGPD Art. 7, IX), to understand where groups come from. It is only a suggestion: it only counts once you confirm it, it is not calculated for users under 18 or accounts without a date of birth, and it is never used for sponsored prizes, sponsored campaigns, or fraud prevention. You can confirm, correct, or turn off the suggestion in the app. External Meta measurement in the app is also optional, off by default, and can be withdrawn from your profile.
7. Data Retention
We keep your data while your account is active or for as long as needed for the stated purposes and legal obligations. Before deletion, ownership of groups with other approved participants must be transferred manually and accepted by the new owner; groups without an eligible recipient are removed. Identification and delivery data for sponsored prizes is retained for 5 years after delivery to meet legal and regulatory obligations. After that period, personal data in the claim and its terms PDF are purged, while non-PII audit dates and identifiers may remain. When marketing measurement is withdrawn, consent ends immediately and deliveries not yet made are cancelled. The country suggestion expires after 90 days and is deleted sooner if you provide your region or turn the suggestion off. The data of a child or teen added in My family is deleted when you remove them, when your account is deleted, or after 400 days without use and without an active group. Participation in draws that have already taken place is anonymized so that the results of the other participants do not change.
8. Children and Teens
You must be 13 or older to create an account.
Children and teens without an account can join groups through the account of their mother, father, or legal guardian, in the My family feature. We process this data in the best interest of the child and the teen and with the specific authorization of the person responsible for them:
- only someone who is 18 or older and has a confirmed email can add someone;
- we ask only for a nickname. We don't ask for a full name, age, photo, email, phone number, or ID document;
- the draw result, the wishlist, and the messages stay with the parent or guardian;
- messages and hints meant for children and teens go through stricter moderation and are not delivered if moderation can't be performed;
- we don't use this data for advertising, marketing measurement, store recommendations, or prizes;
- the parent or guardian can remove the person at any time, and doing so deletes their data.
If you believe a child or teen was added without the authorization of the person responsible for them, or that someone under 13 created an account, write to privacy@oamigosecreto.app.
9. Changes to This Policy
We may update this policy periodically. We'll notify you of significant changes through the app or email. We recommend reviewing this page regularly.