O Amigo Secreto Privacy Policy
Last updated: July 12, 2026
Your privacy is important to us. This policy explains how we collect, use and protect your personal information when you use the Secret Santa app.
The controller of your data is the team behind O Amigo Secreto, which you can contact at the email listed at the end of this page. We process your information in compliance with the GDPR and with Brazil's LGPD data protection law. You have the right to access, correct, export and delete your data, as well as to withdraw consent at any time. We collect only what is necessary to run the draw, the wishlists and the chat, and we never sell your personal information.
1. Data We Collect
Account Information
- •Email (for authentication)
- •Name (for group identification)
- •Profile photo (optional)
Usage Data
- •Groups you participate in
- •Draw results (private)
- •Anonymous chat messages
- •Wishlist
- •First-party product events, such as invite opened, signup, group creation, and draw completion
2. How We Use Your Data
- Authentication: Allow secure access to your account
- Features: Run draws, send messages, manage groups
- Communication: Send notifications about activities in your groups
- Support: Answer your questions and requests
- Product improvement: Use first-party analytics to understand which steps work and where the experience needs improvement
3. Data Security
- Encryption: All data is transmitted via HTTPS
- Passwords: Stored with bcrypt hash
- Tokens: JWT authentication with expiration
- Draws: Results visible only to the participant
4. Your Rights
- Access: Request a copy of your data
- Correction: Update incorrect information
- Deletion: Request removal of your account and data
- Portability: Download a JSON copy of your data from the app
- Withdrawal: Withdraw optional marketing measurement consent at any time
5. Data Sharing
We do not sell your data. We share what is necessary with your group participants, essential providers, and when required by law. Conversion events are sent to Meta only after explicit in-app consent; they may include a hashed account identifier and, when applicable, a hashed email, never messages or wishlists. Withdrawal cancels pending or retrying deliveries.
6. Cookies and Tracking
The website and app use local storage and first-party analytics to understand feature usage. With separate website consent, Google Analytics uses _ga cookies; this choice can be changed in the footer. We do not track your location or collect data from other apps. External Meta measurement in the app is also optional, off by default, and can be withdrawn from your profile.
7. Data Retention
We keep your data while your account is active or for as long as needed for the stated purposes and legal obligations. Before deletion, ownership of groups with other approved participants must be transferred manually and accepted by the new owner; groups without an eligible recipient are removed. Identification and delivery data for sponsored prizes is retained for 5 years after delivery to meet legal and regulatory obligations. After that period, personal data in the claim and its terms PDF are purged, while non-PII audit dates and identifiers may remain. When marketing measurement is withdrawn, consent ends immediately and deliveries not yet made are cancelled.
8. Minors
The app is intended for users 13 and older. We don't intentionally collect data from children under 13. If you're responsible for a minor and believe they provided personal data, please contact us.
9. Changes to This Policy
We may update this policy periodically. We'll notify you of significant changes through the app or email. We recommend reviewing this page regularly.