Privacy Policy

Overview

secret.pics ("secret.pics", "we", "us", or "our") lets people turn a picture into a reveal game: a creator hides an image behind numbered masks, and players lift those masks by answering challenges. This Privacy Policy explains what personal information we collect when you use secret.pics, how we use and share it, and the choices and rights you have. It applies to our website and games hosted on it.

The data controller for the personal data described here is Menoux Studio, a French société par actions simplifiée à associé unique (SASU) with share capital of €1,000, registered with the Rennes Trade and Companies Register (RCS Rennes) under number 931 785 893, whose registered office is at 41 rue Danton, 35700 Rennes, France. For any privacy question or to exercise your rights, contact us at privacy@secret.pics.

We keep data collection to what the product needs. Playing a game never requires an account, and we ask players for an email address only when a specific game is configured to require one.

Information we collect

We collect the following categories of information:

• Account information (creators): when you sign in to create games, we receive your email address, and — if you use Google sign-in — your name and profile picture as provided by Google. Authentication is handled by our identity provider (Supabase Auth).
• Game content (creators): the images you upload, the questions and accepted answers, prompts, themes, rewards, and settings you configure. Your original uploaded image is stored privately and is never sent to players; players only ever receive flattened composites of the masks they have already unlocked.
• Player information: when a game requires it, the email address you enter at the gate (and, for age-restricted games, your confirmation that you are 18 or older). Photo answers you upload for "photo" challenges are shown to the game’s creator for approval.
• Gameplay and usage data: events such as game views, guesses, mask completions, and rewarded-ad views, tied to a per-browser participant identifier rather than to your real-world identity.
• Device and log data: IP address, browser type, device and operating system information, referring pages, and timestamps, collected automatically by our servers and infrastructure providers for security and reliability.
• Cookies and similar technologies: see "Cookies and advertising" below.

How we use information

We use the information above to:

• Provide and operate secret.pics — host games, check answers, persist progress, and reveal earned masks.
• Authenticate creators and secure their accounts and games.
• Send transactional emails, such as sign-in / magic links, gate-verification links, and game-related notifications.
• Enforce per-day guess limits and prevent abuse, brute-forcing, and fraud.
• Moderate content and respond to reports, keeping the platform safe-for-work.
• Measure and improve the product, understand aggregate usage, and fix problems.
• Serve advertising on eligible safe-for-work games, as described below.
• Comply with legal obligations and enforce our Terms.

Cookies and advertising

We use cookies and similar technologies for essential purposes — keeping you signed in, remembering a per-browser participant identifier so your progress persists, and remembering that you have seen a game’s intro. These are necessary for the service to function.

On eligible safe-for-work games we may show advertising provided by Google. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visit to secret.pics and/or other sites on the Internet.

You can opt out of personalized advertising by visiting Google’s Ads Settings (https://www.google.com/settings/ads) and the third-party opt-out tools at https://www.aboutads.info/choices and https://www.youronlinechoices.eu. Advertising is never shown on age-restricted or suggestive games, and appears to players only when they choose to watch a rewarded video in exchange for extra tries.

Where required in the European Economic Area, the United Kingdom, and Switzerland, we request consent for non-essential cookies and for personalized advertising through a Google-certified consent management platform before such cookies are set. You can change or withdraw your consent at any time.

Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract (to provide games you play or create); our legitimate interests (to secure, operate, measure, and improve the service, and to prevent abuse); your consent (for non-essential cookies and personalized advertising, and where a creator collects your email at a gate); and compliance with legal obligations.

How we share information

We do not sell your personal information. We share it only as follows:

• Service providers who process data on our behalf, including hosting and database (Supabase), file storage and delivery (Cloudflare R2), and transactional email (Amazon SES).
• Advertising partners (Google) for serving and measuring ads on eligible safe-for-work games, as described above.
• Game creators receive the emails players submit at that game’s gate and any photo answers submitted to that game. A creator’s use of that information is governed by their own practices.
• Legal and safety: to comply with the law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of our users, the public, or secret.pics.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Data retention

We keep personal information for as long as needed to provide the service and for the purposes described in this Policy — for example, while a creator account or a game is active — and then delete or anonymize it, unless a longer retention period is required by law or to resolve disputes and enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be retained.

Security

We use administrative, technical, and organizational measures designed to protect personal information, including private storage of original images, signed access tokens for earned content, and encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International transfers

We and our service providers may process and store information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, for international transfers of personal data.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal data; to object to or restrict certain processing; and to withdraw consent. If you are in California, you may have rights to know, delete, and opt out of the "sale" or "sharing" of personal information; we do not sell personal information.

To exercise any of these rights, email us at privacy@secret.pics. You may also opt out of personalized advertising using the tools listed under "Cookies and advertising", and you can control cookies through your browser settings. You have the right to lodge a complaint with your local data protection authority; in France, our lead supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris (www.cnil.fr).

Children’s privacy

secret.pics is a general-audience, safe-for-work service and is not directed to children. We do not knowingly collect personal information from children under 13 (or under the minimum age required in your country). If you believe a child has provided us personal information, contact us and we will delete it.

User-generated content

Games are created by our users. While we screen uploads automatically and provide a Report link on every game, creators are responsible for the content and challenges in their games and for how they use any emails players submit. Avoid entering sensitive personal information into a game’s challenges or answers.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of secret.pics after an update means you accept the revised Policy.

Contact us

For privacy questions or to exercise your rights, contact us at privacy@secret.pics. For anything else, reach us at contact@secret.pics.