Privacy policy

UntoldToYou is built so that we know as little about you as possible. This policy explains what we do keep, why, and what you can ask of us.

Who we are

UntoldToYou is operated by Engineering Hub Projects SRL, Șoseaua Berceni 96, Bucharest, Romania, tax ID (CUI) RO28021976 (“we”). We are the controller of the personal data described here. You can reach us at contact@untoldtoyou.com.

What we keep

Your account: your email address, the name you choose, your language and your settings (for example how often you confirm that you're here).

Your messages: letters, photos and videos, encrypted on your device before they reach us. We store them, but we cannot read them.

Your recipients: the email address of each recipient and the question you chose for them, stored encrypted, plus the language in which they should receive emails.

Presence: when you confirmed that you're here, the reminders we sent and the state of your account.

Technical data: sign-in records and server logs (including IP addresses), kept for a short time for security.

Messages to us: what you write through the contact form or by email.

Why we use it

To provide the service you asked for: keeping your messages and delivering them as you set up (performance of a contract).

To keep the service secure and prevent abuse (legitimate interest).

To answer you when you write to us, and to meet legal obligations.

We do not sell your data, we do not use it for advertising, and we do not use tracking cookies.

About recipients

Authors give us their recipients' email addresses. We use them only to deliver that author's messages: a short advance notice when the time comes, the message itself, reminders until it is opened, and the access code. Recipients are never contacted before that.

If you are a recipient and want to know what we hold about you, or object to it, write to contact@untoldtoyou.com.

Who helps us

We use a small number of providers who process data on our behalf, under contracts that protect it: Supabase (database and storage, in Frankfurt, Germany), Resend (sending emails, from Ireland), FlutterFlow (hosting of the web app) and Cloudflare (hosting of this website).

Some of these companies are based in the United States. Where data may be accessed from outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard.

How long we keep it

Your account data and messages are kept while your account exists. When messages are delivered, they stay available to the recipient for at least 90 days.

When you delete your account, your messages, recipients and settings are deleted, and removed from our backups within 30 days. Server logs are kept for up to 30 days.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Your encrypted messages can only be read with your vault password, so we can give them to you only in encrypted form.

Write to contact@untoldtoyou.com. We answer within one month. You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or to the authority in your country.

Security

Messages are encrypted on your device with keys derived from your vault password, which never leaves your device. Recipients' contact details are stored encrypted. You can read more on our Security page.

Cookies

This website does not use tracking or advertising cookies. It remembers your language choice in your browser. The app stores only what it needs to keep you signed in.

Age

UntoldToYou is intended for adults aged 18 and over.

Changes

If we change this policy in a way that matters, we will tell you by email before the change takes effect.