Information we process
- Workspace or tenant identifiers, installation tokens, conversation coordinates, and user identifiers supplied by Microsoft Teams, Slack, or Outlook.
- Secret metadata such as sender and recipient references, creation and expiry times, view limits, status, and audit events.
- Encrypted secret material. Depending on the selected security level, content is encrypted by the service or in the sender's browser before upload.
- Support details you choose to submit, including your name, email address, organisation, product area, topic, and message.
- Operational records such as request timestamps, error details, rate-limit counters, and security events. We do not intentionally write secret plaintext or access tokens to logs.
Billing and member assignments
Billing stores organisation-scoped keyed hashes of platform user identifiers, platform names, display labels, persistent physical-seat/purchase references, original referral bindings, cancellation history, usage periods, scheduled releases and necessary Stripe customer/subscription references. Organisation administrators manage organisation-funded assignments and see aggregate capacity; an employee-funded subscription's invoices, payment methods and customer portal are private to its verified payer. Financial attribution and cancellation history are retained to prevent reattribution, duplicate discounts and fraud.
An email used to find a member is resolved only through that organisation's installed platform and is not retained in billing state. These hashes are pseudonymous, not anonymous. Raw platform IDs are retained separately only where necessary for platform delivery. Stripe processes payment details; SecretBridge does not store your full card details. Partners see only their own aggregate commissions, never customer identities or secret contents.
Partner accounts and referral choices
Partner accounts are separate from platform users and do not grant access to customer secrets or organisation billing. Partner email addresses, authenticator secrets and short-lived email-delivery payloads are encrypted in storage; passwords use salted, slow password hashing. Email lookup indexes are keyed hashes. Resend processes your email address and authentication messages for delivery. The signup and password-reset security checks use the isolated hCaptcha provider.
A necessary first-party login cookie contains an opaque token, is inaccessible to scripts, and expires after eight hours; idle sessions expire after 30 minutes. It is not used for advertising. An optional first-party referral cookie is set only after you choose to remember a partner referral, and lasts up to 30 days. You can instead enter a referral code manually at checkout without this cookie. Referral visits store only a hashed opaque token, public code, partner reference and expiry—not your email address, IP address or secret activity.
Commission accounting stores keyed organisation hashes, necessary Stripe invoice/customer/subscription references, public codes, rates and money amounts. Partners see aggregates rather than customer identities. Verification challenges and encrypted outgoing code messages expire after 10 minutes and are removed by bounded maintenance. Financial attribution and commission records are retained for accounting, fraud review and applicable legal requirements. Contact the secure support form to request partner-account access, export, correction or deletion.
Partner introductions
A partner invitation displays a public alias and sets no invitation-tracking cookie. With your explicit registration consent we save a provisional invitation using internal partner references. After email verification, you may confirm or decline it while enrolling your authenticator. Only confirmation creates the permanent immediate-introducer relationship. Existing partners separately accept the updated terms before inviting anyone. We store signed relationship and terms-acceptance records, mode-separated earning-window dates, payment-linked bonus amounts, refunds and reviewed settlement references for accounting and fraud prevention. Re-registration cannot change an existing relationship.
Introducers see their own aggregate counts and bonus amounts, not introduced partners' email addresses, customer identities, platform users or secret activity. Partner verification and settlement information is processed only through the appropriate private publisher or payout-provider route. Introduction records are retained with financial records for accounting, fraud review and applicable legal requirements; contact support about access, correction or deletion requests. We do not sell this information.
Why we process it
We process this information to deliver one-time secrets to intended recipients, verify platform requests, prevent abuse, enforce expiry and reveal policies, provide audit history, administer billing and persistent seat assignments, and operate and secure the service.
Retention and deletion
When a secret is burned, revoked, or expired, access is removed from the live service immediately and it cannot be revealed again; lifecycle cleanup removes its encrypted material from the current row. For Levels 1 and 2, encrypted backups created before that event can retain the encrypted material and wrapped key for up to 7 days; recovery is technically possible only to an authorised operator with access to both the backup and the separate Key Vault wrapping key. Levels 3 and 4 are server-blind: SecretBridge never receives their content key, so a database backup alone cannot decrypt them. Metadata and security audit records may be retained longer for abuse prevention, support, compliance, and incident investigation. Support tickets have a 90-day live retention limit from creation; scheduled cleanup removes expired encrypted ticket rows. Infrastructure backups can retain them for up to 7 more days. Optional mailbox copies are retained as needed to resolve and document the request. Removing the app revokes the removed conversation as a delivery destination; an organisation may still have other active installations and records.
Security and international processing
SecretBridge uses encryption in transit, encrypted storage, tenant-scoped routing, short-lived grants, and access controls. Browser-created public links encrypt and decrypt the secret on the user's device. No system can guarantee absolute security. Information may be processed in the regions selected by the service operator and its cloud and collaboration-platform providers.
Read the Security overview for current trust boundaries and limitations.
Your choices
Your organisation controls installation and may remove the app. Contact your organisation's administrator or the secure support form to request access, correction, export, or deletion where applicable. We may need to verify the request and preserve records when legally required.
Changes
We may update this policy as the service or legal requirements change. The effective date above identifies the current version.