Hidden Letter is a private-letter application that lets you hide text, voice recordings, documents, photos, and videos inside a cover image, protect them with unlock conditions, and publish or discover location-based secrets through Secret Map.
Effective Date: October 23, 2026
This privacy policy is provided in English for users in the European Union/European Economic Area (GDPR) and residents of California (CCPA/CPRA). Users in China (PIPL) may obtain a Chinese version by contacting lisongtao@appifun.com.
APPIFUN (hereinafter referred to as "we" or "the Company") operates the Hidden Letter mobile application (hereinafter referred to as "the App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the App. We are committed to protecting your privacy and complying with applicable data protection laws and regulations, including but not limited to the Personal Information Protection Law of the People's Republic of China (PIPL), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and its amendment, the California Privacy Rights Act (CPRA).
By downloading, installing, or using the App, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App. We may update this Privacy Policy from time to time and notify you of material changes through in-app announcements or other prominent means. Your continued use of the App after such changes constitutes acceptance of the revised policy.
This Privacy Policy applies only to the App and does not apply to information collected through other channels (such as third-party websites linked within the App).
Important Privacy Summary
We only collect information necessary to enable the core functions of this App (letter creation and unlocking, Secret Library, Secret Map, sharing, feedback, etc.), and strictly adhere to the principle of data minimization. Permission-based features are requested only when you use the related functionality.
The in-app agreement screen makes connection probes and a pixel request, which expose normal connection metadata such as IP address. Detailed device diagnostics are sent after the disclosed agreement and Start action; this does not grant camera, microphone, or location permission.
Information you actively enter or authorize while using the App, including but not limited to:
With your permission, the App may access your approximate or precise location to display Secret Map, find nearby secrets, publish a secret, and verify location-based unlock conditions. Nearby queries send coordinates to our service; publishing makes the secret's location available to other users. You can manage location permission in iOS Settings at any time. If location access is denied, location-dependent features may be unavailable while other letter features remain available.
When you create or unlock a letter, Hidden Letter processes its content and protection settings on your device. Secret Map encrypts the secret body locally before publishing; its cover image, public clue, coordinates, and unlock range are not encrypted with that body. Unlock passwords are used locally and are not included in the Secret Map publishing request.
We always adhere to the principle of data minimization, collecting only the information necessary to provide corresponding functions. For PIPL (China users), we ensure collection is lawful, legitimate, necessary, and transparent; for GDPR (EU/EEA users), processing is based on your consent or legitimate interests; for CCPA/CPRA (California residents), we do not sell personal information.
We use the collected personal information for the following purposes:
Purpose: Display Secret Map, find and publish nearby secrets, and verify location-based unlock conditions.
Control: You can disable location access at any time in iOS Settings. Other letter features remain available.
Purpose: Enable Quick Unlock on supported devices. Authentication is performed by iOS; the App does not receive your biometric template.
Control: Use is subject to your device authentication settings and your choice to enable Quick Unlock.
Purpose: Capture images and scan unlock QR codes.
Control: Requested only when you use the camera feature.
Purpose: Save secret images, unlock QR codes, and recovered media to your library; system pickers let you choose images to import.
Control: Requested only when you use related features.
Purpose: Record voice letters.
Control: Requested only when you initiate recording.
Purpose: Import the documents or media you select through iOS file and media pickers.
Control: You choose which files to provide through the system picker.
Purpose: Retrieve maps and public time, publish and manage map secrets, submit feedback and reports, and make disclosed diagnostic connections.
Hidden Letter only requests permissions necessary for the features you choose to use. We do not request unrelated permissions such as contacts, calendars, or Bluetooth access.
All permission usage is intended to improve user experience and provide core features, and strictly complies with this Privacy Policy.
Network Security: Secret Map, public time, and diagnostic requests use HTTPS. The current in-app feedback endpoint uses unencrypted HTTP; do not include passwords, secret content, or sensitive information in feedback.
| Purpose | Information Used | Legal Basis (GDPR/PIPL/CCPA) |
|---|---|---|
| Secret Map | Location, public image and clue, encrypted secret, unlock range, device identifier, platform | Contract necessity / Necessity / Business purpose |
| Local Letter Features | User-selected text, media, files, and unlock conditions | Consent / Necessity / Business purpose |
| Feedback | Feedback text, app ID | Consent / Legitimate interest / Business purpose |
| Security | Technical logs and related data | Legitimate interest / Legal obligation / Business purpose |
We use the following third-party services, SDKs, or external resources to provide specific application features. The data involved depends on your usage and configuration.
| Name | Purpose | Function / Description |
|---|---|---|
| Secret Map and Public Time Services | Location-based secrets and time checks | app.back.appifun.com handles map records and reports; timeapi.io and worldtime.timezone.io provide public UTC checks |
| Lottie (lottie-ios) | Animation rendering | Plays JSON animations within the iOS App |
| DeviceDataIOSSDK | Device diagnostics and connection checks | Connects to de.dooxoop.online for agreement-screen probes and a pixel request, and sends the disclosed device diagnostics after the agreement and Start action |
| Apple MapKit / Core Location / AVFoundation | Maps, location, and media | Provides maps and device location, captures images and audio, and plays selected media using iOS system frameworks |
| Icons8 | Icon resources | Some icons in the App are sourced from Icons8 under their license. See icons8.com |
We may share your personal information only in the following circumstances:
We do not sell your personal information to third parties.
Regarding international data transfers:
We implement appropriate technical and organizational measures to protect your personal information, including encrypted transmission where supported, access controls, and regular review of our practices. However, no system is completely secure, and we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected users and relevant authorities in accordance with applicable law.
We retain personal information only for as long as necessary to fulfill the purposes described or as required by law. For example:
Depending on your region, you may have the following rights regarding your personal information:
Please contact us using the information in Section 12 to exercise your rights. We may need to verify your request before responding.
Public clues, images, locations, and other user-provided information available through this App are for reference only and do not constitute professional legal, medical, safety, or emergency advice. Use your own judgment when visiting a location or relying on information published by other users.
For Reference Only: Public clues, images, and secrets are supplied by users. Such content may contain inaccuracies and should not be relied upon as the sole basis for important decisions.
Independent Decision-Making: Any actions you take based on user-provided content are your own responsibility. Please verify important information through official sources when necessary.
This App is not intended for children under the age of 16 (or the minimum age required by applicable local law). We do not knowingly collect personal information from children. If we discover that we have collected such information, we will delete it promptly. Parents or guardians may contact us to review or request deletion of such data.
If you have any questions, complaints, or wish to exercise your rights, please contact:
Company: APPIFUN
Address: FLAT A 15/F, GOLDFIELD INDUSTRIAL BUILDING, 144-150 TAI LIN PAI ROAD, KWAI CHUNG NT, HONG KONG (Room A, 15/F, Goldfield Industrial Building, 144-150 Tai Lin Pai Road, Kwai Chung, New Territories, Hong Kong)
Email: lisongtao@appifun.com
Support Email: lisongtao@appifun.com
Phone: +86 18986000384
Website: https://www.appifun.com
We may update this Policy due to operational or legal requirements. We will notify you through in-app announcements, email, or other prominent methods where appropriate. The updated Policy becomes effective from the date of publication unless otherwise stated.
This Privacy Policy applies to APPIFUN, which acts as the personal information processor (data controller) of this App. APPIFUN assumes responsibility for the collection, use, disclosure, and protection of personal information described in this Policy, as well as related legal responsibilities. If you have any questions or wish to exercise your rights, please contact APPIFUN directly (see Section 12 "Contact Us").