Tarci Secret Privacy Policy

1. Data controller and contact

The data controller for personal data processed through Tarci Secret is Stalin Yamarte, in relation to the application published under the identifier com.yamarte.tarcisecret.

For privacy inquiries, data deletion or exercising your rights, you may contact us via the support email indicated at the end of this policy and on the support page of this website.

2. What Tarci Secret is

Tarci Secret is an application for organizing private group social dynamics, such as secret santas, raffles, teams, pairings, duels and other group activities.

The App is designed for families, friends, classes, companies, communities and any group that wants to organize special moments with clarity and privacy.

3. Data the app may process

Tarci Secret may process data entered by users and data generated when using dynamics, including:

• Names or aliases of participants and organizers
• Group and dynamic names
• Subgroups, rules, event dates and optional budget
• Wish lists when the user completes them
• Messages in secret santa group chat, after the draw is completed
• Invitation codes and metadata associated with their use
• Private assignments and draw results
• Language preferences and app settings

The App processes only the data necessary to provide the service. It does not sell personal data to third parties.

4. Anonymous and registered user data

Tarci Secret can be used in quick mode with an anonymous Firebase Authentication session, without requesting email or phone to get started.

In that case, anonymous technical identifiers necessary to maintain the session, associate the user with groups and protect access to private results are processed.

If you later link a registered account (for example, email or another provider), the data necessary to identify you and recover your groups on other devices may be processed, according to the features available in each version.

5. Group, participant and dynamic data

To create and manage a dynamic, the App may store group information (name, dynamic type, status, dates), participant information (alias, role, subgroup, whether they participate with the app or as a managed person) and rules configured by the organizer.

Draw or dynamic results are stored so that each person accesses only what applies to them, except in dynamics with results visible to the whole group (for example, some raffles or team assignments).

6. Participants without app and minors managed by adults

An organizer or responsible adult may add participants who do not use the App (family members without a phone, colleagues without an account, etc.). In those cases, at minimum a name or alias visible in the group is processed.

The responsible adult may receive privately the result they must deliver to that person. The rest of the group cannot see those delegated assignments.

Tarci Secret is not primarily directed at minors. However, it allows a responsible adult to add children as managed participants within a family or group dynamic, under their supervision and responsibility.

7. Invitation codes and private assignments

Invitation codes allow joining a group. They are processed with security measures; they are not stored in plain text permanently when the service's technical policy allows it.

Secret santa assignments and other private dynamics are generated on the server and shown only to the corresponding person or the responsible party who must deliver them. The organizer does not need to see all private results by default.

8. Purposes of processing

We process personal data to:

• Create and manage groups and dynamics
• Allow joining via invitation code
• Execute draws, assignments and subgroup rules on the server
• Display private or public results depending on the dynamic type
• Manage participants without app and managed persons
• Maintain service security, stability and integrity
• Diagnose errors and improve performance
• Measure usage in aggregated form if analytics is active in the installed version

9. Technical providers: Firebase / Google

The App uses Google Firebase services and other Google services as technical providers, which may include:

• Firebase Authentication (sessions, including anonymous)
• Cloud Firestore (dynamic data storage)
• Cloud Functions (draw logic and server-side rules)
• Firebase Cloud Messaging (notifications, if you accept them)
• Firebase Remote Config (remote configuration)
• Firebase Analytics or other measurement tools, if active

Google acts as a processor under its terms. You can review its policy at https://policies.google.com/privacy.

10. Analytics, diagnostics and performance

Depending on the installed App version, aggregated usage, diagnostic and performance data may be collected to understand how the service is used and fix issues.

We do not use this data to sell personally identifiable information to third parties. If analytics is not active in a specific version, that processing will not apply in that version.

11. Data retention

Tarci Secret retains dynamic data for as long as necessary to enable operation. As a general rule, data associated with a completed dynamic may be retained for up to 90 days after its completion or draw, unless the user requests deletion earlier or there is a legitimate need for technical, security or support retention.

After that period, dynamic data may be deleted from the system automatically or manually according to the technical processes in place at the time.

12. Data deletion request

You may request deletion of data associated with Tarci Secret via the official page https://yamarte.com/tarci-secret/en/delete-data/ or by writing to the support email indicated on this website.

To help us locate the information, please indicate if possible the group name, invitation code, associated email if applicable, alias used in the app and a clear description of the request.

For security, we may request additional information to verify that the request corresponds to the appropriate person before deleting data. Some requests may require manual review if they affect shared groups or other participants' data.

13. Security and privacy by design

We apply reasonable technical and organizational measures, such as database access rules, backend draw execution and minimization of information visible to each role.

Privacy is part of the product design: each dynamic shows only what applies to each person. No system on the Internet can guarantee absolute security; we recommend not publishing invitation codes in open places.

14. Transfer or sale of data

Tarci Secret does not sell personal data to third parties.

We only share data with technical providers that help us operate the service (such as Google/Firebase), under contractual and security obligations, or when required by law.

15. Rights and contact

Depending on your country of residence, you may have the right of access, rectification, erasure, restriction, objection or other rights regarding your personal data.

To exercise them, write to the support email. We will respond within a reasonable timeframe and may request data to verify your identity or your relationship with a group.

16. Changes to this policy

We may update this policy to reflect legal, technical or product changes. We will publish the current version at this URL with the «Last updated» date.

If changes are significant, we will endeavour to inform you reasonably within the App or on this website.

Contact and data deletion

Stalin Yamarte · Yamarte Apps
soporte.tarcisecret@gmail.com
https://yamarte.com/tarci-secret/en/delete-data/
Support