Android package: com.bgappsch.secretsanta
Last updated: 7 September 2026
Secret Santa Draw is published by BG Apps. This policy explains exactly what the app stores, where it stores it, and who can read it. It is written to be read, not to be scrolled past.
THE SHORT VERSION
There is no account, no email address and no password. The app never asks for your real name, your contacts, your location, your photos or your files.
If you run an exchange entirely on one phone ("Solo draw"), nothing leaves the device at all.
If you run a shared exchange, four things are stored: the name of the exchange, the display name you type, your wishlist text if you write one, and who you are buying for. That last one is stored so that exactly one device can read it - yours.
WHAT IS STORED, AND WHERE
On your device only
Solo exchanges: the names you type, any keep-apart rules, the budget and date, and the result of the draw. This is a database on your phone. It is never uploaded.
- Your theme choice, your reminder preference, and the display name you last used.
- A list of the shared exchanges you have joined, so the app can show them without a network call.
Uninstalling the app deletes all of this.
In Google Cloud Firestore (shared exchanges only)
Stored in Google's European region (eur3), under a Firebase project operated by BG Apps:
The exchange: its name, an optional budget, an optional date, and the six-character join code.
- Each participant: the display name they typed, and whether they are still taking part.
- Each participant's wishlist text, if they write one.
- Each participant's assignment: the single person they are buying for.
- Anonymous questions between a gifter and the person they are buying for.
The join code is the only thing protecting an exchange from strangers, which is why it is six characters from an alphabet with no easily-confused letters.
Identity
Signing in is anonymous. Firebase Authentication issues your device a random identifier so the database can tell participants apart. It is not linked to a Google account, an email address, or anything else about you. Reinstalling the app produces a new identifier, which is why you have to rejoin an exchange with the code after a reinstall.
WHO CAN READ YOUR ASSIGNMENT
Only you.
This is enforced by the database's own security rules, not merely by the app: the server will hand your assignment to your device and refuse it to every other device, including the organiser's.
Two things follow from that, and both are stated here rather than buried:
The organiser takes part like everyone else and does not see the pairings. The draw is computed on the organiser's phone, because the free Firebase plan this app runs on has no server to compute it on. The app does not display the result to them and the database will not hand any of it back afterwards. This is enforcement by app and by security rules - it is not cryptography, and a determined organiser running a modified copy of the app could observe the draw at the moment it is computed on their own device.
When somebody leaves an exchange after the draw, the one participant who was buying for them is allowed to read that person's assignment, so their own device can repair the ring and give them a new giftee. That permission exists only while the person is flagged as having left, and only for that one participant. Nobody else, the organiser included, gains anything.
REPORTING AND BLOCKING
Wishlists and anonymous questions are text written by other people, so the app lets you do something about text you should not have to read.
Hiding is immediate and local. A message, a whole conversation or a giftee's wishlist that you block disappears on your phone and stays hidden after a restart. It is stored on your device only: nobody else is told, and it is not a decision imposed on anyone else.
Reporting also sends the text to BG Apps for review, together with the reason you picked, any note you add, your anonymous identifier, the join code and the location of the text in the database. It is stored in the same Firebase project, in a collection nothing in the app can read back - not you, not the organiser, not another participant. Reports are read only by BG Apps, in order to act on them.
Reporting is the one case in which the text of a private message is copied out of the conversation it was written in, and it happens only when you choose to report it.
ADVERTISING
The app shows a banner advert on some screens. Adverts are supplied by Google AdMob, which receives your device's advertising identifier and coarse technical information about your device in order to select an advert. AdMob is a third party and acts as a data controller for that information; its own policy applies: https://policies.google.com/technologies/partner-sites
No advert is shown on the screens that reveal a name: the reveal card, the pass-the-phone list, and the anonymous question thread.
In the European Economic Area, the UK and Switzerland, the app asks for your consent through Google's User Messaging Platform before requesting any advert. You can change that choice at any time in the app under Settings > Privacy > Ad privacy options.
ANALYTICS
None. There is no analytics SDK in this app. Google Analytics is deliberately switched off on the Firebase project.
HOW LONG DATA IS KEPT
On-device data: until you delete the exchange or uninstall the app.
- Shared exchange data: until the exchange is deleted on request. An exchange is a seasonal thing; if you would like one removed, write to the address below with its join code.
- Leaving an exchange in the app removes you from its participant list and removes the exchange from your phone.
CHILDREN
The app is not directed at children and does not knowingly collect data from anyone under 13.
YOUR RIGHTS
If you are in the EEA, the UK or Switzerland you have the right to access, correct, or delete the data described above, and to object to its processing. Because the app holds no account, the practical route is to write to the address below and tell us the join code and the display name you used.
CONTACT
CHANGES
If this policy changes, the date at the top changes with it.