Last updated: 2026-10-26
Secret Santa is made by Magmanet. In short: names, draws and wishlists stay on your device. There is no app server. The app also sends anonymous usage statistics, which you can turn off.
By default, only anonymous usage statistics (see below). Secret Santa has no sign-up, no accounts, no advertising and no tracking. We never sell or share your data.
Your events (titles, themes, budgets, dates), participant names, restrictions ("who can't draw whom"), draws (with the organizer PIN, stored only as a one-way hash), wishlists, the personal codes you opened and your settings are saved only on your device, in the app's private storage. Uninstalling the app removes them.
When you send personal codes, the app builds a message for each participant containing their name, the event details
and an encrypted code holding only their own match. The message goes through WhatsApp (a wa.me link opened in your
own WhatsApp) or your phone's share sheet, to the people you choose. Magmanet never receives it. Anyone holding a code
can open it in the app, so send each code only to its person.
If you choose plain-text messages instead (an option in the settings, off by default), each message contains the name of the person the participant drew, the event details and that person's wishlist, as readable text. These messages are sent the same way, only by you, to the people you choose. If the share sheet can't open, the message is copied to your clipboard instead.
Wishlists are shared the same way, only when you tap "Share" or "Send my wishlist". The Copy backup feature copies your data as text to your clipboard; where you paste it is up to you. "Paste" in "I got a code" reads the clipboard only when you tap it.
If an event has a date and a reminder, the app schedules a local notification on your phone. Android asks for the notification permission at that moment, never at launch. Reminders are created and shown entirely on the device.
Secret Santa sends anonymous usage statistics over HTTPS (a short daily ping, plus batched usage events) to Magmanet's own server in the EU (Contabo). They include the app name and version, Android version, phone manufacturer and model, language, how the app was installed, a random install ID, and which screens and features are used (for example "draw" or "code opened", with the number of participants). They never include names, matches, codes, wishlists, titles or anything you type. The ID is hashed on the server, no IP address is stored, and raw data is deleted after 400 days. The data is never used for ads and never sold or shared.
It's on by default. You can turn it off in Settings ("Share anonymous usage statistics"); doing so stops sending and deletes the random ID and any unsent events.
RECEIVE_BOOT_COMPLETED, so scheduled reminders survive a restart).No location, camera, microphone, contacts or storage permissions are requested.
Secret Santa is not directed at children under 13.
If this policy changes, we'll update the date above. Questions: https://github.com/Shauls/magmanet-apps/issues