Start 7-day free trial

Privacy Policy

Effective October 1, 2026

This Privacy Policy explains how Inflight Technology LLC ("we", "us") collects, uses, and protects information through Squawk Secret, including our website at squawksecret.com and the Squawk Secret service. We do not sell personal information, we do not share it for advertising, and we do not use advertising or analytics trackers.

Our role

For information about account holders, such as your name, contact details, and billing, Inflight Technology LLC decides how it is used and is responsible for it.

For the content you send and collect through Squawk Secret, and for information about the people you send it to or collect it from, you (or your organization) decide what is sent and to whom. We handle that information only to operate the service on your behalf, as described here and in our Terms of Service. If you received a Squawk Secret link or request and have questions about what was shared with you or asked of you, please contact the person or organization who sent it.

Information we collect

When you create an account

  • Your first and last name, email address, mobile phone number, and mailing address.
  • A password, which we store only as a scrypt hash and cannot read.
  • If you turn on two-step verification, the setup key for your authenticator app (stored encrypted) and your recovery codes (stored only as one-way hashes).
  • Confirmation that you verified your email address and mobile number, and when.
  • Your organization's name, and your role in it.

When you invite a team (Business plan)

  • The email addresses you invite, and the first and last names, email addresses, and roles of team members.
  • Your organization's logo, if you upload one. It is shown to people who open your team's links and in emails sent on your behalf.

When you pay

  • Your plan, seat count, subscription status, and renewal date, and identifiers for your customer and subscription records at Stripe.
  • We send Stripe your name, email address, mobile number, and mailing address so your invoices are accurate and to help prevent fraud. Your card number goes directly to Stripe. We never receive or store it.
  • A fingerprint Stripe provides for your card (not the card number), so each card can be used for only one free trial.

When you send a secret

  • The content itself (text and files), stored only in encrypted form. The key needed to decrypt it is part of the link you share and is never stored by us.
  • Settings and records about it: when it was created, its expiration and view limit, whether a passphrase is required, the file names and sizes of any attachments, who created it, and the IP address it was created from.
  • Recipient email addresses, if you ask Squawk Secret to email the link for you, along with whether the email was delivered.
  • Access restrictions, if you use them: the email addresses allowed to open a secret (we email each person a one-time code when they ask to open it, and record which address was verified) and the IP addresses or networks it may be opened from.

When you create a request

  • Request templates you save, which your organization's members can reuse.
  • The subject and message you write for the request, which are shown to the person responding and are not encrypted.
  • The responses you receive (text and files), stored in encrypted form. The names, types, and sizes of files in a response are stored unencrypted so you can see what was sent.

When someone opens your link or responds to your request

  • The time, IP address, browser information, and outcome of each attempt to open a secret, and the time and IP address of each response to a request. This record is shown to the sender so they can confirm who accessed what and when.

People who open Squawk Secret links or respond to requests do not need an account and are not asked for any other information.

Security and activity records

  • Sign-ins, sign-in failures, password resets, verification steps, team changes, and billing events, with the time, IP address, and browser information. When your account signs in from a new device, we email you the time, browser, and IP address.
  • Our web servers also keep standard technical logs of requests to the website, including IP addresses.

When someone reports a link

  • The reason and any details the reporter enters, and the reporter's IP address to prevent misuse of the report form. Reports are not shared with the sender.

When you contact us

  • The information you include in your message.

How we use information

  • To provide the service: creating and delivering secrets and requests, erasing them on schedule, managing teams, and showing senders their access records.
  • To verify accounts and prevent abuse: confirming your email address and mobile number, requiring a payment card before a plan starts, rate limiting, and investigating reports of misuse. This keeps the service from being used by throwaway accounts to send harmful content.
  • To bill you through Stripe.
  • To communicate with you: service email only, such as verification, password resets, invitations, read receipts, and important changes to the service or these policies.
  • To keep the service secure and to comply with the law.

Text messages

We text your mobile number only to send verification codes when you sign up or change your number. We do not send marketing texts. Message and data rates may apply. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes.

How we share information

We share information only as follows:

  • Service providers that operate parts of Squawk Secret for us, under agreements that limit their use of the information:
    • Stripe: payment processing and billing. Stripe's handling of your payment details is governed by its own privacy policy.
    • Twilio: sending mobile verification codes and checking that a number is a valid US mobile number.
    • Microsoft: delivering email sent by Squawk Secret.
    • IONOS: hosting our servers.
  • Within your organization: Business plan administrators can see their team members' names, email addresses, and roles.
  • With senders: the access record described above for links they created.
  • For legal reasons: when required by law or legal process, or when needed to protect the rights, property, or safety of our users, the public, or Inflight Technology LLC. Because we never store the keys to secrets, we cannot decrypt secret content for anyone, including in response to legal demands.
  • In a business transfer: if Inflight Technology LLC or Squawk Secret is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy.

Cookies and browser storage

We use only what the service needs to work:

  • sc_session: keeps you signed in. Expires after 12 hours.
  • sc_plan: remembers the plan you chose while you finish signing up. Expires after 30 days, or when you start checkout.
  • sc_authtx: used only during staff single sign-on. Expires after 10 minutes.
  • sc_theme: remembers your light or dark mode choice. Expires after one year.
  • sc_device: a random identifier for your browser, so we can alert you when your account signs in from a new device. Expires after about 13 months.

We use no advertising, analytics, or cross-site tracking cookies. Payment pages are hosted by Stripe, which sets its own cookies under its own policy. Because we do not track you across sites, browser "Do Not Track" and Global Privacy Control signals do not change how we handle your information.

How long we keep information

  • Secret content is erased within minutes after its view limit is reached or it expires. Secrets can last at most 30 days.
  • Request responses are erased when you close the request or when it expires, whichever comes first. Requests can stay open at most 90 days.
  • Records about secrets and requests (settings, access records, recipient email addresses, file names, request subjects and messages, and response times and IP addresses) are deleted 12 months after the secret was erased or the request closed.
  • Security and activity records are deleted after 12 months. Web server logs are deleted after 180 days.
  • Account information is kept while your account is open. You can delete your account at any time in Settings: this immediately erases the secrets and requests you created and removes your name from the records about them, and if you own your organization, cancels its subscription and deletes it. You can also ask us to delete your account, and we will do so within 30 days. Records we must keep for tax, accounting, or legal purposes, such as billing history, and security records within their 12-month retention period, are kept until they expire.

Erased content cannot be recovered, by you or by us.

How we protect information

Secrets and request responses are encrypted with AES-256-GCM, and the keys to secrets are never stored. All traffic uses HTTPS. Passwords are hashed with scrypt. Access is logged and rate limited. Our Security page describes these protections in detail, including exactly where encryption takes place. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.

United States only

Squawk Secret is offered only to individuals and businesses in the United States. Creating an account requires a US mailing address, a US mobile number, and a payment card, and we do not market or offer the service to people in the European Union, the United Kingdom, or any other country. Our servers are located in the United States, and information is stored and processed there.

People who receive a Squawk Secret link or request may open it from anywhere. The information recorded when they do is described above and is handled on behalf of the account holder who sent it.

Your rights and choices

You can update your information and cancel your subscription from within Squawk Secret. You can also ask us to:

  • give you a copy of the personal information we hold about you,
  • correct information that is wrong,
  • delete your account and personal information (you can also do this yourself in Settings), or
  • stop or limit certain uses of your information.

Depending on the state you live in, such as California, Colorado, Connecticut, Virginia, and others with consumer privacy laws, you may have some or all of these rights by law, along with the right to receive your information in a portable format. We will not treat you differently for exercising your rights.

To make a request, email support@squawksecret.com from the address on your account. We may need to confirm your identity before acting on a request, and we will respond within the time required by law, generally within 45 days. You may use an authorized agent where the law allows. If we deny your request, you may appeal by replying to our response.

If you received a Squawk Secret link or request and want information about it, please contact its sender; we can only confirm our own records about that link.

Children

Squawk Secret is a business service and is not directed to children under 16. We do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as Squawk Secret changes. We will post the new version here with a new effective date, and for material changes we will notify account owners by email before the changes take effect.

Contact us

Inflight Technology LLC
14 Commerce Street, Suite 106
Flemington, NJ 08822
Email: support@squawksecret.com