This policy explains what Aanonimy collects, why, and what you can do about it. We have tried to write it plainly and to be specific — including about the things we cannot do for you.
Aanonimy is operated by Damain Ross, a sole trader based in Kingston, Jamaica. We are the data controller for the information described in this policy.
Contact: info@aanonimy.com
Aanonimy is a social app with two things most apps do not have: you can send end-to-end encrypted messages, and you can post and message anonymously, under a pseudonym the person you are talking to cannot connect to your account.
The app is free; optional one-time purchases add credits for anonymous posts.
You can browse without signing up. Without an account you can see the feed and read comments and replies. Posting, commenting, replying, liking, reposting, searching, opening someone's profile and messaging all need an account.
Even without an account, some information is still processed: crash reports, general usage measurement, and your device's advertising identifier for ads (Section 7). We do not have your email, your name or any profile, because you have not given us one.
Aanonimy is not offered in the European Economic Area, the United Kingdom or Switzerland, and is not made available to download there. Elsewhere it is available where the app stores list it.
The app can be used in English, Spanish, French and Portuguese. This policy is written in English, and the English text is the one that applies.
Some features described in this policy — editing posts and comments, See translation, the personalised Home feed, and the app languages — reach people through app updates. If your version of the app does not have one of them yet, you cannot use it. Two things still reach you whatever version you use: people on a newer version may see automatic translations of what you post (Translations, Section 3), and a post you see may have been edited even if your version does not show the “Edited” marker or its earlier versions.
Our website has a waitlist. If you join it, we store your email address and the date you joined, to email you once when Aanonimy launches. Nothing else is done with it — no newsletter, no sharing. The launch email is sent from our aanonimy.com mailbox, which is hosted by Spacemail. We delete the list once the launch email has been sent, and we delete your address sooner if you ask — email info@aanonimy.com. The site also has a sign-up form for our closed test on Google Play: it stores the email address you give so we can add you as a tester. To stop automated abuse, both forms keep a one-way hash of your IP address for a short time. The website does not use analytics or advertising cookies. It loads fonts from Google Fonts, and its email-verification page loads Google's Firebase library, so Google sees your IP address. The full notice is shown beside the form.
When you add a location to a post you can type a place name, or tap to find places near you. These are different, and only the second one uses your device's location:
We never track your location in the background, and we never read it unless you tap that button.
When you register: email address, username, display name, and date of birth.
Optional, only if you add them later: profile photo, biography, and phone number. Leaving them blank is fine, and you can remove any of them again at any time in the app. Removing your phone number also removes it as a way to sign in.
Posts (text, photos, video), comments, replies, voice notes, messages, chat and profile backgrounds, and a location label if you add one — either typed by you, or a place name you picked from the nearby-places list (Section 3).
Posts. You can edit a post within one hour of posting it, at most twice. You can change its words, its photos and videos, and its location. The post then shows that it was edited, and anyone who can see the post can also see its earlier versions — the earlier words, photos and videos — until the post is deleted. This applies to anonymous posts too. A location you change or remove is not kept in that history. Editing does not remove anything you posted before; deleting the post does.
Comments and replies. You can edit the words of a comment or reply while the comments you wrote it in are still open on your screen. It then shows “Edited”. The earlier words are not shown to anyone in the app, but we keep them, visible only to our moderators, so that a report about what a comment said can still be checked. They are deleted with the comment or reply.
To show you content in languages you read, and to offer translations, the app works out which language a post, comment or reply is written in. This happens on your device, using Google's ML Kit: it reads the words — or, for a post with no words, the text in its first photo or video frame. Only the result — a language code such as “es” — is saved with the content, where anyone can see it. The words and the text read from the image are not sent anywhere and not saved. ML Kit does send Google technical information about how it is performing — for example your device model and operating system — never your content (Section 9). The language of an anonymous post is not detected; it is saved as unknown.
Your account also stores the languages you read (set automatically from your phone's language and region, and changeable in Settings → Language) and the language you use the app in, so that notices we send you are in that language.
Under a post, comment or reply written in a language you do not read, you can tap See translation. Its words are sent through our server to a translation service — Microsoft Translator first; if that is unavailable, Google Cloud Translation; if that is unavailable too, Google's Gemini model on Vertex AI (Section 9). Only the words are sent: never photos, videos, voice recordings or messages, and never the account details of the reader or the writer. Messages are never translated. The translation is saved next to the original, so the next reader who asks gets it without another request, and it is deleted when the original is. Because translation happens when a reader asks, the words you post may be sent for translation by other people. Anonymous posts are not offered for translation.
To choose what to show you on Home, your account keeps a record of:
Only you can read this record. It is stored in your account, and the app on your phone keeps a copy so the feed loads quickly. It is not used for ads and not shared with anyone. The authors of anonymous posts are never recorded in it, and it does not change what you see in the Following feed.
Who you follow and who follows you, who you have blocked, what you have liked, disliked and reposted, your anonymous messaging identifier, whether you accept anonymous messages, your read-receipt and notification preferences (including conversations you muted), the items in your activity feed, your anonymous-post credit balance and records of your anonymous posts, any suspension or other action on your account, counters we use to limit abuse (for example how many times you asked for a phone verification code, or how many translations you asked for that day, counted against a one-way hash of your account identifier), which one-time tips you have dismissed, your device's push-notification token, which version of the Terms and this Policy you accepted and when, and a fingerprint (a hash) of each photo or video you attach to a post, used only to find copies of a file when a copyright notice is actioned (Terms Section 18).
A connection flag records whether you are online, so others can see it. It records connection state only.
Read receipts can be turned off in the app; when off, we do not share that signal.
⚠️ Online status cannot currently be switched off. Read receipts can; your online indicator cannot.
If you report content, we store the report with your account identifier, a reference to the content reported, and the reason. If you report a person, the report names them the way you saw them: their account, or — from an anonymous chat — their anonymous identity, never the account behind it. See Section 8 for how long.
When a post, comment or reply is created or edited, its text and images (photos, and a still frame of each video) are checked automatically: first against a word list on our servers, then by OpenAI's moderation service (Section 9). OpenAI receives only that content — never your account identifier, username, pseudonym, messages or voice recordings. If something is flagged — or if the check could not run — a record naming the content goes to our moderators, who decide. The checks can flag content about self-harm for our moderators; that is not monitoring of people and not an intervention service.
If the birthday entered at sign-up is under the minimum age, the app stores on your device only the time sign-up reopens (24 hours later). The birthday itself is not stored, and nothing about your birthday is sent.
When you report a post about self-harm, the app offers a link to Find A Helpline (findahelpline.com), run by ThroughLine. Opening it takes you to their website with your device's two-letter region setting (for example “JM”) in the address, so it can list helplines for your country. From then on you are on their website, under their privacy policy (Section 9). Nothing is sent unless you open the link.
From time to time the app may ask Google Play to show its rating window. Whether it appears is up to Google, and any rating or review you give goes to Google Play under Google's terms, not to us. The counts the app uses to decide when to ask — how long it has been installed, on how many days you used it, and how many things you did — are kept on your device only.
To provide the service; to operate anonymous messaging and posting; to show and deliver content, including ranking the feed and suggesting people; to personalise your Home feed (Section 3); to detect the language of content and translate it when someone asks (Section 3); to show ads (Section 7); to measure how the app is used and fix crashes (Section 7); to enforce our rules and act on reports; to process purchases; to send account notices; and to meet legal obligations.
We do not sell your personal information.
We do not use your content to train AI models, and Aanonimy has no chatbot.
Content goes to an outside AI model for two jobs only: OpenAI's moderation service checks new and
edited posts, comments and replies (Automated checks, Section 3), and when someone taps
See translation, Google's Gemini model may be the service that translates the words
(Translations, Section 3). Under the terms these providers give us, what we send them is
not used to train their models.
Encrypted end to end — we cannot read it: the content of your messages, including text, media and voice notes. The keys are generated and held on your device. Our servers store only ciphertext. The only key material we hold is your encrypted key backup, which we cannot open without your password. Your password is sent to our sign-in service and to Firebase Authentication when you sign in, but we never store it. The backup is only as strong as your password, so choose a strong one.
Not end-to-end encrypted:
Two consequences worth understanding:
If you send a message to someone who has blocked you, it is not delivered. It is rejected and deleted on our servers, and the recipient receives nothing. Your app may still show it as sent — we do not tell you that you have been blocked, because doing so would expose the person who blocked you.
When you message someone anonymously they see a name like Nameless-XXXXX. That
displayed name is a random name chosen for the pair of you, so a different person sees a
different name for you, and nothing on screen lets two recipients tell they are talking to the
same person. It never changes for that person — if you tell them who you are, that is
irreversible for that conversation.
Underneath the displayed name, your account has one anonymous identifier that is the same in every anonymous conversation you have. It is not shown in the app, but it travels inside the message data that recipients' devices receive. Someone who inspected that data with tools could see that two of your anonymous conversations came from the same anonymous identity. It would still not tell them who you are: the link between that identifier and your account exists only on our servers.
Anonymous posts carry a per-post token unrelated to your account and unrelated to your messaging identifier, so posts and chats cannot be linked to each other, and two anonymous posts cannot be linked to each other either.
⚠️ This is anonymity towards other users, not towards us. We hold the mapping between your account and your pseudonyms, and will disclose it where legally compelled (Section 11).
Receiving anonymous messages is off unless you turn it on (Account settings). If you block or report an anonymous sender, what is stored is their anonymous identity, never their account. Blocking it never touches the sender's account; only a moderator acting on a report can act on the account behind a pseudonym, and the app never shows them who it is.
Aanonimy shows ads through Google AdMob. You will see them in the feed, between posts, and in the comments on a post.
Ads are not personalised. We ask Google for non-personalised ads on every request, so the ads you see are chosen from the app and the screen you are on, not from a profile of you. The AdMob SDK still reads your device's advertising identifier — a resettable ID that is not your name or your account — for frequency capping, fraud prevention and aggregate reporting, together with general information such as your device type, your approximate region and the app you are using. We do not send AdMob your email address, your username, your posts, your messages, or the link between your account and any anonymous pseudonym.
Each ad carries the AdChoices icon; tapping it opens Google's controls for that ad, including the option to stop seeing it. You can also reset or delete your advertising ID at any time in your device settings (on Android under Google settings → Ads).
The app includes Firebase Analytics, which records general usage — that the app was opened and for how long, your device model and operating system, your approximate region, an app-instance identifier and, unless you have deleted or reset it, your device's advertising identifier. It tells us how the app is used so we can improve it. It does not receive your messages, your posts, your profile, or the link between your account and any anonymous pseudonym.
The app also includes PostHog, a product-analytics service, on a small set of screens: the sign-up steps, the paywall and the post composer, the chat list and chat, Account Centre, and the activity feed. For those screens it records that the screen was opened, how long it was on screen, and named actions on it — for example that a purchase was started or cancelled, or that a message was sent and whether it was text, photo, video or voice. Events carry a random identifier for the app installation, not your account: we never give PostHog your account identifier, email, username, pseudonym, or any content, and PostHog never records what is on your screen. It also records, for the whole app, that the app was installed, opened or closed. Each event also carries technical details of your device — its model, operating system, app version, screen size, language, timezone, and whether it is on Wi-Fi or mobile data (with the mobile carrier's name) — and an approximate location (country and a rough position, accurate to hundreds of kilometres) that PostHog estimates from your IP address. Your IP address itself is discarded and not stored. Its data is stored in the United States and kept for 12 months. PostHog never records your screen: session recording is switched off.
The app includes Firebase Crashlytics, which sends us a report when the app crashes so we can fix it. A report contains technical details of the crash — where in the code it happened, your device model, the operating system version, the app version, and a Crashlytics installation identifier. It does not contain your messages, your posts or your profile.
| Data | Kept |
|---|---|
| Account record and profile | Until you delete your account |
| Posts, comments, replies | Until you delete them, or your account |
| Earlier versions of an edited post | Visible to anyone who can see the post, until the post is deleted — by you, by us, or with your account |
| Earlier words of an edited comment or reply | Seen only by our moderators; deleted with the comment or reply |
| Translations of content | Until the original is deleted |
| Your Home-feed record | Seen posts 7 days; people you asked to see fewer from 30 days; interaction scores fade over about 30 days; “Not interested” until you delete your account. The copy on your phone stays until you uninstall the app or clear its data |
| The languages you read, and your app language | Until you change them or delete your account |
| Message content | Until deleted by either participant; when both sides clear a conversation, messages up to the earlier point are deleted from our servers |
| Presence flag | Cleared when you disconnect |
| Reports you filed | 12 months after the report is resolved, while it still identifies you — longer only while an appeal or legal matter about it is open. Your identifier is removed when you delete your account, if that comes first |
| The anonymised copy of a report | Kept indefinitely. It contains nothing that identifies the person who reported |
| Reports about a person (from anyone) | Deleted when that person deletes their account, and 12 months after the report is resolved — except reports on child-safety grounds, which are kept as described below |
| Notices about your content | 12 months, or until you delete your account, whichever is first |
| Content we removed for breaking the rules | A copy — including any earlier versions of an edited post, comment or reply — is kept so the removal can be appealed and reversed, and so acting on a report is not what destroys the evidence. Deleted with your account. Child-safety material is the exception below |
| Usage analytics events (PostHog) | 12 months, then deleted. Never linked to your account |
| Copyright notices (Terms Section 18) | At least 6 years, as a business record. If the notice named your account as the poster, we remove our internal link to your account when you delete it, although a username the claimant typed stays on their notice; the notice itself survives |
| Records of child-safety cases — removed material, reports about an account on child-safety grounds, and that account's email, phone number, date of birth and username | Kept indefinitely, including if the account is deleted, so they can be given to law enforcement. See our Child Safety Standards |
| Purchase and payout records | At least 6 years, because Jamaican tax law requires records substantiating income. These come from Google, the merchant of record — we never receive or store your card details, and they are records of money paid to us, not a history of what you bought. RevenueCat, which validates purchases, holds a record of your purchases against your account identifier; we delete that record when your account is deleted. Google keeps its own order records as the merchant, and we keep Google's payout reports as our tax records |
You can delete your account in the app (Account Center → Account status → Delete account). Deletion is not immediate: there is a 14-day grace period, and signing back in during those 14 days cancels a deletion you requested yourself; a deletion we started for repeated copyright complaints is not cancelled by signing in. After that, your data is erased (within about a day).
Deleting your account removes your profile, your posts, comments and replies, your private encryption keys and key backups, your purchase balance, your follows, your blocks and everything else that points at you. Six things stay, each on purpose:
Everything else we hold is either deleted with your account or contains nothing that identifies anyone. Your posts' earlier versions, the earlier words of your comments and replies, translations of your content, your Home-feed record and your language settings are all deleted with your account. Other people's Home-feed records may still hold the internal identifier of an account they interacted with; once that account is deleted, it no longer leads to anyone.
| Provider | Purpose | Their policy |
|---|---|---|
| Google (Firebase) | Sign-in, database, file storage, presence, push notifications, server functions, anti-abuse | firebase.google.com/support/privacy |
| Google Play | Purchases and refunds (merchant of record) | policies.google.com/privacy |
| Google AdMob | Serving ads in the feed and in the comments — see Section 7 | policies.google.com/technologies/ads |
| Firebase Crashlytics | Crash reports, so we can fix what breaks — see Section 7 | firebase.google.com/support/privacy |
| Firebase Analytics | General usage measurement — see Section 7 | firebase.google.com/support/privacy |
| PostHog | Product analytics on selected screens — see Section 7 (random install identifier; device details and approximate location; no account data; IP not stored; no screen recording; United States) | posthog.com/privacy |
| Google Fonts and Google connectivity check | The app downloads its logo font from Google Fonts and checks whether you are online by contacting a Google address — Google sees your device's IP address | policies.google.com/privacy |
| Spacemail | Hosts our aanonimy.com mailbox — the emails you send us and the waitlist launch email | spaceship.com/legal/privacy-policy |
| RevenueCat | Purchase validation and entitlements | revenuecat.com/privacy |
| Google Maps Platform | Place search — receives what you type when searching for a place, and your coordinates only when you tap “find places near you” (Section 3) | policies.google.com/privacy |
| OpenAI | Automated moderation — receives the text, photos and a still frame of each video of new and edited posts, comments and replies (Section 3); never messages, voice recordings, account identifiers or pseudonyms. United States | openai.com/policies/privacy-policy |
| Microsoft (Azure AI Translator) | Translation — receives the words of a post, comment or reply when a reader taps See translation (Section 3); never account details. Microsoft states that text sent for translation is not stored and not used for training. May be processed outside the United States | privacy.microsoft.com/privacystatement |
| Google Cloud Translation | Translation, used when Microsoft's service is unavailable — receives the same words. Google states it does not use them to improve its models; it may keep them for a few days to run the service reliably. May be processed outside the United States | cloud.google.com/terms/cloud-privacy-notice |
| Google Vertex AI (Gemini) | Translation, used only when both services above are unavailable — receives the same words and an instruction to translate them. Under Google's terms they are not used to train its models; Google may keep them briefly to run and protect the service. May be processed anywhere Google operates | cloud.google.com/terms/cloud-privacy-notice |
| Google ML Kit | Detecting the language of content on your device (Section 3). Your content stays on the device; ML Kit sends Google technical information about its performance — device model, operating system, app version and similar | developers.google.com/ml-kit/terms |
| Google Play (in-app review) | Showing Google's rating window when the app asks; any rating or review you give goes to Google Play (Section 3) | policies.google.com/privacy |
| ThroughLine (Find A Helpline) | Only if you open the helpline link: their website receives your device's two-letter region setting in the address, and what any website receives when you visit it (Section 3) | findahelpline.com/privacy |
| vxtwitter | Fetching a preview image when a post links to X/Twitter. Called from our server, not your device — it receives the link, never your IP address | github.com/dylanpdx/BetterTwitFix |
| YouTube · TikTok · Vimeo · Spotify · SoundCloud | When a post links to one of these, your device asks that platform's own public preview service for a title and thumbnail — so the platform sees the link and your device's IP address, as it would if you opened the link | Each platform's own policy |
When a post contains a link, we try to show a preview of it.
If you send us a copyright notice (Terms Section 18), we keep what you gave us — your name, email address, organisation, the work, the content you identified, your statements and signature — for at least six years, as the record that we acted. We tell the person who posted the content that a complaint was received. If they send a counter-notice, we send it to you, and we send your notice to them, so that the two of you can take the matter further; that is how the counter-notice procedure works. We do not use a notice for anything else, and the notice form sets no cookies.
A small number of people help run Aanonimy — for example reviewing content that has been reported. They act on our instructions and under obligations of confidentiality. They are not separate controllers of your information, and they may not use it for their own purposes.
Access to the moderation tools is restricted: it requires a specific authorisation on the account, enrolment on an allow-list, and a second authentication factor.
A reviewer sees the content that was reported. They are not shown the real account behind an anonymous post or an anonymous message — that link stays on our servers and is never sent to the tools they use.
All personal data we store is in the United States, on Google's infrastructure.
Translation is processed elsewhere. When a reader asks for a translation, the words being translated may be processed by Microsoft or Google outside the United States; their translation services do not let us choose the location. The translation itself is stored with us, in the United States. Some of the other providers in Section 9 may also process data in other countries under their own terms.
Why we may do that. Aanonimy cannot be provided without hosting it, and you contract with us for the service — so the transfer is necessary to perform our contract with you, the condition in section 31(4)(b)(i) of Jamaica's Data Protection Act.
We may disclose information, including the link between an account and its anonymous pseudonyms, where required by law or where necessary to investigate serious harm — including child sexual abuse material.
If we believe someone is at imminent risk of death or serious injury, we may share what we hold about the account — including the link to its pseudonyms — with emergency services or the police, so that they can act.
You must be at least 16 to use Aanonimy, anywhere it is available. This is checked at sign-up from your date of birth, and enforced on our servers as well as in the app — so editing the app does not get past it.
See our Child Safety Standards for what we prohibit and what we do about it.
If you are in Jamaica: you have the right to access and to correct your personal data under the Data Protection Act, and the right to complain to the Information Commissioner. We respond within 30 days.
If you are in California: the right to know, delete and correct, and to opt out of sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising — the ads in Aanonimy are not personalised (Section 7).
| What we do | On what basis |
|---|---|
| Run your account, store and deliver your posts and messages, operate anonymous posting and messaging, process purchases | Necessary to perform our contract with you — DPA s.23(1)(b)(i) |
| Keep the service secure, prevent abuse, enforce our rules, act on reports | Our legitimate interests, and those of other users — s.23(1)(f) |
| Meet legal obligations, including child-safety and law-enforcement duties | Compliance with a legal obligation — s.23(1)(c) |
| Show content you chose to make public, including the earlier versions of a post you edited | You published it — s.23(1)(g) |
| Personalise your Home feed; detect the language of content; translate content when a reader asks | Our legitimate interests, and those of other users, in showing people content they can read and want to see — s.23(1)(f) |
| Optional profile details you choose to add | Your consent — withdraw it by removing them — s.23(1)(a) |
You can change your name, username, photo, biography and phone number yourself in Edit Profile and Account Center; edit your posts, comments and replies within the limits in Section 3; delete them, or your whole account, from the app; undo a Not interested right after choosing it; and change the languages you read and your app language in Settings → Language. For anything else: email info@aanonimy.com. We respond within 30 days.
Data is encrypted in transit. Message content is end-to-end encrypted (Section 5), and key material is held in your device's secure storage; we hold only an encrypted backup of it that we cannot open without your password. Access to our systems is restricted by server-side rules, and most requests from the app are attested to reduce abuse.
If there is a breach. If personal data is lost, exposed or accessed without authorisation, we report it to Jamaica's Information Commissioner within 72 hours of becoming aware, and we tell everyone whose data is affected — what happened and what we are doing about it.
We will post material changes here with a new “last updated” date. For significant changes, we will also tell you in the app. A summary of a change may be shown in the app's language; this English policy is the one that applies.
Last updated: 6 October 2026