Privacy Policy

This policy explains what personal data Second Vision (operated by Hidden Builders) collects, how we use it, and the choices you have. It applies to the Second Vision web and mobile apps.

Depending on how you use the Service, we collect:

• Account data: the name and email address your Google account shares with us when you sign in (or, for accounts created earlier, your phone number or email address), and basic profile details you provide.
• Gameplay and assessment data: game sessions, scores, assessment responses, and the insights derived from them.
• AI feature data: the inputs and context you provide to AI features, used to generate responses.
• Payment data: purchase history and transaction references. Card and payment details are processed by Razorpay or Dodo Payments and are not stored by us.
• Attribution data: campaign parameters describing where you arrived from (e.g. utm tags) and, if you arrived from a Meta (Facebook/Instagram) ad, Meta’s click identifiers — used to measure which campaigns bring people here.
• Technical data: anonymous, aggregated usage analytics (page views and product events) via Vercel Analytics, which does not use cookies or track you across sites.

We use your data to:

• Provide the Service: run games and assessments, compute insights, and operate AI features.
• Verify your identity: sign-in uses your Google account. For accounts created earlier with a phone number, the number is used only to send one-time login codes. We do not use your phone number for marketing messages.
• Process purchases and maintain your token balance.
• Keep the Service secure, including audit logging of sensitive operations.
• Understand aggregate product usage through anonymous analytics.

Sensitive personal data is encrypted at rest using AES-256-GCM. This includes phone numbers and the content of your reflections. Data is transmitted over encrypted (HTTPS) connections.

No method of storage or transmission is completely secure, but we apply industry-standard safeguards and limit access to personal data.

The web app stores your authentication tokens and basic profile data in your browser’s local storage so you stay signed in.

We set a small number of first-party cookies prefixed "exp_" that remember which version of a page you were shown when we test copy variations (A/B experiments). These cookies contain only the variant letter, last up to 90 days, and are not used to identify you or track you across other sites.

Our analytics provider (Vercel Analytics) is cookieless and collects anonymous, aggregated usage data only.

We do not sell your personal data. We share data only with the service providers needed to operate the Service:

• Google — sign-in (OAuth). Google shares your name and email address with us when you sign in.
• Twilio — sends SMS verification codes for accounts that still log in with a phone number.
• Razorpay and Dodo Payments — payment processing.
• AI model providers (Google Gemini) — process your AI feature inputs to generate responses.
• Meta — if you arrived from a Meta ad and later make a purchase, we may send Meta a conversion event to measure ad performance; any email or phone number in that event is hashed (SHA-256) before it is sent.
• Infrastructure and hosting providers that store and serve the Service.

Profile and social content is shown according to the visibility settings available in the feature. If you invite someone to a challenge or social flow, the contact information you provide is used to deliver and manage that invitation.

You can export all of your data as a JSON file at any time from Settings → Account ("Export my data").

You can permanently delete your account and all associated data from Settings → Account. Deletion requires explicit confirmation and is irreversible.

Depending on where you live, you may have additional rights (access, correction, portability, objection). To exercise them, contact us at the address below.

We keep your data while your account is active. When you delete your account, your personal data is deleted from our production systems immediately, and from encrypted backups within 30 days. We retain minimal transaction records where tax and accounting law requires it.

The Service is not directed at children, and you must be at least 16 years old to create an account. We do not knowingly collect personal data from children; if you believe a child has created an account, contact us and we will delete it.

We are based in India, and our service providers may process data in other countries (including the United States). Where required, we rely on our providers’ standard contractual safeguards for these transfers. This policy is governed by the laws of India.

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you.

Questions or privacy requests: hello@hiddenbuilders.com.