Privacy Policy

1. Who we are

loveletter.digital is operated by aimbelo. This policy explains what data we collect and how it's used.

2. What we collect

Letters and love pages: what you put in them — text, photos, voice notes, videos and music choices, the sender and recipient names, an optional secret question, and the notes and reactions friends and recipients leave.

Account info: if you create an account, your email address and, if you choose a password, a one-way scrambled version of it (we can't read your password). If you sign in with Google, your name, email and profile picture from Google.

Payment info: if you unlock your account, Polar.sh (our payment processor) collects your email and payment details directly — we never see or store your card number.

Technical data: your IP address (used briefly to stop abuse and limit repeated sign-in attempts, not stored long-term), a “Verify you are human” check on sign-in forms, how the site is used (see the analytics providers below), and error reports when something breaks.

3. How we use it

To operate the Service (store and show your letters and love pages at their links), send the emails that belong to it (sign-in links, a note when your letter is first opened, a yearly anniversary reminder), process payments, prevent abuse, and improve the product. We do not sell your data.

4. Who we share it with

We use these service providers to run loveletter.digital. Each processes data only on our behalf, under its own privacy and security practices:

• Vercel — hosting, and privacy-friendly visit statistics
• Neon — our database (in Frankfurt, Germany)
• Cloudflare — storage for photos, voice notes and videos, and the “Verify you are human” check
• Brevo — sending our emails
• Google — Google sign-in, and Google Analytics visit statistics
• PostHog — product analytics, including recordings of how pages are used
• Sentry — error reports
• Polar.sh — payments

Some of these providers are based in the United States.

5. Cookies

We set these cookies ourselves:

• a sign-in cookie, only if you sign in, so you stay signed in (up to 14 days)
• a cookie that remembers a letter you start before signing in (up to a year)
• a cookie that remembers your language

Analytics cookies are only set if you click “Accept” on the cookie banner:

• PostHog (up to a year) — counts visits and records how public pages are used, so we can improve them. Pages with your letters, love pages, notes, account or sign-in are never recorded, and anything you type is hidden.
• Google Analytics (up to 2 years) — counts visits and where they come from.

If you decline, neither is loaded and nothing is stored. We remember your answer in your browser's storage (not a cookie). Vercel's visit statistics don't use cookies. We don't use advertising cookies.

You can change your answer at any time: Cookie settings

6. Data retention

Free letters and their photos are retained even after the free viewing window closes, so they can be revived if later unlocked. You can request deletion at any time (see below).

7. Your rights

You can request access to, correction of, or deletion of your data by emailing support@loveletter.digital. If you're in the EU/UK or California, you may have additional rights under GDPR or CCPA — contact us to exercise them.

8. Children

The Service isn't directed at children under 13, and we don't knowingly collect their data.

9. Changes

We may update this policy from time to time; changes will be posted on this page.

10. Contact

Questions about this policy: support@loveletter.digital