Last updated: [Date]
Letter content: the text and photos you choose to include in a letter, plus recipient/sender names you enter.
Account info: if you create an account, your email address (used for magic-link sign-in).
Payment info: if you unlock a letter, Polar.sh (our payment processor) collects your email and payment details directly — we never see or store your card number.
Technical data: IP address (used briefly for abuse/rate-limit protection, not stored long-term), and basic, privacy-friendly analytics via Vercel Analytics.
To operate the Service (store and display your letter at its private link), process payments, prevent abuse, and improve the product. We do not sell your data.
We use third-party service providers to run loveletter.digital: Supabase (database, file storage, authentication), Vercel (hosting, analytics), and Polar.sh (payments). Each processes data on our behalf under their own privacy/security practices.
We use a cookie to remember an anonymous letter you're creating before you sign in, and (if you sign in) a session cookie for authentication. We don't use third-party advertising or tracking cookies.
Free letters and their photos are retained even after the free viewing window closes, so they can be revived if later unlocked. You can request deletion at any time (see below).
You can request access to, correction of, or deletion of your data by emailing [support@loveletter.digital]. If you're in the EU/UK or California, you may have additional rights under GDPR or CCPA — contact us to exercise them.
The Service isn't directed at children under 13 (or the relevant minimum age in your country), and we don't knowingly collect their data.
We may update this policy from time to time; changes will be posted on this page.
Questions about this policy: [support@loveletter.digital]