Privacy Policy

Lettrr is built as an intimate digital sanctuary. Unlike ad-driven social media platforms or broadcast networks, our business model does not rely on surveillance, attention mining, behavioral tracking, or engagement algorithms.

Data Minimization Standard: We adhere to the foundational principle of strict data minimization. We only collect, retain, and process personal data that is directly required to maintain your account, securely store your private Keeps, and dispatch your sealed Lettrrs to your chosen recipients.

Zero Proactive Scanning: Lettrr enforces zero proactive scanning of private correspondence. We do not employ automated natural language processing (NLP), optical character recognition (OCR), image recognition, or machine learning models to analyze the contents of your letters, photos, or memories for commercial, profiling, or analytical purposes.

To provide the Service, Lettrr collects and processes the following limited categories of information:

• Account Credentials: Full name, pen name, email address, password hash, and timestamps of assent to our Terms and Privacy Policy.
• Preserved Content (Keeps & Letters): Photographs, video recordings, audio cues, written prose, seal aesthetics (paper stock, stamp die, wax color), and timestamps created by you. Keeps remain private in your vault until you explicitly seal them into a dispatched Lettrr.
• Correspondence Address Book (People): Names, optional email addresses, and optional personal notes you assign to recipients in your personal address book.

What We Never Collect or Do:

• We never sell, lease, or monetize your personal data or uploaded media to third-party data brokers, marketers, or advertisers.
• We never train AI or large language models (LLMs) on your private letters, Keeps, or images.
• We never capture keystroke dynamics, drafts prior to saving, or uncommitted writing desk keystrokes.

Maintaining a reliable, crash-free application requires observability, but traditional full-suite telemetry (such as recording user sessions) directly contradicts Lettrr’s privacy commitments. In accordance with our architecture guidelines:

• Sentry (Error Diagnostics): Sentry is utilized exclusively for detecting client-side runtime errors and server action crashes. Session Replay is completely disabled. Crash logs report stack traces and component lifecycle errors, with personal payload text and recipient emails masked and stripped.
• PostHog (Product Observability): PostHog is configured strictly for cookieless, anonymized event tracking across high-level funnel milestones (such as keep_created, draft_step_completed, lettrr_dispatched, claim_completed, lettrr_opened). Session recordings and DOM replay are completely disabled. Event payloads never include letter text, recipient names, audio assets, or media storage keys.
• No Cross-Site Ad Trackers: Lettrr does not load the Facebook Pixel, Google AdSense, TikTok Pixel, or any third-party behavioral advertising scripts.

Dispatching correspondence to unverified email addresses requires rigorous safeguards to prevent unsolicited invitations and avoid retaining third-party personal data indefinitely. In accordance with our compliance protocols:

• 30-Day Claim Link Expiration: Claim links generated for unregistered recipients remain valid for exactly thirty (30) days. Upon expiration, unclaimed claim tokens become invalid, and the unverified recipient email address associated with the temporary claim record is scrubbed from active operational storage.
• Zero-PII SHA-256 Hash Suppression Registry: If an email recipient clicks the one-click opt-out link in a dispatch email or requests not to receive future correspondence, Lettrr converts their email address into a one-way SHA-256 cryptographic hash. We store only this mathematical hash in our suppression registry, immediately discarding the plaintext email. This ensures that zero personally identifiable information (PII) is retained for individuals who decline to use the Service, while permanently barring our system from sending them future invitation dispatches.
• One-Click Opt-Out: Every automated invitation email dispatched by Lettrr contains a direct, single-click opt-out link complying with CAN-SPAM and international postal regulations.

When an account holder exercises their statutory right to erasure (“Right to be Forgotten”) under GDPR Article 17 or Section 16 of the Philippine Data Privacy Act of 2012, Lettrr balances complete personal erasure with the rights of recipients who cherish their received correspondence.

The Epistolary Delivered Gift Model: In the physical postal tradition, a letter delivered into a recipient’s home mailbox becomes their permanent keepsake. When you initiate an Account Purge via Sanctuary Settings:

• Your authentication credentials, sessions, profile data, address book, unsent drafts, and private Keeps are permanently and irreversibly shredded from our primary databases.
• Claimed Lettrrs previously delivered into recipients’ Mailboxes remain preserved in those recipients’ archives as irrevocable Delivered Gifts.
• To protect your privacy upon erasure, all sender attribution on delivered correspondence is irreversibly replaced with the pseudonym “A Loved One,” decoupling the letters from your past identity.

Lettrr engages select, industry-standard third-party sub-processors solely to provide underlying hosting, storage, and communication infrastructure under strict data processing agreements:

• Cloudflare R2: Encrypted object storage for uploaded photographs, audio recordings, and video Keeps, served via short-lived presigned URLs.
• Neon / PostgreSQL: Relational database infrastructure hosting encrypted credentials and correspondence records.
• Vercel: Serverless edge runtime hosting the application framework.
• Resend: Transactional email delivery service utilized solely to dispatch claim links, notification pacings, and authentication emails.

Lettrr does not knowingly collect, solicit, or maintain personal information from individuals under the age of thirteen (13), in compliance with the Children’s Online Privacy Protection Act (COPPA) and applicable domestic youth protection laws.

If we discover or are notified by a parent or guardian that an account was created by a child under thirteen (13), we will promptly delete all associated credentials, Keeps, and records. Inquiries regarding minor accounts should be directed to support@lettrr.app.

Depending on your jurisdiction, you possess specific legal rights regarding your personal information under the Philippine Data Privacy Act of 2012 (RA 10173), the General Data Protection Regulation (GDPR), and other global privacy statutes:

• Right of Access & Portability: You can download a complete, self-contained offline archive of your correspondence and media at any time using the Archival Export feature in Sanctuary Settings.
• Right to Rectification: You may edit your pen name, full name, and notification pacing in Settings.
• Right to Erasure: You may trigger an immediate, irreversible account purge via the Close Account & Purge Archive command in Settings.

If you have any questions, concerns, or requests regarding this Privacy Policy or our telemetry and data processing practices, please reach out to our privacy compliance operations: