Privacy Policy
Last updated: [EFFECTIVE DATE]
Slow Letters is run by [OPERATOR NAME], [OPERATOR ADDRESS] ("we", "us"). We decide how your personal data is used, and this policy explains what we collect and why.
The short version
- We collect your email address and what you write here. Nothing else about who you are.
- Other members only ever see your pen name. Your email is never shown to anyone.
- A letter is seen by you and by the person it was sent to.
- There are no ads, no trackers and no selling of data.
- You can delete your account at any time. Letters you have already sent stay with the people who received them.
What we collect and why
| Data | Why we need it |
|---|---|
| Email address | To sign you in, and to tell you when a letter arrives if you want that |
| Pen name and the languages you read | To sign your letters and to choose who receives them |
| Letters and drafts | To deliver your letters and show them to you and the recipient |
| Times of activity: when a letter was sent, delivered and opened, and when you were last active | To run the service. The time you open a letter is never shown to the person who wrote it |
| People you block and letters you report | To apply your blocks and keep a record of reports |
| IP address when you request or enter a sign-in code | To stop abuse of sign-in. Deleted after 24 hours |
| Technical logs kept by our hosting provider, such as IP address, browser type and time of request | Security and fixing faults |
We don't ask for your real name, phone number, location, contacts or photos.
If you are in the EU or UK, our legal grounds are: performing our agreement with you (running your account and delivering letters), and our legitimate interests in keeping the service safe (abuse prevention, reports, logs) and in letting you know when a letter arrives, which you can switch off at any time.
Emails we send
We send sign-in codes when you ask for one. If arrival emails are on, we send at most one email a day to say a letter has arrived. These emails never contain the text of a letter. You can turn them off on the You page or with the link in any arrival email.
Cookies
We use one essential cookie to keep you signed in. The human check on the sign-in page is provided by Cloudflare Turnstile and may use a strictly necessary cookie of its own. We use no advertising or analytics cookies.
Who can see your letters
You and the person the letter was sent to. They see your pen name and nothing else about you.
We do not read letters as a matter of routine, and we do not screen them before delivery. Authorised staff may open a letter if it has been reported, if we are investigating abuse or a security problem, or if the law requires it.
Who we share data with
We use a small number of companies to run Slow Letters. They process data on our behalf and only on our instructions:
- Supabase: database and sign-in
- Vercel: hosting
- Resend: sending email
- Cloudflare: domain services and the human check at sign-in
We may also disclose data when the law requires it, or to a successor if the service is transferred. We never sell personal data.
Where your data is kept
These providers may store and process data in countries other than your own, including the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses for those transfers.
How long we keep it
- Your account, pen name, drafts and settings: until you delete your account.
- IP addresses recorded at sign-in: 24 hours.
- Records of arrival emails: 30 days.
- Reports: for as long as they are needed to keep the service safe.
- Backups: up to [BACKUP RETENTION], after which deleted data is gone from them too.
Deleting your account
You can delete your account from the You page. When you do:
- Deleted straight away: your email address and sign-in, your drafts, your settings, and any letter to a stranger that has not yet reached a reader.
- Kept: letters you have already sent stay with the people who received them, signed with your pen name. They are no longer linked to your email address or to any account.
The people you wrote to are not told that you have left.
If a letter you sent contains personal information you need removed, write to us at the address below and we will deal with it.
Your rights
Depending on where you live, you may have the right to see the data we hold about you, to correct it, to delete it, to receive a copy, and to object to or restrict how we use it. You can change your pen name, languages and email settings yourself on the You page. For anything else, write to us at the address below. You also have the right to complain to your local data protection authority.
Age
Slow Letters is for adults aged 18 and over. If we learn that someone under 18 has an account, we will close it and delete their data.
Security
Data is encrypted in transit, and access to it is restricted to the few people who need it to run the service. No system is perfectly secure, so please don't put anything in a letter that would harm you if it were exposed.
Changes to this policy
If we change this policy in a significant way, we will tell you in the app or by email before the change takes effect.
Contact
[CONTACT EMAIL]