What we hold about you, and why.

Who is responsible

Not yet provided. The name of the person or organisation responsible and an address to write to are for the operator to give, and this page will show them as soon as they are set. Until then we leave this blank rather than make something up.

What we hold, and what it is for

• Your email address. To send you a sign-in link and the mail you have not turned off. It is never shown to another member, at any level, and never passed on. Every category of mail except the sign-in link can be turned off on your own page.
• The facts on your desk. Pen name, first name, date of birth and time zone; and, if you gave them, gender, your town (town-level coordinates, never a street), languages and children. Somebody new to you sees your first name once you’ve each written a proper letter, about 120 words or more. Somebody who already knows you sees it from the start. The rest is never shown. Nobody is sorted by an algorithm. Every pair is made by a person: somebody who invites another person to write, or who sets two people up.
• What we do not ask. No orientation, religion or ethnicity, and nothing about who you would like to write to. You choose that yourself, one invitation at a time.
• Your letter, lists and answers. Your few words are what a correspondent new to you reads first. The hidden questions and your lists are what the quiz deals from, and lists are the tiles a correspondent uncovers as you write, in the order you set. The letters you exchange are shown to the person you wrote them to and to nobody else, except a moderator if one of you reports the conversation.
• Photographs. Stored privately, looked at by a person before they can turn over for anyone, and uncovered to a correspondent only in the order and at the pace you chose. There is no gallery.
• How it went. The counters behind the trust rules (letters sent, conversations finished, reports) are private and never shown to anybody as a score.
• Invitations. An invitation you send holds the address you typed until it is answered, withdrawn or lapses; it is in your export, and it goes when either of you leaves. Setting two people up holds both their addresses in the same way, and the whole introduction goes if you leave.
• Sign-in records and a mail log. Sessions last 60 days and slide while you use the desk. The mail log records that a message was sent, to whom and of what type, but not its text, and is deleted after 30 days. Rate-limiting records last two days.

What we do not do

• No read receipts, typing indicators or online lights; the sender of a letter is never told when it was opened.
• No tracking pixels or click-tracking in mail, and no analytics scripts or advertising on the pages.
• No public profiles, no browsing, no gallery, and no score of anybody’s attractiveness shown to anyone.
• Nothing you write is sent to an AI service to be judged.

Where it lives

The application runs on Vercel; the database and the private photograph store are on Supabase; mail is sent through Resend. These are the services the software is built to use. Each one holds only what its job needs. The mail service sees an address and a message, and the photo store sees a file.

Leaving, and taking it with you

Your own page can export everything we hold about you as one file, at any time. Leaving hides your letters from your correspondents at once and closes every open conversation with a plain word to them; after 30 days everything that identifies you is erased, photographs included. If you sign back in before then, we take it you’ve changed your mind. Your correspondents’ own letters are theirs and stay with them.