1 Who we are and what this policy covers
Letterhenge LLC (“Letterhenge,” “we,” “us,” or “our”) operates Letterhenge at letterhenge.com and through its applications. This policy explains how we handle personal information on our website and in our limited beta application, including account access, profiles, correspondence, controlled tests, and support requests.
Letterhenge is in pre-launch testing. Our intended initial commercial offering is digital correspondence and letters composed online for printing and postal delivery through Lob. Live printed fulfillment and real-money payments are not available through this beta. Account access and features are limited; a signup screen does not establish that public registration is available. This policy applies to information actually provided or processed when you use an available feature. Questions and privacy requests may be sent to support@letterhenge.com.
2 Information we collect
Account and authentication information. When account access is available, we collect your email address, username, password through our authentication service, account identifiers, verification and recovery information, account status, and records of your acceptance of terms and confirmation that you are at least 18. Authentication also involves session tokens and records of sign-in activity. Supabase provides the account authentication service.
Profile information. You may provide a display name, biography, profile image or portrait, introductory text, interests, languages, country, and correspondence preferences. Profile settings may include whether you accept new correspondence or printed letters. Avoid including private contact details or sensitive information in fields intended for discovery by other users.
Correspondence and relationships. We process the text you compose, saved drafts, sent letters, available correspondence files, sender and recipient identifiers, correspondence relationships, and information such as creation, sending, delivery, and reading status. We also process settings and personal notes you save about a relationship, where those features are available. Sending and delivery can generate order identifiers, document versions, and operational records.
Letters can contain personal information about you or other people. Please share only information you are entitled to disclose and consider whether a letter could expose someone to harm.
Mailing information. Available address-setting and controlled print-test features process the recipient name, street address, city, state or region, postal code, country, validation information, and receiving permissions you supply. Print tests can also record a return address, destination snapshot, document, and provider request. Supplying an address or receiving permission does not activate live mailing. Use synthetic mailing details for sandbox exercises unless you have been specifically instructed to supply real details for an authorized purpose.
Payment and order information. Controlled payment tests can record test amounts, currency, payment status, provider transaction identifiers, and simulated refunds. Stripe-hosted test checkout receives the details entered there; Letterhenge receives payment results and references rather than a full card number or card security code through that integration. Use provider-specified test payment details, not a real card. A test balance, price, checkout confirmation, or receipt does not represent an actual charge, available funds, or a live mailing order. The account system also supports provider customer/payment-method references and limited card fields; any existing records are subject to the retention and request procedures below.
Support and operational information. We collect the information you send to support, feedback, complaints, and records needed to investigate problems. Our services and infrastructure may also process IP addresses, browser or app information, request times, error details, security events, and service activity records.
Separate Address Vault tests. The independent Address Vault is separate from the main account system. If you participate in a separately enabled Vault test, it can process account links, passkey public keys and credential identifiers, verification challenges, consent evidence, prepared letter PDFs, and order-test records. Its account-creation or reconciliation screen can transiently process an email address and password to communicate with Supabase. Passkey authentication does not require Letterhenge to receive your device's biometric template. Address enrollment and fulfillment are disabled in the current beta Vault runtime; its encrypted-address capability is not a statement that real addresses have been enrolled or that all main-application address copies are held there.
Information on your device. Our website uses authentication cookies and browser storage for session handling, preferences, and working copies of drafts. The mobile application stores authentication credentials using operating-system credential storage and stores some preferences locally. Device storage and cloud storage are separate; clearing one does not necessarily clear the other.
3 How we use information
We use information to:
Create, authenticate, secure, and administer accounts, and record required confirmations.
Display profiles and help people establish and manage correspondence relationships.
Save drafts, deliver correspondence, maintain correspondence histories, and apply delivery settings and permissions.
Exercise available address, receiving-permission, document-preparation, and provider workflows in controlled testing.
Reconcile sandbox payment and print-test outcomes and maintain related operational records. A test outcome does not authorize a real charge or mailing.
Provide support, investigate abuse or fraud, enforce our terms, and protect users and the service.
Diagnose failures, maintain service reliability, and satisfy applicable legal obligations or lawful requests.
We use the information relevant to the feature you request. A postal address is not required for digital correspondence. Declining information needed for a particular feature may prevent that feature from working.
4 Correspondence privacy and profile visibility
Saved cloud drafts are restricted from ordinary access by other users. Sent correspondence is made available to the relevant participants according to the service's delivery rules. Profiles and profile images have different visibility rules from private correspondence. Published profile portrait files can be publicly accessible, including to someone who has their URL.
Private correspondence is processed and stored by Letterhenge's systems and service providers. The beta does not provide end-to-end encryption of correspondence. Database administrators and appropriately authorized service or support personnel may have access needed to operate the system, investigate a reported problem, protect safety, or comply with law. Print-test documents are also processed in readable form. Eventual live printing would require readable documents, but is not enabled by this beta.
We do not present your delivery address as an ordinary public profile field. However, address privacy does not mean that only you can access your address: authorized systems and personnel can access it, and a provider used for an authorized print test receives the information submitted for that test. Main application records can include mailing information and fulfillment snapshots. A separate Address Vault does not by itself eliminate those copies.
Recipients can retain, photograph, download, or share information you send them. We cannot erase copies held independently by another person. A letter's text or a print document can itself reveal information you include.
5 When information is disclosed
Other users and intended recipients. We disclose profile information according to its visibility settings and correspondence to the intended participants when a delivery feature is enabled. Saving a private draft alone does not deliver it.
Supabase and hosting providers. Supabase supplies authentication, application database, and file-storage functions. Website, application, and infrastructure providers process information necessary to host and deliver the service. Email providers process email addresses and message content needed for verification, recovery, and service communications.
Stripe sandbox. When Stripe test checkout is separately enabled and used, Stripe receives the checkout inputs and payment-test identifiers needed to process it. Stripe may maintain its own service and security records under its privacy notice. Test mode does not authorize real payment collection.
Lob sandbox. When a Lob print test is separately enabled and used, Lob receives the submitted letter PDF, destination name and address, return address, and dispatch metadata. A document sent to a provider is disclosed to that provider even if the request is a test. Test requests do not produce live postal delivery. Live disclosures to print-production partners and carriers would require an enabled live service and updated information before use.
Safety, legal requirements, and business changes. We may disclose relevant information when reasonably necessary to investigate misuse, protect rights or safety, respond to valid legal process, or comply with law. Information may also be transferred in a merger, acquisition, financing diligence, or sale of business assets, subject to applicable law and appropriate confidentiality arrangements.
At your direction. We may disclose information when you request or authorize it.
6 Cookies and beta diagnostics
We use cookies and local storage for functions such as signing in, maintaining a session, remembering preferences, and preserving draft work. Blocking or clearing storage can sign you out or remove device-only drafts and settings. Local draft copies can remain until the browser's cleanup process or storage clearing removes them; a successful send does not necessarily erase every local working copy immediately.
Hosting and authentication services maintain operational and security records. If you participate through Apple TestFlight, Apple may provide us with installation, usage, crash, and feedback information, including screenshots you choose to submit. We use TestFlight-provided information only to improve the application and related products and disclose it only as permitted by Apple's testing terms. Avoid including unrelated personal information in a bug report or screenshot.
The limited beta does not offer external AI portrait generation or letter-writing assistance. Changes that introduce additional personal-data processing will be described before they apply, with any consent required by law.
7 Security
Our application uses authentication and database access controls to restrict ordinary user access. Certain postal settings require additional verification, and some server operations use server-held service credentials. These controls are intended to reduce unauthorized access; they do not make every record inaccessible to service administrators or eliminate all security risks.
No system, device, or postal delivery process can guarantee complete security. Protect your account credentials and access to your device, and contact support@letterhenge.com if you believe your account has been misused.
8 Retention
We retain account and correspondence records to maintain the account and its history, and operational and support records to investigate service issues, reconcile test outcomes, protect the service, address disputes, and meet applicable legal obligations. The current beta does not have a general automatic deletion schedule for every category. In particular:
| Category | Current treatment |
|---|---|
| Profiles, private settings, unsent cloud drafts, and designated private images | The account-private cleanup process can remove these records when it is run and applicable conditions are satisfied. Requesting deletion or disabling access does not establish that cleanup has finished. |
| Sent letters, shared files, correspondence relationships, and historical participant/account identifiers | These remain in the current system after the account-private cleanup process; they have no automatic expiry under that process. |
| Mailing details and print-test copies | Some ordinary address fields can be cleared by private cleanup. Destination snapshots, prepared PDFs, and stored provider requests are separate copies and are not all removed by that operation. |
| Payment-test records, existing financial records, legal acceptances, and audit/security history | Some descriptive fields can be cleared; historical records are not subject to a general automatic purge. |
| Independent Vault records | These have a separate lifecycle. A main-account deletion request does not automatically erase Vault identity links, passkey records, consent evidence, or prepared PDFs. |
| Infrastructure logs, provider records, emails, and backups | These can remain outside the active application under the relevant system's or provider's retention practices. Clearing an application field does not establish that these copies have been deleted. |
Retention is subject to applicable privacy rights. Describing what the current system retains does not mean every retained record is legally required. A deletion request may require individual review of information that the ordinary cleanup process leaves in place.
9 Deletion and your choices
You can edit available profile fields and correspondence preferences through the controls provided for those features. Closing a mailbox or withdrawing receiving permission is different from account deletion.
For privacy questions or to request access, correction, or deletion, contact support@letterhenge.com. We may need to verify your identity before acting, using information proportionate to the request. Please do not email your password or full payment-card details. We assess requests under applicable law and explain any applicable limitation.
The beta does not currently provide a functioning self-service account-deletion screen. Its backend can accept a verified request, revoke main-account access, and queue private-data cleanup. A queued request or an account marked inactive does not mean the cleanup worker has run, that the authentication record has been erased, or that deletion is complete. Cleanup can remain pending while operational dependencies or holds are resolved.
Sent correspondence and historical records remain as described above. Main-account cleanup does not automatically erase independent Vault or provider-held records. Removing information from the active service may not immediately remove backup copies, public-image caches, or files already downloaded by someone else. Our review of a request must address these separate records and any applicable rights; we do not promise immediate or complete erasure through the automated process.
You can stop participating in the beta without requesting deletion. If you no longer wish to receive beta invitations, contact us; uninstalling the app alone does not delete server-held information.
10 Privacy rights and processing locations
Depending on where you live and the laws that apply, you may have rights to request access to, correction of, deletion of, or a copy of your personal information; object to or restrict some processing; withdraw consent where processing relies on consent; or complain to an appropriate authority. Contact us to make a request or ask about a decision. We will assess requests under the applicable law and explain any applicable exception.
Using cloud, email, and sandbox providers can involve processing outside the place where you live. The location of a server does not itself determine which privacy rights apply to you.
11 Adults only
Letterhenge accounts are intended for people at least 18 years old. We do not offer accounts to children. If you believe a child has provided personal information through an account, contact us so we can investigate and take appropriate action.
12 Changes and contact
If our practices materially change, we will provide appropriate notice and obtain consent where required by law. A later policy does not retroactively authorize a new use that requires separate permission.
Letterhenge LLCWebsite: https://letterhenge.comPrivacy and support: support@letterhenge.com