Your words. Your privacy.

We ask for a letter. Not your life story.

What we save

We store your letter and any image you choose to attach, its language, stationery and theme, archive permission, moderation status, submission time, and your chosen opening time and timezone. After review, letters are shared with up to three randomly matched readers; people you choose by private username or mailbox link are additional. Images are resized and stripped of photo metadata in your browser before sending, then reviewed with the letter. If you choose recipients, we store their mailbox IDs, not their private usernames, links, or keys. We also keep delivery records, reports, and an administrator action log. We don’t ask for names, schools, grades, admission results, or email addresses.

Your private username and mailbox link

New writers choose a unique private username. It is stored as a keyed hash for lookup and an encrypted copy to show in their mailbox. The username alone can sign in, so keep it private and hard to guess. The browser also creates a random private link, which you may save as a second way back. We store its SHA-256 hash and an encrypted copy so administrators with link access can view it; older links cannot be recovered. The link key travels in an authorization header and sits after # in the page address. Anyone with your username or full link can access the mailbox and manage your letter. Neither credential is connected to email.

Drafts, language, and cookies

Text drafts and your language preference are saved only in this browser’s local storage. An image selected for a draft is not saved there; choose it again after reloading. A draft is removed when you successfully send it. You can clear this site’s browser data at any time. Administrator sign-in uses an HttpOnly session cookie. This application uses no advertising, tracking pixels, or third-party analytics. Fonts and artwork are served by this site.

Keeping the post desk usable

To limit spam, the server uses a daily, secret-salted hash of the connecting IP address, with counters kept for up to two days. Raw IP addresses are not written to the application database. The hosting provider may process network logs under its own policies. Letters are checked by a human reviewer before delivery, so this is not an end-to-end encrypted service.

Change your mind

Open your mailbox with your private username or link, then choose “About your letter & privacy” to withdraw archive permission or permanently remove your letter and attached image. Removal also ends receiving access. Minimal delivery and moderation records remain to enforce limits. Words or images someone already copied or saved cannot be recalled. Public archive sharing is always optional and off by default.

Letters otherwise remain available for rereading and, with consent, the collective archive. Contact the project through the Contact page for questions.