LetterRelay does not sell personal data, build advertising profiles, or accept free-form public letter text. Reviewed organization ornaments may display promotional company logos and website links; there is no advertising SDK or personalized advertising. Pseudonymous data is still treated as personal data whenever it can be connected to an account or identifiable person.
1. Scope and controller
This policy applies to letterrelay.com, the LetterRelay application and api.letterrelay.com. LetterRelay is a Kodably.com product. The data controller is RUSEI MS COMPANY S.R.L., Str. Oltului nr. 4, sc. C, ap. 2, Brașov 500283, Romania, Romanian Trade Register J2026028599007, unique registration code 54592408.
Privacy questions and rights requests can be sent to [email protected]. More company information is in the Legal Notice. LetterRelay is intended only for people aged 18 or older and is not designed for children.
2. Presentation website, contact and ornament purchases
The public website has no app login, product inbox, advertising tracker or analytics profile. The host and delivery providers may process standard delivery and security data such as IP address, request time, requested path, browser/device information, response status and abuse signals.
If you contact us, we process your address, message, attachments and request history to respond and protect the service. If you buy a special ornament, the site requests a temporary Stripe Checkout Session and redirects you to Stripe. Stripe collects payment, billing and fraud-prevention data under its own privacy practices. LetterRelay may receive merchant-visible amount, status, contact, transaction, refund and dispute metadata, but not your full card number or security code.
We use a normalized email hash to match a pending purchase to your verified Google account, and retain payment identifiers, amount, currency, status and account assignment to deliver the ornament and handle retries, refunds and disputes. Email and payment amount are never included in public tree records. Account deletion detaches the payment ledger and prevents purchase reactivation. The website's device-storage practices are described separately in the Cookie Policy.
3. Sign-in and account data
The active service uses Google sign-in. Google and Firebase Authentication provide an account identifier, email address, display name, authentication credential and sign-in security information. LetterRelay uses the resulting Firebase UID to secure the account and API requests. Your provider display name may be shown only to you in Account & settings and is not used as your public letter identity.
We store your selected pen name, sign, country, onboarding status, policy version, acceptance timestamps, delivery counters, account state and service-security state. Your pen name, sign and country are intended as pseudonymous public information; your provider email, display name and Firebase UID are not displayed on letters or ornaments.
Authenticated activity timestamps and recent activity dates help deliver letters to members who have used the service within the last 30 days. We record a return after at least seven days and seasonal participation to understand service use and show your progress.
4. Letters, journeys, replies, ornaments and organizations
We process approved message IDs and resolved approved text, paper/envelope/font/color choices, sticker placement, sender and recipient account identifiers, delivery state, timestamps, preset replies and journey stops. Starter letters are marked internally as system-generated and disclosed when opened.
We process ornament credits, approved wish selections, design choices and an optional public country label. Organization applications include the submitter UID, organization name, HTTPS website, selected wish, uploaded logo, review status and timestamps. Approved organization details and logos become public on the tree.
Drafts are saved locally on this device, separately for each account and letter context; they are not uploaded before sending. You may discard a draft or save a printable album of your explicitly selected sent letters. Files you export remain under your control.
If you enable native notifications, we process a random installation identifier, platform and Firebase Cloud Messaging token to send requested service alerts. Notifications contain no letter content, pen name, country or review details. You may disable them in Account & settings or device settings. We stop device token generation and remove registration when disabled; account deletion removes owner-bound notification records.
Opening an organization ornament or choosing its website can record an account action, deduplicated once per ornament, action and UTC day. Organization owners see aggregate opens and link clicks, not viewer identities. These records measure app actions, not verified people or completed website visits. Daily delivery and participation statistics are restricted to the authorized operator. An authorized reviewer can look up an applicant's private provider email/name for organization verification; these do not become public.
5. Reports, blocks and service protection
A report records the reporter UID, reported UID, letter identifier, selected reason, status, moderation decision and timestamps. A block records the related account identifiers plus the blocked sender's public signature so the relationship can be managed in Account & settings. The reported member is not shown who filed a report.
Authentication, API, hosting, payment and security providers may create logs needed to prevent abuse, enforce limits, diagnose failures and protect the service. We may preserve limited evidence when reasonably necessary for an unresolved safety report, security incident, dispute or legal obligation.
6. Where data comes from and what is required
Data comes from you, your sign-in provider, other members' permitted interactions with your letters, and technical records generated when the service processes a request. Account authentication, policy confirmation and the required public signature fields are necessary to provide an account. Without them, the account and relay functions cannot operate.
Special ornament purchases, organization applications, public country display on a personal ornament, reports and support communications are optional. Avoid sending free-form personal data in an organization logo, website destination or support attachment unless it is necessary for the request.
7. Purposes and legal bases
Service performance and steps you request: authenticate the account, create the public signature, deliver and balance letters, continue journeys, provide replies, rewards and ornaments, process organization submissions, delete the account, and open a requested Stripe Checkout.
Legitimate interests: keep the service secure and reliable, prevent duplicate or abusive operations, apply rate limits, investigate reports, enforce Community Rules, review organizations, provide support, measure service reliability and participation through restricted activity records and aggregate results, maintain shared pseudonymous journey continuity, and establish or defend legal claims. We consider the effect on members and use restricted access, curated content, pseudonymous public identity and deletion controls to reduce that effect.
Legal obligations: keep and disclose information required for accounting, tax, payment disputes, lawful authority requests and other applicable duties.
Where a future optional feature genuinely relies on consent, the request will identify that purpose and allow withdrawal. Accepting the Terms is not treated as blanket consent for unrelated personal-data use. LetterRelay currently sends no advertising or direct-marketing email.
9. Retention and deletion
Retention depends on the data category, operational need and legal exception. The detailed current rules are in Data Retention. Account deletion removes the active account and account-owned operational data. Shared journey history may remain only in detached pseudonymous form without the deleted account UID. Provider-managed backups, security logs and legally required payment or dispute records follow their applicable cycles.
10. Your rights
Depending on the applicable conditions, you may request access, correction, deletion, restriction, portability or objection; withdraw consent where a specific processing operation relies on consent; and receive information about relevant international-transfer safeguards. You may also lodge a complaint with the Romanian supervisory authority, ANSPDCP, or another competent supervisory authority.
Use [email protected] and describe the request. We may ask for proportionate information needed to verify account control; never send a password or authentication code. We normally respond within one month. A complex or numerous request may require the legally permitted extension, in which case we will explain it within the initial period.
You can also block or unblock member senders, report a letter, omit the country from a personal ornament, avoid an organization submission or an ornament purchase, sign out, delete the account directly in Account & settings, or use the public deletion request if the app is unavailable.
11. Automated processing
LetterRelay uses deterministic service rules to validate approved content, balance delivery, prevent blocked matching, enforce quotas and calculate ornament eligibility. These operations do not make decisions that produce legal or similarly significant effects about you. Safety reports and organization submissions require human review before the described enforcement or public-approval outcomes.
12. Security
Application records and uploaded logos are accessed through the authenticated API; direct client access to Firestore and Cloud Storage is denied. Controls include authenticated sessions, origin restrictions, server-side validation, idempotency, bounded rate limits and least-purpose data design. No internet service can guarantee absolute security.
13. Changes
We update this policy when collection, use, sharing, providers or product behavior materially changes. The updated date will change. Where another legal basis or product contract requires notice, acceptance or consent, LetterRelay will request it separately; continued browsing alone is not treated as privacy consent.
14. Contact
Email [email protected] for privacy questions or rights requests. Postal correspondence may be sent to the controller address in section 1.