Back to home

Privacy Policy

Last Updated: October 22, 2026

Thank you for using Letters Home (“we,” “our,” or “us”). We respect your privacy and are committed to being transparent about how we collect, use, share, and retain information when you use our website and services (the “Service”).

1. Information We Collect

1.1 Collection Content and Import Sources

Letters Home lets you create a collection from ongoing inbound emails or from content you choose to add or import. Depending on the features you use, we may receive:

  • Email bodies, sender and recipient details, dates, subject lines, attachments, and related message metadata
  • Letters, journal entries, captions, tags, locations, and other details you enter or edit
  • Photos and files you upload, select from a connected photo service, or include in an import archive
  • Blog exports, saved-email archives, PDFs, and similar source files you submit for import
  • Journal page images and extracted text when you choose to use an assisted scanning feature
  • Book settings, cover images, generated book files, and other materials used to create your book

Raw inbound messages are retained for processing and recovery. Storage expiration is configured for 30 days for processed messages, 365 days for messages awaiting processing or recovery, and 730 days for messages whose processing status has not been classified. Previous stored versions expire 30 days after becoming noncurrent. These periods are lifecycle settings, and physical removal can take additional time after expiration. Temporary import archives and scanning source images are deleted after processing, with storage lifecycle controls that remove remaining temporary copies within 30 days. Content you choose to keep—such as letters, photos, edits, and generated materials—remains in your collection until you delete it or close your account, subject to the exceptions in Section 5.

1.2 Account and Connected-Service Information

We collect information needed to create, secure, and manage your account, including:

  • Your email address and authentication information
  • Account, collection, and communication preferences
  • Encrypted authorization credentials when you connect an external service for an import

1.2.1 Assistant-Guided Email Import

When you connect an AI assistant to Letters Home Email Import, we ask for permission to list your collection names and to create, inspect, start and cancel imports. The assistant sees the address and selection you provide, collection identifiers/names, a setup link and import counts/status. Tool responses do not include message content, private filenames or storage upload credentials. Information you provide to the assistant is also handled under that host's privacy terms.

Your browser scans the exported MBOX on your device and shows selection counts before upload. Only matching messages are uploaded after your approval; the source archive remains local. An optional local selector can instead write a selected MBOX without contacting Letters Home or an email provider. You approve the selected file, selection and collection in a signed-in browser before it uploads directly to private AWS storage. No Gmail API access is used. Original/reply detection has limits, and selected messages may still contain quoted correspondence. Keep your source export as needed; delete completed local selector output yourself. Partial selector files are removed on handled cancellation/failure; after a forced termination, you may need to remove a remaining partial file.

We retain encrypted authorization records with hashed lookup identifiers, account/grant associations and import selection settings to authorize and complete this workflow. Access tokens expire after 15 minutes; connections expire after 30 days and can be disconnected earlier. Expired connection/workflow records are cleaned up by the hourly service job. Selection addresses attached to finished or failed import jobs are removed after 30 days. Browser upload-resume storage holds chunk hashes and upload acknowledgements, not message content or credentials; it is removed on completion or when expired entries are next encountered. You can clear browser storage at any time.

Selected uploads and temporary import objects have a 7-day storage expiration, with incomplete multipart uploads aborted after 1 day. Noncurrent stored versions expire after 1 day. These are lifecycle settings; physical deletion can take additional time. Imported letters remain until you delete them or close your account, subject to Section 5. Disconnecting stops further assistant access. Approved imports continue; cancel an active import separately to stop remaining work. Already imported letters remain after cancellation. Reviewer demonstrations use synthetic mail in a dedicated sample account, never private correspondence.

1.3 Purchase, Payment, and Shipping Information

When you buy a collection or printed book, we collect transaction details such as the item, price, discounts, payment status, order identifiers, and fulfillment status. For printed books, we also collect the recipient's name and shipping address so the order can be validated, printed, and delivered.

Payments are handled by a third-party payment processor. We do not store full payment card numbers or card security codes.

1.4 Private and Public Content

Collections are private by default. If you choose to publish a collection blog or other sharing feature, the letters, photos, dates, locations, maps, and related information you select may be visible to others according to your sharing settings. You can unpublish or change available access settings in the Service, but copies previously saved or shared by other people may remain outside our control.

1.5 Photos, Media, and Information About Others

Your content may contain personal information about family members, correspondents, or other people, including photos of minors. You are responsible for having the rights and permissions needed to submit, import, publish, and print that content.

You may not upload or transmit illegal or exploitative content. Sexualized or exploitative content involving minors will result in immediate termination and will be reported to law enforcement.

1.6 Usage, Log, and Device Data

To operate and secure the Service, we may collect:

  • IP address
  • Browser and device information
  • Authentication, security, and error logs, including a pseudonymous account identifier used to associate application errors
  • Basic feature and performance information

Operational logging and error-reporting tools are configured to avoid intentionally sending letter text, photos, email addresses, shipping details, authentication credentials, or full page URLs containing query strings.

1.7 Cookies, Local Storage, and Optional Analytics

We use cookies and similar technologies for:

  • Essential functions such as sign-in, account protection, and core product features
  • Local storage for app settings and your analytics consent choice
  • Optional analytics to understand public-site performance, checkout flow, and feature usage

Separately, we count visits to our public articles using internal daily totals. These counters store only the article ID, date, and number of views; they do not use analytics cookies or persistent visitor identifiers, and they operate independently of your optional analytics choice.

We enable Google Analytics and other non-essential product analytics only after you accept the analytics consent prompt. If you decline, or have not made a choice, those analytics events are not sent.

When enabled, analytics may include page views, checkout steps, feature interactions, browser or device details, and approximate location information. We do not intentionally send names, account email addresses, letter content, photos, card details, blog passwords, public links, or exact coordinates in analytics events.

With analytics consent, we also measure which sources and campaigns bring visitors to Letters Home and lead to email signup, a forwarding trial, or a confirmed collection payment. We use a fixed list of source and campaign labels from tagged links or the referring website, rather than sending raw referring URLs or arbitrary link parameters. A source label is held in browser memory while you decide about analytics. After acceptance, we keep approved source labels in tab session storage until they are replaced, you withdraw consent, or the tab session ends. On a later page load, we reuse those labels only if they were saved within the previous 30 minutes. During the current page session, the source label also remains in memory for consented events; withdrawal clears the active source and its storage. Local payment-event markers help prevent repeat counts in the same tab session and are not sent to Google. These measurements cover consenting browsers and do not identify every source or every customer conversion.

Google processes analytics information as described in How Google uses information from sites or apps that use its services.

Page views use fixed page labels and route patterns, excluding collection, letter and book identifiers, journal slugs, query strings and private page titles. Administrative and helper pages do not emit explicit page views. Account settings also offer a browser exclusion preference that stops optional Google Analytics in that browser, including after logout, while leaving your consent choice unchanged. This preference stays in local storage until you change it or clear site storage; set it separately in each browser. Internal article view totals are unaffected.

You can change your analytics choices later in account settings or clear your browser storage and choose again.

2. How We Use Information

We use information to:

  • Receive, import, organize, edit, display, and export collection content
  • Generate book files and fulfill printed-book orders you place
  • Validate delivery addresses, process payments, and send transaction or fulfillment updates
  • Provide user-controlled sharing features
  • Operate, secure, troubleshoot, and improve the Service
  • Provide support and communicate about your account or material Service updates
  • Enforce our Terms of Service and protect users, the Service, and others
  • Count public article visits using internal daily totals without visitor identifiers, and measure other product performance only when you have opted into optional analytics

We do not sell personal information or use collection content for third-party advertising.

3. When We Share Information

We share information only as needed for the following purposes:

  • Cloud, storage, email, and security services: to run the application, receive inbound messages, store content, send notices, and protect the Service
  • Payment processing: to process purchases, refunds, disputes, and fraud checks
  • Printing and fulfillment: when you order a printed book, to provide the finished book files, order and contact details, and delivery address needed to print and ship it
  • User-directed imports: when you connect or submit content from another service, to request the files you selected
  • Assisted scanning: when you use a scanning feature, to extract text from the page images you submitted
  • Optional analytics: only after you accept analytics
  • Operational support: to monitor reliability, diagnose errors, and respond to support issues using appropriately limited data

We may also disclose information when reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate fraud or abuse, or complete a merger, financing, acquisition, or transfer of the Service subject to appropriate confidentiality protections.

3.1 Service Providers and Map Requests

Our integrations include Amazon Web Services for hosting, storage and email; Stripe for payments; Lulu for printing and fulfillment; Mistral for text extraction when you choose assisted journal scanning; Bugsink for application error reporting; and Google Analytics for consent-based analytics. Which providers receive information depends on the features you use. A scanning request sends the submitted page image to Mistral for text extraction. A print order sends book files and fulfillment information to Lulu.

Interactive maps request styles and map tiles from CARTO and, where used as a fallback, OpenStreetMap. Those requests disclose your IP address, browser/request information, and the geographic area of the map being displayed to the map provider. We also request map tiles when generating book maps. Map requests are part of the map feature and are separate from optional analytics.

Providers' privacy information is available from AWS, Stripe, Lulu, Mistral, Bugsink, CARTO, and OpenStreetMap Foundation. Mistral's consumer privacy policy does not describe all processing under its business-service agreements.

3.2 Google Photos Imports

When you connect Google Photos, we use the Photos Picker to retrieve the photos you select and associated information needed to import them into your collection. Imported photos can be included in your chosen book and sharing features. You can delete imported photos through the Service and revoke connected-service access through your Google account.

Our use of information obtained from Google Photos APIs is subject to the Google API Services User Data Policy and its Limited Use restrictions. We limit use and sharing to the permitted user-facing features, with your consent, and the security and legal exceptions permitted by those requirements. A merger, acquisition or asset sale involving this data requires your explicit prior consent. These restrictions take precedence over the general disclosure provisions above.

Third-party processors and fulfillment partners handle information under applicable service agreements and their privacy practices. We do not share personal information with them for third-party advertising.

3.3 Administrative AI Assistance

Authorized administrators may connect an AI assistant for service analytics, editorial article drafts and customer support. Depending on approved permissions, the assistant host may receive aggregate reports; account identifiers and verification/access status; collection identifiers, names, settings, status and counts; and editorial article text, including unpublished drafts. Account email addresses may be returned for specific support lookups. These admin tools do not return private letters or photos, authentication credentials, payment identifiers or shipping details.

Access requires administrator authorization and is checked on each request. The connected assistant host handles received information under its applicable service terms and privacy practices; retention and training practices depend on the selected host, account and settings. We retain encrypted connection authorization records. Access tokens expire after 15 minutes, connections expire after 30 days, and administrators can disconnect earlier. Disconnecting revokes further access; it does not erase copies already retained by the host.

4. Children and Sensitive Content

Accounts are for adults age 18 and older, as required by our Terms of Service. The Service is not directed to children under 13. A collection may include content about children, but children should not create accounts or submit information directly to us.

Do not use the Service to store sensitive regulated information that is unrelated to its purpose, such as medical records, financial account numbers, authentication credentials, or biometric identifiers.

5. Data Retention and Deletion

  • Raw inbound messages, including their original attachments, use the processing-status retention periods in Section 1.1: 30 days for processed messages, 365 days for pending messages, and 730 days for unclassified messages. Previous versions expire 30 days after becoming noncurrent; storage-lifecycle deletion is asynchronous.
  • Temporary import archives and scanning source images are deleted after processing, with a 30-day storage-lifecycle backstop.
  • Collection content and generated materials are kept until you delete them, close your account, or they are removed through normal operational cleanup.
  • When you close your account, account and collection content is scheduled for permanent deletion. Limited copies may remain briefly in backups or storage lifecycle queues before automatic removal.
  • Purchase, payment, tax, fraud-prevention, customer-support, and print-fulfillment records may be retained as reasonably necessary for legal, accounting, dispute, delivery, and operational obligations. Fulfillment records are limited or redacted when the full delivery address is no longer needed.
  • Payment processors, printers, carriers, and other service providers may retain transaction or fulfillment information under their own legal obligations and privacy practices.

We may preserve information longer if required by law, a valid legal hold, or an unresolved security, fraud, payment, or legal matter.

6. Your Choices and Rights

Depending on your location and applicable law, you may be able to:

  • Access, correct, export, or delete stored collection content
  • Close your account and request deletion of associated account and collection data
  • Control whether a collection is published and adjust available sharing settings
  • Decline or withdraw consent for optional analytics without losing core Service access

Inbound email processing applies only to collections configured for ongoing email collection. Upload and import options do not require ongoing email collection.

Email support@sendlettershome.com to make a privacy request. We may need to verify your identity before completing it, and some requests may be limited by applicable law or the retention exceptions described above.

7. Data Security

We use reasonable technical and organizational safeguards designed to protect information, including access controls, encryption where appropriate, and private storage for collection content. No system is perfectly secure, so we recommend keeping personal backups of important content.

8. Changes to This Policy

We may update this Privacy Policy as the Service or legal requirements change. We will post the updated version and revise the date above. We will provide additional notice when required by law.

9. Contact Us

For questions or privacy requests, contact: support@sendlettershome.com