Privacy

What we store

• The sender’s and the recipient’s names.
• The letters: their text, photos, voice notes and the text version of each voice note.
• The recipient’s time zone, and when each letter was opened.
• The buyer’s email.

The recipient’s browser keeps one note that the envelope was opened, so it doesn’t ask again. We don’t use cookies.

Where it lives

• Letters and names are in a Postgres database run by Neon.
• Photos and voice notes are in a private Cloudflare R2 bucket, and are only served through short-lived signed links.
• The site runs on Cloudflare Workers.
• Payments go through Stripe. We never see card numbers.

Our server logs don’t record page addresses, because a gift link carries its secret in the address.

Who can see a gift

Anyone who has the link. The link is a long random secret, and search engines never list it. Share it only with the person the letters are for.

How long we keep it

For as long as the gift link works. We haven’t set a fixed period yet. When we do, we’ll post it here before anything changes.

Deleting a gift

Email hello@forwhen.app from the email you paid with, or send us the gift link. We’ll delete the gift with all its photos and voice notes. A delete button on your edit link is coming later.

What we never do

• Sell your data.
• Use your letters or voice to train AI.
• Use AI voices.

Analytics

We count visits with PostHog in cookieless mode. Events never include names, letter text or gift links. A gift address is recorded as /g/:token, without the secret. PostHog also sees your browser type and IP address.