Privacy Policy

The short version

We collect only what we need to let you sign in, keep the letters you write, and remember the mood you set. We do not sell your data, we do not run advertising networks, and we never read your letters for any purpose other than delivering the experience you asked for. Where we rely on others (to host the site, store data, or process a donation), we choose providers who are bound to the same restraint.

Who we are

Lost Letters Room is the service described at www.lostlettersroom.com. For anything in this policy, you can reach us at support@lostlettersroom.com. For the purposes of data-protection law, we act as the data controller for the information described below.

What we collect

When you create an account

Accounts are handled by our authentication provider (Supabase). If you sign in with email, we store your email address and an encrypted credential. If you sign in with Google, we receive your email address and basic profile details from Google — never your Google password. We also keep a display name and any profile preferences you choose to set.

When you write and lose letters

We store the letters you compose — their text, the recipient name you give, the paper and wax you choose, and whether you wished to remain anonymous. If you lose a letter on the Atlas, we also store the approximate place you dropped it and a private share token so a stranger can later open it at a link. Letters marked discoverable are shown to others without your account identity attached unless you chose to sign them.

When you support us

Donations are processed by Stripe. We never see or store your full card details; Stripe handles the payment and returns only a confirmation and the amount to us.

Automatically

Like any website, our hosting provider records basic technical logs (such as IP address and request time) to keep the service secure and available. If you allow analytics cookies, we also collect anonymous, aggregate counts of which pages are visited. See our Cookie Policy for the full list and how to change your mind.

Why we use it, and on what basis

• To run the room — creating your account, saving and displaying your letters, and processing donations. This is necessary to provide the service you requested.
• To remember your preferences — candlelight, sound, and language — with your consent, so the room feels the same each visit.
• To keep the house standing — security, fraud prevention, and diagnosing faults. This rests on our legitimate interest in a safe, working service.
• To understand what is used — anonymous analytics, only if you allow it.

Who we share it with

We share data only with the providers who make the service possible, each acting on our instructions: Supabase (hosting, database, and authentication), Vercel (application hosting and delivery), and Stripe (donations). We may also disclose information if the law genuinely requires it. We do not sell personal data.

How long we keep it

We keep your account and letters for as long as your account exists. If you delete your account or ask us to, we remove your personal data within a reasonable period, except where we must retain limited records (for example, a donation receipt) to meet a legal or accounting obligation.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these, write to support@lostlettersroom.com and we will respond within the time the law allows. You may also complain to your local data-protection authority.

Children

The room is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will remove it.

Changes to this policy

If we change how we handle your data, we will update this page and its date above. Material changes to cookies or consent will re-open the choice banner so you can decide again.