Privacy

We built the tool so the letter does not have to live on our server.

What you type

When you draft a letter, the form is sent to our server. If an OpenAI API key is configured, those facts are sent to OpenAI to produce the draft, then the draft is returned to your browser. We do not write the letter text to a database. The draft sits in this tab’s session storage so you can preview it. Closing the tab clears it.

What we refuse

Do not send a Social Security number or a full bank account number. The form rejects those patterns. The only account detail the gift form accepts is an optional last 4.

Payment

Checkout, when it is connected, is handled by Lemon Squeezy. We send a product choice and a random letter id, not the letter. The webhook tells us an order was paid. Card numbers stay with Lemon Squeezy. An unlock token is then kept in this browser’s local storage. We do not run user accounts.

Rate limits and analytics

Draft requests are counted by IP address in memory, on that server instance, so one network cannot generate letters without limit. The count is not a profile. Vercel Web Analytics measures traffic. If a Google Analytics measurement id is configured, Google Analytics loads too. Those tools see page views, not the body of your letter.

How long anything lasts

The in-memory rate limit and the in-memory record of a paid order exist only as long as that server process does. The browser copy of the letter lasts until you clear the tab. A single-letter unlock is meant for 7 days, and the 30-day pass for 30 days, both in the browser that completed checkout.