What we hold about you, and why.

Who is responsible

Not yet provided. The name of the person or organisation responsible and an address to write to are the operator’s to give, and this page will show them as soon as they are set. Nothing is invented here in the meantime.

What we hold, and what it is for

• Your email address. To send you a sign-in link and the mail you have not turned off. It is never shown to another member, at any level, and never passed on. Every category of mail except the sign-in link can be turned off on your own page.
• The facts on your desk. Pen name, first name, date of birth, where you live (town-level coordinates, never a street), languages, children and what you hope for. These decide who could be introduced to whom. Your first name travels to a correspondent only after a letter each; the rest is never displayed.
• The optional sensitive fields. Orientation, religion and ethnicity are optional. They are used only to honour your own preferences and those of the people you might be introduced to; blank means unknown and is never held against you. You can clear them at any time on your own page.
• Your letter, lists and answers. The introduction letter and the hidden questions feed the matching. Lists are the tiles a correspondent uncovers as you write, in the order you set. The letters you exchange are shown to the person you wrote them to and to nobody else, except a moderator if one of you reports the conversation.
• Photographs. Stored privately, looked at by a person before they can turn over for anyone, and uncovered to a correspondent only in the order and at the pace you chose. There is no gallery.
• How it went. Your verdicts on introductions teach the matching what to look for next; they are never shown to the person they are about. The counters behind the trust rules — letters sent, conversations finished, reports — are private and never shown to anybody as a score.
• Sign-in records and a mail log. Sessions last 60 days and slide while you use the desk. The mail log records that a message was sent, to whom and of what type — not its text — and is deleted after 30 days. Rate-limiting records last two days.

What we do not do

• No read receipts, typing indicators or online lights; the sender of a letter is never told when it was opened.
• No tracking pixels or click-tracking in mail, and no analytics scripts or advertising on the pages.
• No public profiles, no browsing, no gallery, and no score of anybody’s attractiveness shown to anyone.
• Nothing you write is sent to an AI service to be judged.

Where it lives

The application runs on Vercel; the database and the private photograph store are on Supabase; mail is sent through Resend. These are the services the software is built to use. Each holds only what its job needs: the mail service sees an address and a message, the photo store sees a file, and none of them sees the whole of you.

Leaving, and taking it with you

Your own page can export everything we hold about you as one file, at any time. Leaving hides your letters from your correspondents at once and closes every open conversation with a plain word to them; after 30 days everything that identifies you is erased, photographs included. Signing back in before then means you changed your mind. Your correspondents’ own letters are theirs and stay with them.