Privacy Policy

Snail Mail collects as little as it can to carry your letters. We don’t sell your data, we don’t show ads, and we don’t track you across other sites.

What we keep

• Your account: name, username, email address and a securely hashed password. We also record when you agreed to these policies.
• Your profile: your town (never a street address), and optionally a short bio, interests and whether you’re listed as a pen pal.
• Your letters: what you write, who it’s addressed to, the towns at each end, the carrier, the timing and whether it has been read.
• Notifications: if you turn them on, the push address your browser gives us.
• Safety records: blocks you make, reports you file or that are filed about letters you sent (including a copy of the reported letter), and any moderation decisions.

What we use briefly and don’t keep

• Your IP address is used to stop abuse (rate limits and bot detection) and, when you first set up your mailbox, to guess your nearest town. The guess is offered to you, not saved unless you choose it.
• Our host collects cookie-free, aggregated visit statistics and page performance data. These aren’t tied to your account.

Cookies

We use a handful of strictly necessary cookies: one that keeps you signed in, and small ones that remember your time zone, language and light or dark preference. No advertising or tracking cookies.

Who can see what

• The person you write to can read your letter once it arrives, along with your name and town.
• Anyone with a tracking number sees the journey: names on the envelope, towns, carrier and timing. Never the words.
• Anyone with a letter’s private link can read that letter after it arrives.
• If you list yourself as a pen pal, other members see your name, username, town, bio and interests.
• Letters are encrypted in transit and at rest by our providers, but they are not end-to-end encrypted. The person running Snail Mail could technically access stored letters and only does so to review a report, keep the service working, or when legally required.

Services we rely on

Vercel hosts the site, runs the delivery schedule, provides analytics and bot protection (Vercel BotID, powered by Kasada). Neon stores the database. Push notifications travel through your browser maker’s push service (for example Apple, Google or Mozilla). Data is stored in the United States.

How long we keep it

Your account, profile and letters stay until you delete them. Deleting your mailbox removes your account, profile and the letters you sent right away; letters others sent you stay with them. Backups held by our providers roll off within their retention windows. Reports are kept for up to a year after they’re resolved so repeat abuse can be spotted.

Your choices and rights

From Settings you can update your profile, download everything we hold about you, and delete your mailbox. Depending on where you live (for example under GDPR or CCPA) you may have further rights to access, correct, delete or object to the use of your data. To ask about any of them, contact the Report button on any letter, or Settings in your mailbox.

Children

Snail Mail isn’t for anyone under 16, and the pen-pal directory is for adults only. If you believe a child has made a mailbox, tell us and we’ll delete it.

Changes

If we change this policy in a meaningful way we’ll post a notice on the site before it takes effect.