Privacy Policy

1. Introduction

EverLetter (“we,” “us,” or “our”) operates the everletter.family platform. This Privacy Policy explains how we collect, use, share, and protect information about you and your family when you use our Service. We take your privacy seriously, especially because our platform stores deeply personal family memories.

By using EverLetter, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Data Controller

EverLetter is the data controller for information collected through the Service. For privacy questions, contact us at privacy@everletter.family.

3. Information We Collect

Information you provide directly

• Account information: Name, email address, password
• Family information:Family name, Child Vault names, children’s dates of birth, child photos or names you choose to add
• Memory Capsule content: Videos, audio recordings, photos, written letters, documents, and artwork you upload
• Contributor information: Names and email addresses of family members you invite to contribute capsules
• Legacy Guardian information: Names and contact details of guardians you designate
• Payment information: Processed by Stripe, Inc. We do not store full payment card details on our servers.
• App launch interest: Email address and platform preference when you join our mobile app updates list on the marketing site

Information collected automatically

• Usage data: Pages visited, features used, session duration, and interaction patterns collected via PostHog analytics
• Device information: Browser type, operating system, device type, and screen resolution
• Log data: IP address, timestamps, and error logs
• Cookies: Session cookies for authentication and analytics cookies for product improvement. See Section 9 for details.

4. How We Use Your Information

We use your information to:

• Create and manage your account and Child Vaults
• Store, process, and deliver Memory Capsules at scheduled times
• Generate AI transcripts, summaries, and memory prompts
• Process subscription payments and manage billing
• Send transactional emails (email confirmation, capsule delivery, family invites)
• Send app launch notification emails when you join our mobile app updates list
• Provide customer support
• Improve and develop the Service using anonymized usage analytics
• Comply with legal obligations
• Respond to accessibility accommodation requests (see Section 8)

We do not sell your personal information. We do not use your Memory Capsule content to train AI models without your explicit consent.

5. Children’s Privacy (COPPA)

EverLetter complies with the Children’s Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13.

Child Vaults are created by adult account holders (parents or guardians) on behalf of children. Information associated with a Child Vault — such as a child’s name, date of birth, and photo — is provided by and under the control of the parent or guardian account holder.

Parents and guardians may at any time:

• Review the information held in any Child Vault
• Edit or correct that information
• Request deletion of a Child Vault and all associated content

To exercise these rights, contact us at privacy@everletter.family. We will respond within 10 business days and complete deletion within 30 days.

If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

6. How We Share Your Information

We share your information only in the following limited circumstances:

• Service providers: We share data with trusted third-party providers that help us operate the Service:
  • Supabase — database hosting and authentication (data stored in U.S. data centers)
  • Stripe, Inc. — payment processing
  • PostHog — product analytics (anonymized usage data)
  • Email delivery provider — transactional emails only
• Family members you invite: When you invite a contributor or Legacy Guardian, their name and email are shared only as necessary to deliver the invitation.
• Legal requirements: We may disclose information if required by law, court order, or to protect the safety of a child or other person.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you by email and provide an opportunity to delete your account before transfer.

We do not share your Memory Capsule content with advertisers, data brokers, or any party not listed above.

7. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Access controls limiting who can view your data internally
• Regular security monitoring and review

No security system is perfect. If you believe your account has been compromised, please contact us immediately at hello@everletter.family.

In the event of a security breach that affects your personal information, we will notify you by email within 72 hours of discovery, as required by applicable law. We will also notify applicable regulatory authorities where legally required.

8. Accessibility Accommodation Data

When you contact us to request an accessibility accommodation or to report an accessibility barrier, we may collect information about:

• The nature of the accessibility barrier you experienced
• The assistive technology or browser you were using
• Your preferred format for receiving information

We use this information solely to respond to your request and improve the accessibility of our Service. Accessibility accommodation requests are handled confidentially. We do not share this information with third parties, do not use it to make any decisions about your account status, and do not combine it with other personal information for any other purpose.

You may request deletion of any accessibility accommodation correspondence at any time by emailing accessibility@everletter.family.

9. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and security. These cannot be disabled without breaking the Service.
• Analytics cookies: Set by PostHog and Google Analytics only after you accept our cookie banner — to help us understand how users interact with the Service. These are anonymized and do not identify you personally.

Decline analytics cookies on our banner, or clear site data in your browser, to opt out. Disabling essential cookies will prevent you from logging in.

10. Data Retention

We retain your account information and Memory Capsule content for as long as your account is active. If you cancel your account:

• You may export your content for 60 days after a recurring subscription ends (90 days for Lifetime plan holders upon service discontinuation)
• We may delete your content from our servers after the export retention window closes
• Anonymized analytics data may be retained indefinitely
• We retain billing records as required by law (typically 7 years)

11. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and personal data
• Portability: Request an export of your data in a machine-readable format
• Opt-out of analytics: Disable analytics tracking through your browser or by contacting us

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information is sold or shared (we do not sell personal information), the right to correct inaccurate personal information, and the right to non-discrimination for exercising privacy rights. Children’s names, dates of birth, and photos held in Child Vaults are treated as Sensitive Personal Information (SPI) under CPRA and are not used for advertising or shared with third parties beyond what is listed in Section 6.

Do Not Sell or Share My Personal Information:We do not sell your personal information. Under CPRA, sharing data with analytics providers for cross-context behavioral advertising may constitute “sharing.” You may opt out of PostHog analytics at any time by disabling analytics cookies in your browser settings or by emailing us.

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Legal basis for processing: We process your personal data to perform our contract with you, to comply with legal obligations, and on the basis of our legitimate interest in improving and securing the Service.
• Right to restrict processing and right to object to processing based on legitimate interest (including analytics).
• Right to lodge a complaint with your local supervisory authority (e.g., ICO in the United Kingdom, or the relevant EU data protection authority in your member state).
• International data transfers: Your data may be transferred to and stored in the United States via Supabase, Stripe, and PostHog. These providers rely on Standard Contractual Clauses (SCCs) approved by the European Commission as a transfer safeguard.

To exercise any of these rights, contact us at privacy@everletter.family. We will respond within 45 days (30 days for GDPR requests).

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting an updated policy on this page with a new effective date. Your continued use of the Service after the effective date of changes constitutes your acceptance.

13. Contact Us

For privacy questions or requests:

EverLetter — Privacy Team
privacy@everletter.family

For accessibility questions:

accessibility@everletter.family

See also our Terms of Service and Accessibility Statement.