Privacy policy

The short version

• We store what you put in a card, so the card can be shown to the person you send it to.
• You don't give us your email, your phone number or theirs. You share the link yourself.
• Deleting a card from your private link deletes its photos, voice note and edit history with it.
• Payments go through our payment provider. We never see your card number.

What we store

When you make a card

The names you enter (theirs and yours), your message, doodle, photos, voice note, song link, theme, Bun's outfit, how it opens, and the date and time it's sealed until. We also keep the times it was made, last edited, and first opened, plus how many times it's been viewed. When you edit a card, we keep the earlier version of what changed, so we can look into abuse and fix mistakes; it's deleted along with the card.

Your private link contains a key. We store only a one-way fingerprint (hash) of that key, so we can check it but can't read it back.

Photos are resized and re-encoded on our server, which strips hidden data such as GPS location and camera details. Voice notes are stored as recorded.

When you open, react to, reply to or sign a card

Reactions are stored as a count, with nothing about who sent them. Replies are stored as the text you write. Group notes are stored with the name you give and what you write. The card's creator can read both.

When you pay

We keep a record of the payment: which card it was for, the amount, the currency, the payment provider's reference, and whether it succeeded. Your card details go straight to the payment provider. The payment description they receive includes the recipient's name as written on the card.

When you contact us or report a card

We keep your email and what you tell us, so we can reply and follow up. If a card is reported, we keep a copy of the card's content with the report, so we can review it even if it's later changed or deleted.

IP addresses, cookies and browser storage

• We use your IP address briefly, in memory, to stop people from flooding Bunletter (for example, making hundreds of cards an hour). It isn't written to our database. Our hosting provider may keep standard server logs, including IP addresses, for a short time for security.
• We don't use cookies for visitors. The only cookie we set is a sign-in cookie for our own staff on the admin page.
• When you make a card, your browser remembers (in local storage) that you made it, so opening your own card to check it doesn't count as them opening it. Clearing your browser data removes it.
• If you arrive through a link tagged with where it was shared (like ?ref=ig), your browser keeps that tag for up to 30 days. If you then make a card, the tag is saved with it, so we know which places bring people to Bunletter. It says nothing about who you are.

Analytics

We count visits with Umami, which we run on our own server. It doesn't use cookies, doesn't follow you across sites, and doesn't build a profile of you. It sees which page was visited, the site you came from, your browser, device type and country. Before anything is sent, links to cards are cut down to just the kind of page (for example /c/[id]), and names and messages are removed from the address, so card links, recipients' names and what you wrote never reach it.

Who else is involved

• Hosting and database providers store and serve Bunletter and its data for us.
• Cloudflare Turnstile checks that people making cards, replies and notes aren't bots. Cloudflare processes information about your browser and connection to do this, under its own privacy policy.
• Our payment provider processes payments for fancy cards, under its own privacy policy.
• YouTube and Spotify: if a card has a song from one of them, their player loads inside the card. They may set their own cookies and see that you played it, under their own policies. Cards without a linked song don't load anything from them.

We don't sell or rent your information, don't show ads, and don't use advertising or cross-site tracking tools. We'll only share information beyond the list above if the law requires it, or to protect someone from harm.

How long we keep things

• Cards stay until their creator deletes them, or until we remove them for breaking our terms.
• Deleting a card removes it, its photos, voice note, replies, notes and edit history.
• Photos and voice notes uploaded but never added to a card are deleted automatically after about a day.
• Payment records are kept for as long as we need them for accounting and tax.
• Reports, and the copy of the card kept with them, are kept as long as we need them to keep Bunletter safe.

Your choices and rights

You can edit or delete your card anytime from your private link. If you've lost it, or a card about you was sent by someone else and you'd like it removed, write to [email protected] with the card's link. Depending on where you live, you may also have the right to ask what we hold about you, have it corrected, or object to how we use it. Just ask, and we'll answer within 30 days. Since there are no accounts, we may need the card's link to find what you're asking about.

Children

Bunletter isn't meant for children under 13 to use on their own. If you think a child has given us personal information, tell us and we'll remove it.

Security

Everything travels over HTTPS. Edit keys are stored only as hashes, card links are long and random, photos are cleaned of hidden data, and uploads are checked before they're stored. No system is perfectly secure, so please don't put anything very sensitive in a card.

Changes

If we change this policy, we'll update the date at the top, and say so on the site if the change matters.

Contact

Bunletter is run by Bunletter. For anything about your privacy, write to [email protected].