Privacy Policy

1. Information We Collect

When you create an account, we collect your email address, display name, and profile photo (if you sign in with Google). When you generate a letter, we store the letter content and the details you provided in the form so you can access your letter history.

2. How We Use Your Data

Your form inputs are sent to the Claude API (by Anthropic) to generate your letter. Generated letters are stored in your account for your letter history feature. We use your data to provide, secure, and improve the service.

3. Email Communications

We send two kinds of email:

• Transactional emails — account verification, welcome, letter delivery, payment receipts/invoices, refund confirmations, and subscription notices (renewal, failed payment, cancellation). These are required to operate your account and are sent regardless of marketing preferences.
• Product & marketing emails — occasional tips, win-back reminders, and offers. Every one includes an unsubscribe link, and you can opt out at any time from your email preferences; we honor that choice on all non-transactional email.

4. Data Storage & Security

Your data is stored securely in Firebase Firestore with encryption at rest and in transit. Authentication is handled by Firebase Auth. Payment processing is handled by Stripe — we do not store your payment card information.

5. Sub-Processors & Third-Party Services

We share data with the following sub-processors only as needed to operate CraftMyLetter, and only the data each requires:

• Firebase (Google) — authentication, and storage of your account, letters, and purchase records
• Anthropic (Claude API) — your form inputs, to generate your letter
• Stripe — payment processing (card details go directly to Stripe; we never store them) and your email for receipts
• Resend — sending transactional and (where opted in) product emails to your address
• Vercel — application hosting and infrastructure logs
• PostHog — product analytics and event data (see Cookies & Analytics below)
• Microsoft Clarity — session recordings and heatmaps to understand usability; input text is masked by default (see Cookies & Analytics below)
• Upstash (Redis) — rate-limiting counters keyed by account/IP to prevent abuse
• Sentry — error monitoring; events are PII-scrubbed (emails redacted, letter content excluded) before they are sent

6. Cookies & Analytics

We use PostHog for product analytics and Microsoft Clarity for session recordings and heatmaps to understand how the service is used and improve it. Clarity masks input text by default. For visitors in the EU, UK, EEA, and Switzerland we ask for consent before enabling these analytics cookies, and both stay off until you accept. You can decline and continue to use CraftMyLetter normally.

7. Data Deletion & Export

You can delete individual letters from your history at any time. You can also delete your entire account and all associated data yourself from your account settings — this permanently removes your letters, purchases, and sign-in, and cancels any active subscription. Before deleting, you can export your data as a JSON file. For help, contact support@craftmyletter.com.

8. Contact

If you have questions about this privacy policy, contact us at support@craftmyletter.com.