Privacy policy

Last updated 6 October 2026. Questions or requests: [email protected].

What we store, and why

• The letter. The words, the names on the envelope, the song link and the email addresses you add are encrypted before they are stored. We need them to deliver the letter and to show it to the person it is for. Nobody at Open When reads private letters.
• Email addresses. Only if you add one: theirs, so we can tell them a letter is waiting; yours, so we can tell you it was opened, remind you of a date or send your links again. We also keep a one-way fingerprint of each address so we can find your letters when you ask, without storing the address in readable form.
• Saved dates. If you turn on a reminder, we store the name, the day and month, your email and your time zone, and send one email a week before.
• A record of emails sent. Which kind of email went out and when, so we never send the same one twice. Outside testing it holds no names, words or addresses.
• If you sign in (optional). Writing and reading never need an account. If you sign in with Google to keep your shelf on more than one device, we store your Google account id, your email address (encrypted), a sign-in cookie, and your shelf's keys (encrypted): the ids and private keys of letters you wrote, the letters you received and your saved dates. Never your unsent letters or drafts.
• Seen and hearts on the public shelf. When you read a shared letter for a few seconds, or heart one, we store a fingerprint of a random number your browser made for itself, so each reader counts once. It is not linked to your name, your email or your account.
• Abuse limits. A fingerprint of your IP address, kept for one day, so nobody can send thousands of letters. It is deleted daily. Before we send an email for you, Cloudflare Turnstile checks that a person, not a script, is asking.

What stays on your device

Your drafts, your unsent letters, your shelf and the private keys to the letters you wrote live in your browser's storage on this device (and, if you sign in, the shelf's keys are also kept with your account). Unsent letters never leave it. Clearing your browser's site data removes them; Delete everything removes them too.

How a letter is protected

Each letter has two private keys: one for the writer, one for the reader. The reader's key travels in the part of the link after the "#", which browsers do not send to any server. We store only fingerprints of the keys, so a copy of our database does not open any letter.

Who else processes it

• Cloudflare hosts the site and the database, and runs Turnstile, the check that keeps bots from sending email.
• Google signs you in, only if you choose Continue with Google. Google tells us your account id and email address and nothing else.
• Resend sends our emails.

We do not sell or share personal information, and we do not use it for advertising.

How long we keep it

A letter is kept until its writer deletes it. When a letter is deleted, its words, names, addresses and song are wiped straight away; only its id and dates remain, so the link can say there is no letter here. A saved date is kept until you remove it. An account is kept until you delete it: Delete everything on the privacy page deletes the account and its saved shelf too. A sign-in lasts 180 days or until you sign out. You can stop all email from Open When to your address with the link at the bottom of any email we send.

The public shelf

Nothing is public unless the writer asks, after the letter has been opened. We remove names and places, a person reads it before it goes up, and the writer can take it down at any time. Unsent letters are never public.

Your rights

You can see, download or delete your letters at any time from the privacy page and your shelf. For anything else, including a copy of what we hold about your email address or a request to delete it, write to [email protected] and we will answer within 30 days.

Children

Open When is not for children under 13, and we do not knowingly collect information from them. A parent can write a letter to a child and give it to them later.

Changes

If this policy changes, the date at the top changes too. If a change is significant, we will say so on this page before it takes effect.