Privacy Notice

Letters From The Sea is operated by Sea Breeze Script ("we", "us"). Sea Breeze Script is the data controller for the personal data described in this notice — meaning we decide why and how it is processed, and we are responsible for it. You can reach us at any time through the support page.

Letters. The text you write, the names you choose to sign with, and the shells, sunsets and curiosities you attach. Each letter is stored with a secret link and expires 24 hours after it is written. Legal basis: performance of the service you ask us to provide (contract).

Account. If you sign in, we keep your email address, the display name you choose, your sea title, an optional avatar and a short bio. Legal basis: contract (providing your account).

Newsletter and support. Only what you type into those forms: an email address, an optional name, and your message. Legal basis: your consent for the newsletter (you can withdraw it at any time) and our legitimate interest in answering support requests.

Abuse protection. A one-way hash of your IP address, used only to slow down flooding. The address itself is never stored and the hash cannot be reversed into one. Legal basis: our legitimate interest in keeping the service safe and available.

Payments for Pro subscriptions are handled entirely by our payment provider and Merchant of Record, Paddle. When you subscribe, Paddle collects and processes your billing details (name, billing address, payment method) on its own systems to complete the sale, manage the subscription, handle taxes and issue invoices. Your card or wallet details never touch our servers or our database — we only receive a subscription status and a Paddle customer reference. Paddle processes this data under its own privacy policy and buyer terms.

Only the categories of recipients needed to run the service:

Service providers — our hosting, database and authentication providers, who process data on our behalf to keep the site running.

Paddle — our Merchant of Record, for the sale of Pro subscriptions, payment processing, subscription management, tax compliance and invoicing.

Authorities — only where we are required to by law.

We never sell or rent personal data to anyone.

Letters: automatically and permanently deleted when their link expires, 24 hours after writing.

Account data (email, name, sea title, avatar, bio): kept while your account exists and deleted when you delete your account or ask us to.

Newsletter: kept until you unsubscribe or ask us to remove you; removed within 30 days of that request.

Support messages: kept for up to 12 months so we can follow up on your question, then deleted.

IP hashes for abuse protection: kept for no more than 24 hours.

When data is no longer needed it is deleted or anonymised.

No advertising, no selling or renting of data, no third-party trackers, no profiling of what you write. Letters are never listed anywhere, never indexed by search engines, and not browsable — not even by you after you send them.

Anyone holding the secret link, within its 24 hours. That is the whole access model, so send links only to the person they are meant for. Our servers can technically read stored rows in order to serve them; no one at Sea Breeze Script reads letters as a matter of practice.

You have the right to:

Access — ask us what personal data we hold about you.

Rectification — correct inaccurate data (most of it you can edit yourself on your profile page).

Erasure — have your account, newsletter subscription or support messages deleted.

Portability — receive a copy of your data in a commonly used format.

Objection and restriction — object to processing based on legitimate interests, or ask us to restrict it.

Withdraw consent — unsubscribe from the newsletter at any time.

To exercise any of these rights, write to us from the support page. We respond within one month. Depending on where you live, you may also have the right to complain to your local data protection authority.

We protect data with appropriate technical and organisational measures, including encrypted connections, access controls and row-level isolation in our database. See our security page for details.

We use only essential cookies and storage needed to keep you signed in and make the site work. There are no analytics, advertising or marketing cookies, so there is nothing to opt out of.

This is not a service for children under 13.

If this notice changes in a way that matters, we will say so on this page and in the newsletter.