Security

The letters table denies every direct request from the app. Reads and writes happen only inside trusted server code, and only when a request carries the exact secret link.

Each letter gets a 192-bit random token generated with a cryptographic random source. There is no listing, no sequential id and no way to search for someone else's letter.

A day after it is written, a letter stops being served entirely — an old link returns nothing at all, not even the sender's name.

Text is stripped of control characters and length-limited, emails are validated, and attachments (shells, sunsets, inks, papers, curiosities, chests, seas) are matched against a fixed catalogue on the server. Pro items are verified server-side, never trusted from the browser.

Letter sending, newsletter signups and support messages are rate limited per hour using a one-way hash of the sender's network address.

Sign-in is handled by a managed authentication provider — we never see or store your password. Your profile row can only be read and edited by you. Avatars live in a private bucket where each file sits in a folder keyed to your account, and only you can read or replace it.

Card, Apple Pay and PayPal details are entered on the payment provider's own hosted checkout. Those details never touch this site or our database.

Please tell us through the support page before sharing it publicly. We answer every report.