Privacy Policy

FutureLetter lets you write a letter and schedule it to be emailed to someone on a date you choose. This page explains what we collect, why, who processes it, where it goes and how long it stays. We have tried to say only what is true for how the service works today.

FutureLetter is operated by A&B Network (https://anb-network.com), a sole proprietorship in the Republic of Korea. Privacy officer: the owner of A&B Network. Contact: contact+future-letter@evoa.one.

When you write a letter we collect: - The recipient's email address (you give it to us; the recipient has not given it to us). - Your own email address. It is always required, to send you a confirmation message and to limit abuse. The "anonymous" option only hides your address from the recipient; we still store it. - The letter title, the letter text, the theme, the language and the date you want it delivered. - Technical records needed to run the service: confirmation tokens (stored as hashes), a lowercase copy of your address used for rate limits, and a one-way hash used to detect duplicate letters. We do not store your IP address in our database. Our application logs contain letter IDs, spam-check scores and mail error messages. The hosting provider keeps its own technical request logs (see "Service providers"). While you write, your draft (including the letter text) is saved in your browser (local storage) so you do not lose it. It stays there until you send the letter successfully or clear your browser data. It is not sent to us until you submit. Google Analytics, Google ads and Cloudflare Web Analytics do not run on the writing page, on letter pages or on any page whose address contains a letter ID or token. The writing page still uses Google reCAPTCHA (see "Service providers and overseas transfers" below).

We use this data only to: confirm your address, send the letter on the chosen date, show it to the recipient, keep the service running and safe, prevent abuse and spam, and meet legal duties. We do not use it for marketing and we do not sell it.

Letters are stored in Google Cloud Firestore; the service runs on Firebase App Hosting (Google Cloud). Region: Taiwan (Google Cloud asia-east1) for both the hosting and the database. The database accepts no direct connections from browsers or apps; all reads and writes go through our server. Data is encrypted in transit (HTTPS) and, by Google's default, at rest. We do not add application-level encryption, and operators with access to the project can technically read stored letters. How a letter is shown: the email to the recipient contains the title (as the subject) and a link, not the letter text. To open a letter the recipient types their own email address; a match opens it for 15 minutes in that browser. Anyone who has both the link and the recipient's address can read the letter. Do not put sensitive information in the title, because it travels in the email subject, and do not write anything you would not want others to read. Emails: you receive a confirmation email (title, recipient address, sending time, confirmation link). The recipient receives the notification described above.

We use the following providers. Google Cloud and Resend process data on our behalf to run the service. Some of them are located outside Korea, so your data is transferred abroad. - Google LLC (Google Cloud: Firebase App Hosting, Cloud Run, Firestore, Cloud Scheduler). Items: everything listed under "data", plus technical request logs (IP address, time, requested URL, browser type). Country and place: Taiwan (asia-east1); Google may also process data in the United States. When and how: sent over the network when you use the site or submit a letter. Purpose: hosting and running the service. Retention: as under "How long we keep it"; hosting request logs 30 days. Contact: Google LLC, https://policies.google.com/privacy To refuse: do not use FutureLetter. Effect: the service cannot be used. - Resend, Inc. (email delivery, via SMTP). Items: sender and recipient addresses, the letter title (subject), notification text and link. The letter text is not sent in the email. Country and place: United States. When and how: sent over the network when a confirmation or delivery email is sent. Purpose: delivering the emails. Retention: Resend keeps email delivery records under its own policy. Contact: Resend, Inc., https://resend.com/legal/privacy-policy To refuse: do not schedule letters. Effect: letters cannot be sent. - Google LLC (reCAPTCHA v3, spam protection). Items: IP address, browser and device information and page interaction data, which the reCAPTCHA script collects when the writing page loads. We receive only a score and token. Country and place: United States and other Google locations. When and how: when the writing page loads and when you submit. Purpose: preventing spam and abuse. Retention: determined by Google. Contact: Google LLC, https://policies.google.com/privacy To refuse: do not use the writing page. Effect: letters cannot be written. The writing page links to Google's Privacy Policy and Terms of Service. - Cloudflare, Inc. (Cloudflare Web Analytics, site statistics). Items: page path without the query string, referring page, country derived from your IP address, browser, operating system and device type, page-load timings; public pages only. Country and place: United States. When and how: sent over the network each time a public page is viewed. Purpose: site statistics and performance measurement. Retention: statistics can be viewed for the previous six months (Cloudflare's information). Contact: Cloudflare, Inc., https://www.cloudflare.com/privacypolicy/ To refuse: block the script with a content blocker or email contact+future-letter@evoa.one. Effect: the site works unchanged. - Google LLC (AdSense and Google Analytics), only if you accept in the cookie bar. Items: IP address, cookie identifiers, page address, referring page, time on page, device and browser information, approximate location (Google Analytics); ad impressions and interactions (AdSense). Country and place: United States and other Google locations. When and how: sent over the network from the time you accept. Purpose: visit analysis and showing and measuring ads. Retention: Google Analytics event data up to 14 months (the product maximum; our setting may be shorter); ads as set by Google's policies. Contact: Google LLC, https://policies.google.com/privacy To refuse: choose Decline, or withdraw with "Ad and analytics cookie settings" in the footer. Effect: the service works the same without them. We do not sell your data or share it for other purposes. We may disclose data where the law, a court or a government authority requires it.

Each letter and its duplicate-check record are deleted automatically 3 months after the date you chose for delivery, whether or not the letter was sent or confirmed. Rescheduling a held letter moves that date. Deletion is automatic and can lag by about a day. Backups of the database are made daily and kept for 7 days. Deleted letters cannot be restored. If you want to keep a letter, save a copy yourself. Records at Google and Resend follow their own retention (see "Service providers"). To delete a letter earlier, contact us at the address above with the recipient address and the title; we may ask you to confirm from your sender address. Your cookie choice stays in your browser until you clear your browser data or change the choice.

Site statistics without cookies. We use Cloudflare Web Analytics, provided by Cloudflare, Inc. (USA), to see how our public pages are used and to measure page performance. It sets no cookies and does not use your browser's local or session storage. Each page view sends Cloudflare the page path (without the query string), the referring page, country-level location derived from your IP address, your browser, operating system and device type, and page-load timings. Cloudflare states that it does not use this tool to track individual visitors across websites. Statistics can be viewed for the previous six months. For visitors in the EEA, the UK and Switzerland the legal basis is our legitimate interest in operating and improving the site (GDPR Art. 6(1)(f)). You can object by emailing contact+future-letter@evoa.one or by blocking the script with a content blocker; the site works without it. Cloudflare may process this data in the United States: https://www.cloudflare.com/privacypolicy/ Visit analysis (Google Analytics 4). With your consent only, this site uses Google Analytics 4 from Google LLC (USA). Until you accept, Google Analytics is not loaded. If you accept, Google sets cookies whose names begin with _ga in your browser and receives the page address, the referring page, time on page, device and browser information, approximate location and the cookie identifier. We use this to see how many people visit and which pages they read. Google keeps the event data for up to 14 months (the product maximum; our setting may be shorter). For visitors in the EEA, the UK and Switzerland the legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with "Ad and analytics cookie settings" in the footer, or block Google Analytics with the add-on at https://tools.google.com/dlpage/gaoptout Ads (Google AdSense). This site shows ads to help cover its costs. Until you accept in the cookie bar, ad scripts are not loaded. If you decline, no Google ad service is contacted and no ad cookies are set (the writing page still contacts Google reCAPTCHA; see "Service providers and overseas transfers"). If you accept, Google loads ad scripts from its ad servers and sets cookies and storage entries (for example FCCDCF, FCNEC and google_ama_config) to serve and measure ads and to remember your consent choices; Google and its ad partners may use visit information from this and other sites to show ads matched to your interests. Google's own policies describe that processing: https://policies.google.com/technologies/partner-sites . Ad settings: https://adssettings.google.com . Your choice is stored in your browser (local storage key futureletter_ad_consent) and can be changed at any time with "Ad and analytics cookie settings" in the footer; withdrawing stops further loading and tries to remove Google's cookies (from this site and its parent domain evoa.one). Cookies that are not removed can be deleted in your browser settings. Google's cookies are shared across *.evoa.one, so changing your choice or clearing cookies here can also remove Google's cookies for other EVOA sites. Other cookies and storage on this site: a language cookie (NEXT_LOCALE), a 15-minute session cookie that lets a recipient who typed their address keep reading a letter, a cookie of up to 24 hours set only when you confirm a letter after its delivery date has passed (the letter is held because that date passed before confirmation; this cookie lets you reschedule or discard it), your saved draft (see "data") and your cookie choice. Google's privacy policy: https://policies.google.com/privacy

You can ask us to show, correct, delete or stop processing the data we hold about you, and to tell you who we gave it to, by emailing the address above. We reply within 10 days. If you received a notification email and do not want the letter, contact us with the address it was sent to and the letter title and we will delete it. You can also complain to the data protection authority of your country, in Korea the Personal Information Protection Commission.

FutureLetter is not directed at children under 14 and we do not knowingly collect their data. If you think a child under 14 used it, contact us and we will delete it.

We update this page when the service or our providers change; the date at the top shows the latest version.