Privacy notice

What we keep about you

When you create an account:

• Your email address, so you can log in and we can send you login codes.
• Your username and the display name you choose.
• Your password, if you set one. We only keep a scrambled version that can't be turned back into the password.
• That you confirmed you're 18 or older, and when.
• If you use "Continue with Google": your Google account ID and email. We never see your Google password.

Your letters

We keep what you write so the person you send it to can open it: the names, the message, the date it opens, and their reply. We also keep whether and when it was opened, so you can see "Opened".

We don't read your letters. The only time someone at Dearlly looks at one is when it is reported, to decide whether to take it down.

Unsent drafts stay on your own phone or computer until you seal them. Downloads (pictures and PDFs) are made on your device; nothing is sent to us.

People who receive a letter

If a sender types in your email address, we use it once to deliver that letter and then delete it. It is never used for marketing and never shared.

Every email has "Stop messages from this sender" and "Never email me again". To honour those, we keep a coded fingerprint of your address, not the address itself.

If you report a letter, we keep the report and your reason so we can review it and spot repeat abuse.

Keeping Dearlly safe

Like every website, our servers see your IP address. We use it briefly to stop spam and attacks (for example, limiting how many login codes can be requested). Server logs are overwritten automatically, and private letter links are removed from them.

When something breaks, an error report is sent to our error-tracking service. Private links, passwords and letter content are removed before it leaves our server.

Cookies

We only use cookies Dearlly needs to work: ones that keep you logged in, one that protects forms from forgery, and a small one that only says "logged in" so pages load fast. No advertising cookies, no tracking across other sites, no analytics.

Who helps us run Dearlly

These companies handle data only to provide their service to us, under their own privacy and security terms:

• Hostinger: our server, in the European Union.
• Cloudflare: website protection, the "are you human" check, and our encrypted backups.
• Resend: sends our emails.
• Sentry: error reports, with personal details removed.
• Google: only if you choose "Continue with Google".

How long we keep it

• Your account and letters: until you delete your account.
• "Take back" closes a letter's link straight away; the letter itself is deleted with your account.
• Recipient email addresses: deleted as soon as the letter is emailed, or if it is cancelled.
• Backups: encrypted, and each one is deleted after 35 days.

Your rights

You can ask to see the data we hold about you, correct it, move it, object to how we use it, or have it deleted. You can change your name and password and delete your account yourself in Profile. Deleting your account removes your letters and replies straight away.

Write to us and we'll reply within 30 days. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Adults only

Dearlly is for people aged 18 and over. If we learn that an account belongs to someone younger, we delete it.

Changes

When we add something new, like photos or games, we'll update this notice and change the date at the top. If a change matters, we'll tell you by email before it takes effect.