Privacy Policy

About this policy

This Privacy Policy describes how Letterfy Inc. (“Letterfy,” “we,” “us,” or “our”) handles information when you visit our website, use the Letterfy iOS app, or contact us. The app is currently in pre-release development; availability and features may differ between test builds and a future public release.

This policy updates our earlier Letterfy privacy policy to describe the current website and iOS experience. If we introduce a feature that changes how your information is used, we will update this policy and provide additional notice or seek consent where required.

Information we handle

The coming-soon website

You can browse this website without creating an account. The site does not have a mailing-list signup form, advertising trackers, or third-party analytics scripts. We use Cloudflare to serve the site. Hosting and security infrastructure necessarily processes network information, such as your IP address, requested address, browser information and request time, to deliver and protect the website. We do not enable application-level request logging for this site.

When you contact us

If you email us, we receive your email address, the contents of your message and any information you choose to include. We use this information to respond, provide support and resolve issues. Please do not send passwords, access tokens or private email content unless it is necessary for your request.

When you connect an email account

The app uses your email provider’s authorization flow. Your account information, email data, synchronization state, newsletter choices, reading preferences and saved/read status are processed on your device to provide the reading experience. Provider access and refresh tokens are stored in the device’s Keychain; they are not sent to Letterfy’s servers. We do not receive your email account password.

A first mailbox check covers up to 100 emails per account from the past five days. Subsequent checks include read and unread mail, resume unfinished checks, and process new provider-reported arrivals even when their message dates are older. A sync repair may recheck the recent five-day window to recover missed issues. Checks run when you request them, or automatically if you enable that option. Newsletter detection and duplicate checking happen on your device.

Email & newsletter data

Letterfy retrieves email from your connected provider and identifies newsletters on your device. Detection may examine messages that are not newsletters, so it would be inaccurate to say the app never accesses other email. Classification is imperfect, and you choose which newsletters to add.

Find missing newsletters lets you search your connected Gmail mailbox, including older read and unread messages outside the initial check. Search terms go directly to Google. Results and email previews remain in memory until you choose emails to add. Compatible builds render previews with the same isolated reader used for saved newsletters; opening a preview does not add the email or change its read status. Remote images start blocked in each preview. If you choose to load them, that permission applies only until you close the preview; fetched preview images are held in memory. Selected emails are stored on this device, their senders are approved locally (including previously hidden senders), and their current read status is preserved. The manual inclusion choice remains until the message or account is removed. In compatible builds, Add privately keeps manually selected messages out of catalog submissions, while Add & verify explicitly includes them in the contribution process below. Builds without those choices keep manual additions out of catalog submissions. They are never used for shared-model training.

Possible newsletters keeps uncertain emails on your device for review, including some short reading announcements and emails with limited editorial evidence. They stay outside your reading library until you explicitly add them. Adding preserves read status and approves the sender locally. Dismissing removes the local email unless you saved it. In compatible builds, Not a newsletter also stores a local hashed repeat rule scoped to that connected mailbox, sender, mailing-list identity and recurring subject wording, allowing standalone numbers to vary. Matching pending and future emails stay out of newsletter suggestions; different topics or mailing lists from the same sender can still appear, and already approved reading mail is preserved. Generic subjects only dismiss the individual email. Explicitly adding a matching email through Find in your email clears its repeat rule. Earlier builds remember only the dismissed message. Dismissing does not revoke sender approval or catalog-contribution consent, but dismissed messages remain excluded from contributions. Hide is a separate sender-wide choice, reversible through Your newsletters → Hidden senders. These choices do not unsubscribe you or delete email at your provider. Pending review and dismissal choices survive detector changes and are cleared when the account is removed. In compatible builds, Add privately keeps these emails out of catalog submissions, while Add & verify explicitly authorizes the contribution process below. Builds without those choices keep possible-newsletter additions out of catalog submissions. Mail and review choices are never used for shared-model training.

When you choose Unsubscribe for a supported message, Letterfy sends a direct HTTPS request from your device to the publisher’s unsubscribe endpoint. The request includes the publisher-provided subscription URL, which may contain a recipient identifier or token, a fixed unsubscribe instruction, and ordinary connection information such as your IP address. It does not add mailbox credentials, cookies, email content or a separate recipient address. Other recognized unsubscribe links open the publisher’s page after you review the destination. Mail checks do not send unsubscribe requests. Action metadata stays in the local mailbox cache; an account-scoped URL hash and request status remain locally to prevent repeat sends until you remove the account. These links and receipts are not uploaded to Letterfy’s server, catalog or notifications.

Subscription confirmation review uses local rules and, starting with build 55, a separate bundled on-device intent model to identify recent newsletter signup requests before newsletter filtering. The model can recognize unfamiliar subject lines, but a request must still pass explicit-link and newsletter-intent checks. It does not choose arbitrary links, contact an AI service or open actions automatically. Known confirmation templates continue to use local rules if the model is unavailable. The app stores sender, subject, message date, message identifier and the confirmation link in a separate on-device queue; it does not keep a full email body in this queue. Detection can miss requests or mistake other messages for confirmations. Letterfy does not automatically open these links or authenticate the sender. You review the sender and destination and choose whether to open the publisher’s page. That site receives the requested URL, including any confirmation token, and ordinary connection information; opening the link may activate your subscription. Dismissing clears the local action payload. Requests older than five days are hidden and cleared during local mailbox cleanup. A local message receipt prevents repeats until the message or account is removed. Confirmation links are not sent to Letterfy’s server, the public catalog or notifications, and connected customer mail is not collected for shared-model training. In builds with confirmation completion, you can report that the publisher confirmed your subscription. This adds the newsletter to your local library and clears the action link. If catalog sharing is enabled, its publication name and sender or list identity are queued for publisher review without the confirmation subject, message body, action URL or token. Local subscription metadata and completion receipts remain until account removal; hiding the newsletter stops pending submissions. Opening a link alone does not mark success. Welcomes may appear in your library, but welcome and confirmation metadata do not create editorial issue candidates.

Starting with build 49, newsletter detection first uses a bundled Letterfy Core ML classifier on your device. Newsletter welcomes may be included; subscription confirmation requests remain a separate action flow. If the bundled model cannot process an email, the app falls back to Apple’s on-device model when available or local rules. Detection can make mistakes; you can review possible newsletters, add missed mail or remove unwanted sources. Message content is not sent to Letterfy or a cloud AI service for classification. Downloaded email content and the local search index stay on your device. Letterfy’s backend does not automatically receive newsletter bodies, recipient identifiers or provider credentials. Private reading history stays on your device unless you enable the separate publication-count contribution described below. A passage you deliberately publish in a discussion is a separate public disclosure, described below.

Letterfy requests Google’s gmail.modify permission to read messages and synchronize read/unread state, such as marking a newsletter as read when you finish it. The Google permission grant is broader than those particular actions; the app does not use it to send or delete email. User-selected unsubscribe requests use a separate direct connection to the publisher, not a mailbox-send operation. You can withdraw provider access at any time through your Google Account.

Choices during setup

Starting with build 57, a fresh onboarding setup presents publication matching, catalog sharing, publication reader counts, automatic newsletter images, hourly automatic mail checks, and all three notification categories initially on. Each choice has an explanation and can be turned off before you save and continue. Opening or dismissing the choices does not apply them. Previously saved choices are preserved when setup resumes, and updating the app does not change preferences for people who already completed setup. These choices remain editable in Privacy & data, Reading preferences, Mail checks and Notifications. Notification delivery also needs separate iOS permission, which you can decline while continuing to use Letterfy.

Automatic checks and notifications

Automatic checks after initial account setup are optional. Fresh onboarding in build 57 and later initially selects them with an hourly target; saving and continuing enables the selected setting. Earlier builds start with automatic checking off, and existing choices are preserved. You can choose an hourly, six-hourly or daily target, or turn checks off in Mail checks. Checks run on your device; iOS controls background timing. When enabled, mailbox credentials and the local mailbox remain accessible to Letterfy while your phone is locked after the first unlock following a restart. Turning automatic checks off restores access only while unlocked. Mailbox credentials remain in device-only Keychain storage and are not sent to Letterfy.

Separate switches control local notifications for new reading, items needing review, and subscription confirmations. All three are initially selected in fresh onboarding starting with build 57; earlier builds start with subscription confirmation alerts off. Existing choices are preserved. Alerts apply to eligible new discoveries after the selected category is enabled, without sending an old backlog. Saving notification choices during onboarding or choosing Enable notifications later can request separate iOS permission. Declining that permission does not prevent mail checks or reading. Notifications show counts, without email subjects or addresses. The app keeps notification history and pending alerts locally to prevent duplicates and removes that account’s history when you remove the account. Manual checking remains available without notification permission.

Publication matching and browsing

Starting with build 44, publication matching is initially on in onboarding, where its disclosure and switch let you turn it off before continuing. Continuing saves that choice. While matching is enabled, Letterfy automatically sends normalized sender addresses or publication-specific List-IDs and versioned hashes derived from those identities and issue titles to its authenticated catalog service in small batches. This finds existing publication and public issue identifiers without downloading the whole directory. Unknown newsletters remain readable. Matching requests do not contain raw subjects, bodies, previews, recipient addresses, mailbox account identifiers, reading state or provider credentials. Sender and list identifiers may themselves contain personal information. The hashes are derived mailbox data, not anonymization, and known titles can be compared with them.

The service processes lookup keys to answer the request; the lookup handler does not save keys, results or a lookup history in server tables or application logs. Installation authentication and ordinary hosting/security processing still apply, so a request can be associated with the installation while it is handled. On-device caches retain relevant keys and results for offline use and remove keys for mail no longer in the library on its next reload. Lookups do not add catalog suggestions or verification votes and do not train a model. Add privately and the catalog-contribution pause control prevent contributions; they do not disable publication matching. You can turn matching off separately in Privacy & data; this clears its local lookup cache and stops future matching requests. Build 43 instead asks through a separate first-use choice. Existing matching choices are preserved. Installations that already completed onboarding without making a matching choice keep matching off until it is enabled in Privacy & data.

Discover sends your search text and page cursor to the catalog service. Public issue browsing sends relevant publication IDs, search text and page cursors; artwork requests send a bounded list of catalog publication IDs. These requests may reveal publications of interest to the service during processing. They do not contain newsletter bodies or mailbox credentials, and these handlers do not save a browsing history.

Publication catalog sharing

In compatible builds that offer Add & verify (including builds 39, 40 and 43), Add & verify shares the publication name, normalized sender address or publication-specific List-ID, issue title, date and, where sufficient content is available, an on-device content fingerprint with Letterfy to improve Discover. A disclosure appears immediately before that choice in newsletter review and manual recovery. This authorizes contributions for that publication’s eligible current and future issues. Add privately and swipe-to-add exclude it from contributions; optional publication matching still works as described above. Existing library approvals do not authorize these new contributions. The Privacy & data sharing switch is initially enabled as a pause control. Starting with build 57, fresh onboarding also presents that choice before you save and continue. The switch does not itself enroll a publication; switching it off stops future contributions and switching it back on resumes previously confirmed choices. Builds without Add & verify, including build 41, may still send limited catalog metadata under their existing catalog-sharing setting, which is initially enabled; they do not send content fingerprints. Manually recovered and possible-newsletter additions in those builds remain excluded from catalog submissions.

The submitted catalog fields do not include your account identifier, recipient address, message body, preview, images, reading state or email credentials. A separate app-access credential accompanies the request so Letterfy can verify the installation. We do not attach the installation key or credential to catalog review records. They enter a private review queue; approved publication identities can become part of the public directory. Reviewers may see the submitted publication information. We also store versioned lookup fingerprints derived from the submitted newsletter identity and normalized issue title. Reviewed fingerprints can appear in the public catalog so your device can match an issue without uploading its body or personalized links. These hashes are lookup identifiers, not anonymization or proof of delivery. Sender addresses and issue titles can themselves contain personal information, so consider this before enabling sharing or adding a newsletter.

Community verification uses a versioned, deterministic fingerprint calculated on your iPhone from normalized newsletter text. Fixed rules discard common greetings, hidden previews, tracking links, footer blocks and formatting; email bodies and recipient addresses are not uploaded. Unknown personalization can prevent a match, and short or insufficient text is skipped. Sender addresses and issue titles may contain personal information. Fingerprints are derived mailbox data, not guaranteed anonymization: a known text can be compared with its fingerprint. No generative model or shared-model training is used for this step.

The server combines the content fingerprint with a keyed, publication-specific pseudonym derived from the verified app installation and a server observation time. The pseudonym links reports within that publication and is not anonymous. One installation counts once per distinct content fingerprint. Administrators configure the required installations, distinct fingerprints and counting window; reports expire after 90 days. Pausing sharing stops future reports; previously stored reports expire on that schedule. Legacy subject-only signatures never count toward content verification. Matching reports suggest a real newsletter, not necessarily distinct people, authenticated delivery, publisher endorsement or permission to reuse content. Publication details and public links still need validation.

Letterfy also maintains a separate research inbox subscribed to publications for product development. Confirmed subscriptions and delivered messages can supply publication names and exact sender or list identities, and editorial editions can supply issue titles and receipt dates, to the same private catalog review queue. Bodies, recipients, provider identifiers and confirmation links are not copied into this catalog intake. A research subscription does not itself approve a public catalog entry; independent publisher checks and review still apply.

When automatic catalog review is enabled, Letterfy compares these suggestions with public publisher websites, subscription pages and RSS or Atom feeds. We collect public publication names, author or publisher names, descriptions, topic categories, archive links and possible artwork links, and retain selected facts, source links, check results and review history. Supported matches can enter Discover automatically; uncertain matches remain for human review. These checks do not approve artwork rights, establish authentic email delivery, grant reader eligibility or add newsletters to your personal library.

Public-source requests come from Letterfy’s server. The publisher receives the requested public URL and ordinary server connection information; Cloudflare’s DNS resolver receives the website hostname. We do not forward your app credentials, mailbox credentials, cookies, recipient information or submitted issue titles with these requests. Standard Substack sender addresses can identify a publication subdomain. This review uses deterministic rules, does not send submissions to a cloud AI model, and does not retain fetched page or feed bodies or add them to a training dataset.

Sharing visual cards

Compatible builds let you preview and export an image card for a selected newsletter passage, a newsletter title, a public discussion post and its context, or a publication. Cards are rendered on your device and may include a suitable publication avatar already available in the app. Preparing the card does not fetch additional newsletter images. Creating a preview does not upload it to Letterfy or publish it to a social network. Newsletter cards do not automatically include the email body or preview; quote cards include the text you select. A title or selected passage may contain personal information, so review the card and caption before sharing.

When you choose a destination in the iOS share sheet, that app or service receives the card and the caption and public source link if included. The destination controls how these items are displayed and retained, under its own terms and privacy policy. Public source links come from the reviewed catalog, rather than personalized links in your email. If no verified link is available, you can still share the card. Copy caption writes the caption to your device clipboard. Choosing Save Image can save the card to your photo library with your permission. Letterfy does not store exported cards on its server; recipients and other services may keep copies that Letterfy cannot recall.

Public discussions & identity

Compatible Letterfy builds offer optional public discussions using an existing AT Protocol account, including supported Bluesky accounts. This connection is separate from email sign-in. Your provider handles account authorization, and community access credentials are kept in a separate device-only Keychain entry. Letterfy’s API receives short-lived signed identity proofs, not your provider’s OAuth access or refresh token. Connecting does not create posts or alter your provider’s records. Letterfy indexes your existing public profile so other readers can recognize you.

Letterfy requests public names, handles, biographies and profile-photo URLs from Bluesky’s public profile service using public account identifiers, and stores this information in its discussion service. These shared profiles are visible to all Letterfy readers, including people who have not connected a community account, subject to Letterfy’s moderation and block rules. A saved Letterfy display name comes from your public personal data server record and takes precedence over your Bluesky display name. These are user-chosen public details, not verification of a legal identity. Photos can be changed through your Bluesky profile.

Profile metadata requests come from Letterfy’s server and do not include the viewer’s credentials. Public profile photos load on your device from Bluesky’s image service, which receives the image path and ordinary connection information such as your IP address. Neither request includes mailbox credentials, private emails or community access tokens. Public profile snapshots are also cached on your device by account identifier and may be included in device backups; photo bytes are cached in memory. Disconnecting clears local sign-in and drafts but keeps public snapshots for display and reconnecting. Removing the app removes its local snapshots but does not remove the shared public profile.

When you choose to save a public profile or publish a post, reply, follow, like or repost, the app writes public Letterfy records to your account’s personal data server. These records include your public account identifier, the chosen content or interaction, timestamps and relevant public newsletter references. They are Letterfy records, not automatic Bluesky feed posts. Letterfy fetches accepted records from that server to index and display them. Your account provider and other services may make public records available to others.

Any newsletter passage you choose to quote and publish becomes public. The app shows this disclosure before publishing. Sharing is your choice; connecting email, reading a newsletter or connecting a community account does not itself publish a quote. Consider confidentiality and the publisher’s rights before sharing. Other people and services may copy public records, and deletion cannot recall every copy.

To start a discussion, the app checks locally for the selected newsletter and sends a publication identifier, your public account identifier, a one-time challenge and an App Attest assertion to Letterfy. We retain publication-scoped reader eligibility and device-key references to enforce this rule. This does not send the email or mailbox identity and does not prove a paid subscription or authentic delivery. Signed-in replies do not require the same reader grant.

When you choose to publish, Letterfy checks the comment, selected quote and public profile text against community rules before allowing publication and indexing. These deterministic checks run in Letterfy’s service; no AI or external moderation provider receives this text. Rejected unpublished drafts are not stored or logged by the service. Already indexed public records are checked before the server returns them for display, and Letterfy retains a copy of the indexed public record and its moderation verdict so edits cannot reuse an earlier check. These checks do not scan your private newsletter bodies. Reports and blocks are private Letterfy policy records associated with your public account identifier. Reports contain the public record reference, selected reason and a snapshot of that public record for authorized reviewers. Report snapshots can remain after a post is removed to support abuse review. The Letterfy team can dismiss reports, remove discussions, restrict an author’s participation or restore future access. Decisions retain the operator’s public identifier, record reference, reason and time for accountability. Removing your Letterfy account clears indexed content-check copies and report snapshots about your public records; minimal moderation decisions and restrictions may remain where needed to protect the service. Removing a post alone cannot recall other services’ copies. A block filters discussions in Letterfy; it does not make public repository records private or block them across every service.

Unpublished discussion drafts, selected quotes and pending retry records are stored locally in app preferences and may be included in device backups. They are not sent to the discussion service until you choose to publish. Disconnecting your community account clears its local credentials and drafts. Public records already published are separate.

Images & external links

Starting with build 57, fresh onboarding initially selects automatic newsletter image loading; it takes effect after you save and continue with that choice enabled. Earlier builds start with images blocked, and previously saved choices are preserved. Each email preview still starts with images blocked and needs its own temporary permission. While automatic image loading is enabled, or when you load images for an email preview, your device contacts the image host. This includes candidate header images on newsletter cards, which can load before you open a message. That host can receive your IP address and the requested image URL; a personalized image URL may reveal that a message was opened. Blocking small tracking pixels does not prevent every form of image-based tracking.

Header image selection analyzes image dimensions, layout and visual features on your device using a bundled model and local text recognition. The app does not upload images or extracted text to Letterfy or a cloud AI service for this selection, and does not collect your mailbox content for ongoing model training.

You can block newsletter images again in Reading preferences. Images already permitted and downloaded may be stored locally for offline reading. Letterfy’s separate publisher-artwork catalog provides approved artwork for requested catalog publication IDs, as described above. Artwork never establishes sender authenticity or reader eligibility.

When you open a publisher link or use a connected email provider, that provider’s own privacy policy applies. We do not control third-party websites or their data practices.

Letterfy’s bundled newsletter classifier is developed from messages delivered to an operator-controlled research inbox subscribed to free publications. The operator retains those messages and review records privately for classification development and testing; they have no automatic expiry. The app contains the trained classifier, not a copy of the research email corpus. This workflow does not collect connected customer mailbox content or personal review choices for shared training, and it does not use linked articles to expand received emails. Research-inbox email is hosted by Nylas separately from the app’s connected mailbox providers.

Improving newsletter detection

Our catalog review tools can store independently sourced publisher text with an explicit editorial or non-editorial label, source URL, training-rights evidence and reviewer record. Only examples specifically approved for training are exported to our offline training tools. Mailbox submissions, their derived metadata and manually selected emails are not copied into this shared training dataset. Public availability alone is not treated as training permission. These curated examples and review records have no automatic expiry; permission withdrawal excludes an example from future exports and requires review of existing datasets and models.

Google data & limited use

Letterfy’s handling of information received through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We use Google data only for the reading features, explicitly chosen Discover contributions and public excerpt sharing described here. We do not sell it, use it for advertising, or use it to train generalized AI models. Disclosures are restricted to authorized feature delivery, security, legal obligations, or a business transfer with the consent Google requires. Human access is limited to the exceptions Google permits, such as your specific permission, necessary security or legal work, or qualifying aggregated internal operations. Catalog reviewers can see the limited metadata described above; they do not have access to your mailbox.

Service providers & disclosures

We use service providers to host and operate Letterfy, handle email and deliver requested functionality. These providers may process the information needed for their role. When we share personal information with a provider acting on our behalf, we require it to use the information only for the authorized service and to provide protection consistent with this policy. The restrictions attached to Google user data continue to apply when a provider processes it. Cloudflare hosts this website, the app’s authenticated catalog and discussion services, and private reader-eligibility and moderation records. Your AT Protocol provider hosts public repository records and processes community authorization and repository requests. Your email provider processes requests when you connect or refresh your mailbox. Apple also processes app-integrity checks through App Attest, as well as information connected with app distribution and TestFlight under its own policies.

We do not sell your personal information or use private email data for targeted advertising. The current website does not include Google Analytics, Firebase Analytics or Firebase Crashlytics. The app does not send private opens or time spent reading to our publication ranking service. Optional completion contributions are described below.

We may disclose information where necessary to meet legal obligations, protect users and our services, or complete a business transfer, subject to applicable law and any additional restrictions on provider data. We will not use a change in ownership to bypass the commitments in this policy.

Relevant provider policies include Cloudflare’s Privacy Policy, Google’s Privacy Policy and Apple’s Privacy Policy. Infrastructure providers may process information in countries other than the one where you live.

Your choices & retention

• Remove a newsletter from Letterfy: compatible builds offer Remove from Letterfy in newsletter and reader menus. This hides the selected newsletter’s sender or senders in the relevant connected mailboxes, stops adding their new issues to the reading library, and clears their local catalog-contribution consent. It does not unsubscribe you or delete email at your provider. Saved issues stay available, and downloaded content remains subject to the local retention rules below. You can restore a sender in Your newsletters → Hidden senders. Removal does not retract catalog metadata already submitted.
• Disconnect and delete local account data: go to Profile → Email accounts, open the connected account’s menu, and choose Remove account. Removing an account from the app deletes its local credentials, downloaded letters, search data and synchronization state. This does not delete your Google Account, your messages at the email provider, or your newsletter subscriptions. Email reading connects an existing email-provider account; optional community participation uses an existing AT Protocol identity rather than a new Letterfy password.
• Revoke provider access: use your provider’s connected-app settings. For Google, visit your Google Account connections. Revocation stops future authorized provider access; remove the account in Letterfy as well to erase its existing local data.
• Control mail checks and alerts: disable automatic checking or change its frequency in Mail checks, and change notification categories in Notifications. You can also disable notifications in iPhone Settings.
• Control publication sharing: turn off catalog sharing in Settings. This stops future submissions; it does not automatically remove publication metadata already submitted. Contact us about information already held.
• Manage community access and posts: use Profile → AT Protocol account to disconnect locally, and your AT Protocol provider’s connected-app controls to revoke its grant. Use a post’s menu to delete your own record from your personal data server and request removal from Letterfy’s index. Disconnecting or removing the app does not delete already published records. Contact us about private reader or moderation information held by Letterfy.
• Control image requests: change the image-loading preference in the app.
• Request assistance: contact us to ask about access, correction or deletion of personal information held by Letterfy. We may need to verify a request, and applicable legal obligations may limit what can be deleted.

Local downloads remain until you remove them or the account, or storage cleanup removes eligible downloads. Ordinary cleanup targets read, unsaved downloads after 30 days or when its storage budget is reached; saved letters and active reading downloads are protected from that cleanup. Searchable text and metadata can remain until account removal. Catalog submissions, automatic review results and approved directory records do not currently expire automatically: we keep them to review publications and operate the directory. Contact us to request correction or deletion of personal information in these records. Support correspondence is retained while needed to resolve your request and meet applicable legal obligations. Where a legal obligation prevents deletion, we retain only the information needed for that obligation.

Public discussion records remain in Letterfy’s index until they are deleted, removed through moderation, or become ineligible under its rules. Shared public profile snapshots are refreshed periodically and have no automatic expiry. A moderation removal hides a profile from Letterfy readers; an account deletion processed by Letterfy also removes its shared profile snapshot. Contact us to request correction or deletion. Changes made outside Letterfy are checked periodically, so deletion may not appear immediately. Reader eligibility expires after seven days unless renewed or revoked; expiry does not automatically erase the underlying policy record or an unchanged accepted discussion. Reader-grant, report, block and moderation records have no general automatic deletion deadline; contact us about access, correction or deletion. Independent copies of public records are governed by the services that hold them.

Optional publication reader counts

Starting with build 57, fresh onboarding initially selects “Include my reads in publication counts,” with its disclosure before you save and continue. You can turn it off before saving or later in Privacy & data. Earlier builds start with this choice off; existing saved choices are preserved. While enabled, deliberately using Finish or Mark as read for a newsletter with a matched public catalog identity sends that publication’s catalog ID and the completion time to Letterfy. The request uses verified app access and the contribution is stored with the installation key identifier. It contains no email body, issue title, sender or recipient address, mailbox account identifier, provider message ID or email credentials. Read flags imported from your provider and reading before you enabled sharing do not contribute.

Letterfy uses these contributions to show publication reader totals and up to three most-read publications over the rolling past seven days. Each participating app installation counts once per publication regardless of repeated reads, issues or connected mailboxes. These are not publisher subscriber totals or a verified count of distinct people: multiple devices or reinstalls may count separately, and readers who do not share are excluded. Other users see totals and rankings, not a list of readers. Letterfy can associate stored contributions with the installation; the data is not anonymous to Letterfy.

Turning sharing off clears local contribution records and queues a replacement that removes that installation’s server contributions. Undo or Mark as unread retracts the corresponding completion; other completions for the same publication may still count. Removing an email account removes its local contributions and queues an updated server snapshot. If offline or a request fails, pending changes retry when the app runs with a connection; contributions may remain visible until that update succeeds or they expire. Re-enabling starts fresh. No more than the 250 most recently completed publications per installation are included in a snapshot.

Contributions stop counting seven days after completion. Expired contribution rows and revoked-installation contributions are removed by scheduled cleanup and during contribution requests. This is not a promise that cleanup completes at an exact deadline. Installation keys and the latest snapshot revision remain as separate security and replay-prevention records until removed for security or support purposes. Uninstalling without first withdrawing cannot send a removal request; existing contributions still expire from counts. No readership data is used for advertising, sold or used to train AI models.

Security & children

Verified app access

Letterfy uses Apple App Attest to verify app installations before allowing catalog requests. We process an installation-specific key identifier, public key, verification proof and replay counter, and issue short-lived access credentials. The private key is managed on the device; your email login and mailbox content are not part of this verification. Requests can be associated with the installation during authentication. Raw installation identifiers are not saved alongside catalog submissions; optional community-verification receipts use the separate newsletter-specific pseudonyms described above.

We retain installation public keys, counters and revocation state until removed for security or support purposes. Removing an email account does not remove these separate installation records. Challenges and access credentials expire after five minutes; expired server records are cleaned during authentication requests and scheduled cleanup. Bootstrap abuse protection uses a temporary IP-address digest that expires after two ten-minute window boundaries. Catalog intake separately uses a daily IP digest that expires after two UTC day boundaries. We do not retain the full attestation certificate chain or Apple receipt.

We use safeguards intended to protect information, including device Keychain storage for credentials and iOS file protection for local mailbox data. No method of electronic storage or transmission is completely secure. Keep your device and account credentials secure and install relevant security updates.

Letterfy is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate steps to delete it.

Policy updates

We may update this policy as the service develops. We will post the revised policy here and change the date above. Where required, we will provide a more prominent notice or request consent before a new use of your information.