Last updated: 6 October 2026
Letter has no accounts and no sign-up. There is no advertising, no advertising identifier, no analytics SDK in the app and no tracking.
Your letters stay on your device. On iPhone, iPad and Mac they sync through your own private iCloud, which we cannot see; on Android there is no sync, so they stay on the device you wrote them on. Two things talk to our server: the AI writing suggestions, and a short hello when the app starts so we know which versions are in use. Nothing you write is stored on our server.
We do not use anything you write to train machine-learning models. We do not sell your data. We never have.
A letter is almost always about someone else as well as you — their name, their address, what you have to say to them. Section 4.7 explains what that means.
Übelacker Solutions GmbH
Bläsiring 28
4057 Basel
Switzerland
support@letter-app.com
We are the controller for the processing described here, under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
Data protection officer. We have not appointed one. Letter's processing does not meet the conditions in Art. 37 GDPR — it is not a public authority, not large-scale regular monitoring, and not large-scale processing of special categories of data. If that changes, we will appoint one and say so here.
Representative in the EU. We have not appointed a representative under Art. 27 GDPR. We consider the exemption in Art. 27(2)(a) to apply: the processing described here is occasional, does not involve special categories of data or data relating to criminal convictions on any scale, and is unlikely to result in a risk to the rights and freedoms of individuals. You can reach us directly at the address and email above.
Letter is for people aged 16 and over. We do not knowingly process data from anyone younger. If you believe a child under 16 has been using Letter, write to support@letter-app.com and we will delete whatever we hold.
Do you have to give us anything? No. Letter works without an account, and you are never required to provide personal data. Writing, laying out, printing and exporting letters happens entirely on your device. Only the AI writing suggestions send anything you have written anywhere, and you choose whether to use them.
Your letters, their recipients, your saved senders, your templates, your signatures and your settings stay on your device.
On iPhone, iPad and Mac they sync through your own private iCloud if you have that switched on. That is Apple's service to you, under your iCloud settings and Apple's privacy policy — the data does not pass through our servers and we cannot see it. On Android there is no sync: they stay on the device you wrote them on.
This data stays until you delete the letter, the sender, the template or the app.
This runs only when you ask for a suggestion, and only after you have agreed to it once. If you decline, the rest of the app keeps working.
Sent to our server: the subject and the body of the letter you are working on, the language you are writing in, the country you are writing to, and which kind of suggestion you asked for.
What happens: our server passes them to OpenAI's language model, which returns a suggested text.
What we keep: a randomly generated identifier for the suggestion, the language, the app version, how long the request took, and — if you tell us — whether you accepted the suggestion. We do not keep the subject, the text, the recipient, or any link to you beyond a random identifier.
Purpose: providing the feature, and seeing whether it is working well enough to keep.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR, on the basis of the consent you gave in the app before the feature was first used.
We also count how many suggestions an installation has asked for, against its random identifier, so that one installation cannot use up the capacity for everyone. That counter is deleted after four hours.
OpenAI processes the request on our instructions under a data processing agreement, does not use it to train its models, and does not keep it after answering.
When the app starts, it says hello to our server.
Recorded, against randomly generated identifiers only: the Letter version and build, the device type and description and operating system version, your device language and region, which PRO features are unlocked for that installation, how many letters and how many senders exist on the device, and the dates of the oldest and the most recently changed letter.
Not involved: any letter, recipient, sender, template or anything else you have written. We record how many letters there are, never what is in them.
Purpose: knowing which versions and devices are actually in use and whether the app is being used at all, so we can operate and maintain the service and decide what to keep supporting.
Legal basis: our legitimate interest in operating and maintaining the service, Art. 6(1)(f) GDPR. We keep no content and no identifying data, so the effect on you is minimal, and there is no practical way to maintain an app without knowing what it runs on.
The entry is overwritten each time and deleted one year after the last check-in.
Your device proves that it is running a real copy of Letter, without any account. On iPhone, iPad and Mac this uses Apple's App Attest; on Android, Google's Play Integrity API. Apple and Google are involved in that check, under their own privacy policies.
What we keep: on Apple platforms, the device's public key, a counter and the attestation receipt; on Android, nothing — the integrity token is checked with Google for that one request and then discarded. The one-time challenge each request uses expires after ten seconds.
Purpose: protecting the service from abuse and keeping costs from being run up by automated requests.
Legal basis: our legitimate interest in operating the service securely, Art. 6(1)(f) GDPR.
The public key and counter are deleted one year after the last check-in, together with the rest of that install's record.
The PRO features are sold by the App Store or Google Play. Neither store tells us your name, your email address or your payment details.
RevenueCat checks in the app whether a purchase is active, as our processor. It receives a randomly generated identifier and the store receipt. Apple also sends our server notifications about subscription events for the app, which carry no name, email address or payment details.
Purpose: giving you the features you have paid for.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
Contacts. If you let the app read your contacts, it does so only to put an address into a letter, and only when you pick one. Your contacts are read on the device and are never sent to us.
Reading an address from a photograph. On iPhone and iPad you can point the camera at an address. The text is recognised on your device by Apple's built-in text recognition. The photograph is not stored and never leaves your device.
Photographing or importing a signature. A signature you draw, photograph or pick from your photo library stays on your device, alongside your senders.
None of these three features sends anything to our server.
A letter is about someone else as well as you. Their name, their address and whatever you have to say to them are in your letter.
On your device, that is between you and them. We never see it. It is stored on your device and, if you use iCloud, in your own iCloud account.
In an AI writing suggestion, it goes further. The subject and body you send for a suggestion may well name the recipient and describe their situation. That text goes to our server and on to OpenAI. We do not store it, and OpenAI does not keep it or train on it — but it does leave your device, which is why the app asks you first.
What this means for you. When you write about another person, you decide to do that, and you need a legal basis for it — usually your own correspondence, your contract with them, or your own household activity. Please do not put other people's sensitive information, identity documents or payment details into an AI writing suggestion. This is also set out in our Terms of Use, §6.4.
No advertising. No advertising identifier. No analytics SDK. No tracking. No profiling. No location tracking. No sale of data to anyone, ever.
The app asks for access to your contacts, your camera and your photo library only when you use the feature that needs it, and asks for no other permission.
| What we do | Legal basis | | ------------------------------------- | --------------------------------------------------------------------------- | | AI writing suggestions | Contract — Art. 6(1)(b) GDPR, on the consent given in the app | | Limiting AI requests per installation | Legitimate interest — Art. 6(1)(f) GDPR | | Checking whether a purchase is active | Contract — Art. 6(1)(b) GDPR | | Checking in when the app starts | Legitimate interest — Art. 6(1)(f) GDPR | | Proving the app is genuine | Legitimate interest — Art. 6(1)(f) GDPR | | Website server logs | Legitimate interest — Art. 6(1)(f) GDPR | | Website performance measurement | Legitimate interest — Art. 6(1)(f) GDPR | | Analytics on this website | Consent — Art. 6(1)(a) GDPR | | The contact form | Consent and our legitimate interest in replying — Art. 6(1)(a) and (f) GDPR |
Where we rely on a legitimate interest, you can object at any time — see section 13.
| What | How long | | --------------------------------------------------------------------------------- | ------------------------------------------------------------- | | Letters, senders, templates and signatures on your device | Until you delete them or the app | | The subject and text sent for an AI suggestion | Not stored | | The record of an AI suggestion (random id, language, version, duration, accepted) | 30 days | | AI request counter per installation | 4 hours | | Start-up check-in record | Overwritten each time, deleted 1 year after the last check-in | | App Attest public key, counter and receipt | Deleted 1 year after the last check-in | | Play Integrity token | Not stored | | One-time request challenge | 10 seconds | | Website server logs | 24 hours | | Website analytics data | 14 months | | Contact-form emails | 12 months after the conversation ends |
| Who | What for | Where | | ------------------- | --------------------------------------------------- | --------------------------------- | | Amazon Web Services | Hosting the backend and its database | Frankfurt, Germany (eu-central-1) | | OpenAI | Generating a writing suggestion | USA | | Vercel | Hosting this website, and measuring its performance | USA / Frankfurt, Germany | | Apple | App Attest, App Store | USA / EU | | Google | Play Integrity, Google Play, Analytics, reCAPTCHA | USA / EU | | RevenueCat | Whether an installation has an active purchase | USA / EU | | Mailgun | Delivering contact-form emails | USA / EU |
Each of these processes data only on our instructions, under a data processing agreement.
iCloud is not on this list, on purpose. When your letters sync through iCloud, that is Apple's service to you under your own Apple account and Apple's privacy policy. The data does not reach us, and Apple is not acting on our behalf. The same goes for the App Store and Google Play as sellers of the PRO features.
Our backend and database run in Frankfurt. Some of the providers above process data in the United States, or may do so.
For every transfer outside Switzerland and the EEA we rely on:
We also apply the additional measures these require: transport encryption throughout, certificate pinning between the app and our server, no letter content stored at our AI provider or by us, and random identifiers rather than names or email addresses wherever the feature allows.
If you would like a copy of the safeguards for a particular provider, write to support@letter-app.com and we will send you what we have.
This site is hosted by Vercel and served from its Frankfurt region. Visiting it creates the usual web server log entries: IP address, time, page requested and browser identification.
Purpose: operating the site and keeping it secure.
Legal basis: our legitimate interest in a working, secure website, Art. 6(1)(f) GDPR.
Retention: 24 hours — that is how long our host keeps its runtime logs, and we copy them nowhere else.
We do not use these logs to identify you.
We also use Vercel Speed Insights, which measures how quickly pages load. It records page performance measurements without cookies and without building a profile of you.
Legal basis: our legitimate interest in a website that works properly, Art. 6(1)(f) GDPR.
Until you accept the notice, this site sets no cookies other than strictly necessary ones.
If you accept, we use Google Analytics with IP anonymisation switched on, to see roughly how many people find the site and which pages they read.
Legal basis: your consent, Art. 6(1)(a) GDPR.
Retention: analytics data is deleted after 14 months.
Changing your mind. You can withdraw or change your consent at any time through the cookie settings in the footer of every page — it is exactly as easy as giving it was. Withdrawing does not affect processing that already happened.
| Cookie | Purpose | Duration |
| ------------------ | ------------------------------------------------------ | ------------------- |
| Consent preference | Remembers what you chose in the notice | 12 months |
| _ga, _ga_* | Google Analytics — distinguishes visitors | 24 months |
| reCAPTCHA cookies | Google reCAPTCHA — spam protection on the contact form | Session to 6 months |
The form is protected by Google reCAPTCHA, which is why it is available only once you have accepted cookies. Google's terms and privacy policy apply to that check.
Your message reaches us by email through Mailgun.
Purpose: answering you.
Legal basis: your consent in sending the message, and our legitimate interest in replying, Art. 6(1)(a) and (f) GDPR.
Retention: 12 months after the conversation ends, so we can follow up sensibly. Then deleted.
We never use your address or message for advertising. You can always email support@letter-app.com directly instead, with no reCAPTCHA and no cookies.
Everything travels over encrypted connections, and the app pins the certificate of our server so that it will not talk to anything else. Our backend and database run in Frankfurt with access restricted to what is needed to operate the service. We store random identifiers instead of names or email addresses, and we store no letter content at all. Device attestation keeps unauthorised clients off the backend.
We designed Letter so that the safest data is the data we never hold. Almost all of it never leaves your device.
If personal data we hold is breached and the breach is likely to result in a risk to your rights and freedoms, we will report it to the competent supervisory authority within 72 hours of becoming aware of it, as Art. 33 GDPR and Art. 24 FADP require. If the risk to you is high, we will tell you as well — in the app and on this site, since Letter has no accounts and no way to email you.
Letter uses an AI model to suggest text for a letter. That is a suggestion about your writing, not a decision about you.
We make no automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR or Art. 21 FADP. We do no profiling. Nothing the model produces changes your rights, your pricing or your access to anything.
The model's output can be wrong — that is covered in §7 of our Terms of Use.
You have the right to:
Most of what Letter holds is in your hands: delete the letter, or delete the app, and it is gone.
How to exercise them. Write to support@letter-app.com. We reply within one month and it costs you nothing. Because Letter has no accounts, we may need you to tell us enough to identify the data you mean. We will not ask you for more identifying information than the request needs.
Complaints. You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU the authority in your country.
There is no account to close, because there is no account.
We update this policy when the way Letter handles data changes. The date at the top always tells you when it last changed.
For material changes — a new sub-processor, a new legal basis, a new kind of data — we will also point them out in the app or on this site before they take effect, and we keep the previous versions so you can see what changed.
Languages. This policy is published in all seven languages the app ships in. The authoritative version is the German one: Datenschutzerklärung. The others are translations of it.
support@letter-app.com
Übelacker Solutions GmbH
Bläsiring 28
4057 Basel
Switzerland
