Overview
FuturePostman lets you compose letters (including optional audio/video and attachments) and schedule delivery in the future. This policy explains what we collect, how we use it, and your choices.
Information We Collect
- Account data: email, name, and sign-in data: your password (stored only as a hash), your Google account id if you sign in with Google, your passkeys and two-factor secrets, and your signed-in sessions with their browser and IP address. Sign-in is our own and this data is stored in our own database in the EU, like the rest of your data.
- Purchase and billing data processed by Stripe when you buy credits or another product (we do not store card numbers).
- Letter content you provide: recipients, subject, body, schedule time, attachments.
- Letter openings: when each recipient of your email letter first and last opened it, and how many times.
- Optional media you record or upload (audio/video/files) to include with your letters.
- Public letters data when you opt to publish (alias, anonymization preferences, views/likes/comments).
- Operational logs for reliability and security (IP address for abuse prevention, error logs, rate limits).
- AI prompts/content you choose to send to our AI composer to generate message drafts.
- Phone numbers: the mobile number you confirm for your account or for If I'm Not Back, the numbers of the people you choose to reach by text, and a record of each text message sent.
- If I'm Not Back: the letters and files you write for it, the names, email addresses and numbers of the people who receive them and of your trusted people, a backup email address if you add one, and the history of check-ins, reminders, calls and texts.
How We Use Information
- Provide and improve the service, including scheduling and delivering your letters.
- Show you which recipient opened your email letter and when, so you know it arrived.
- Process payments for credits and other products with Stripe.
- Sign you in and keep your account safe: passwords, Google sign-in, two-factor sign-in, passkeys and the list of signed-in devices.
- Moderate public content and handle user reports to keep the platform safe.
- Generate optional AI-assisted drafts when requested by you.
- Prevent abuse, enforce our Terms, and comply with legal obligations.
- Send the text messages and calls you set up, confirm phone numbers, and prevent, trace and stop misuse of text messages.
Data Processing & Storage
Email letters and the files you attach to them are always stored encrypted (AES-256). Paper letters are sent to the print centre in readable form, because they have to be printed. Attachments and media are stored on our servers and linked to your scheduled letters. Emails are delivered via the configured SMTP provider (set by the system admin).
We use third-party processors to operate core features: Stripe (billing), Twilio (text messages and phone calls), and an AI model provider for AI compose. Sign-in is not one of them: no third party receives your sign-in data. If you choose to sign in with Google, Google receives only what that sign-in needs, and tells us your name, email address, profile picture and Google account id. When you use AI compose, your prompt and relevant context may be sent to the AI provider solely to generate the requested output.
Public Letters
If you opt to publish a letter publicly, its content (and your chosen alias or anonymity setting) becomes visible to anyone. You can report public content for review, and we may moderate or remove content that violates our Terms.
When a Recipient Opens a Letter
A recipient opens an email letter on the letter page with their email address and access code. When they do, we record it, so that the person who wrote the letter knows it arrived.
What we record: For each recipient separately: when they first opened the letter, when they last opened it, and how many times. Visits within 30 minutes of each other count as one. We do not store the recipient's email address with this record. It is linked to the recipient through a non-reversible hash of the address. When you open your own letter, it is not reported as an opening.
What the writer sees: In your account you see which recipient opened your letter and when. The first time each recipient opens it, you get a notice in the bell in the app.
Why we use it: Knowing that a letter arrived is the core of the service you asked for (contract). For recipients, the record is based on our legitimate interest in delivering letters and letting the writer know they arrived.
If you receive a letter: The person who wrote to you sees when you opened their letter: the first and the last time, and how many times. The record is deleted together with the letter.
Text Messages and Calls
Some features use phone numbers: an email letter can also be announced by text message (SMS), and If I'm Not Back can remind you by text and call you. This section explains what we keep and why.
Phone numbers: Before your account can send texts, you confirm your own mobile number with a 6-digit code. A number can be confirmed on one account only. Your number, and the numbers you add to a letter, are stored encrypted. Your number is not shown to the people you write to.
A record of each text: For every text we send for an email letter (its link or its access code) and every code that confirms a number, we keep the sending account, your confirmed number at that moment, the letter, the recipient's number (encrypted, plus a non-reversible hash so it can be searched), the time, the delivery status and the cost. A text has fixed wording with the letter's link or a code. You do not write it, and it does not contain your letter.
Why we use them: To deliver texts and calls, to confirm that a number is yours, and to prevent, trace and stop misuse such as spam or harassment. We use your own number because it is needed for the service you asked for (contract). Recipient numbers, the records of each text and the list of numbers we do not text are based on our legitimate interest in delivering letters safely and protecting the people who receive them.
If I'm Not Back: If you set up If I'm Not Back, we use the mobile number you confirm for it to send you check-in reminders by text and to call you when you have not answered, on the days and hours you chose. When your letters are released, the recipients you chose to reach by text get the letter's link by text. These numbers are stored encrypted, and the history of reminders, calls and texts is kept with the plan until you delete your account. This is part of the service you set up (contract). If you cancel your plan, its letters, files, trusted people and numbers are deleted at once.
Twilio: Texts and calls are sent through Twilio Inc. in the United States. Twilio processes the phone numbers and the content of the texts and calls only to deliver them. Transfers to the United States are covered by the safeguards described under Data Transfers.
If you receive a text: Reply STOP to any of our texts and your number goes on a list of numbers we do not text. If you do not know the sender, report it to us: we can then block the sender from sending texts. You can also contact us to use your rights over the data we hold about your number.
Your Rights & Data Protection
Your Rights: Depending on your location (particularly EU/EEA residents under GDPR), you may have rights to access, rectify, delete, port, or restrict processing of your personal data, and to object to certain processing.
Legal Basis: We process your data based on: (a) contractual necessity to provide the service; (b) legitimate interests in operating and improving our platform; (c) your consent for optional features like AI compose; (d) legal obligations.
Data Transfers: Your data may be transferred to and processed in countries outside your jurisdiction, including the United States. We implement appropriate safeguards for international transfers.
Exercising Rights: To exercise your rights, contact us using the details below. We may need to verify your identity and will respond within applicable timeframes. Some rights may be limited during business closure or bankruptcy proceedings.
Security
We employ industry-standard security measures, including encryption at rest for email letters and attached files, role-based access controls, and audit logging. Passwords are stored only as a hash, and you can add two-factor sign-in with an authenticator app, or passkeys, under Your account, Sign-in and security. A sign-in lasts 30 days and is renewed while you use the device; you can see every signed-in device under Your account, Sign-in and security, and sign any of them out. Resetting your password signs out every other device. No system can be 100% secure; please keep credentials safe and use a strong, unique password.
Data Retention
We keep personal data only as long as it is needed for the purpose it was given for, and we delete it automatically after that. Each kind of data has its own rule:
Your letters The text of your email and paper letters stays in your account as your own archive, until you delete the letter or your account. Deleting a letter removes its text, its files and its link at once, also before it is delivered.
If I'm Not Back Your plans are kept until you delete your account, also plans that are over: their letters, files, recipients, trusted people and the history of check-ins, reminders, calls and texts. Recipients open a delivered letter with their link, the address or number it was sent to, and an access code. A delivered letter is kept for 30 days after it is first opened, or for one year after delivery if it is never opened. Then its words, files and the recipients' addresses and numbers are deleted; the history of when it was sent and opened stays. Cancelling a plan deletes its letters, files, trusted people and numbers at once, and keeps only its history.
Attachments and recordings Kept until the letter is delivered. After delivery they stay available for as long as the link is open (you choose how long, 90 days unless you change it) and are deleted 30 days after the link closes. A file that may only be downloaded is deleted 30 days after every recipient has downloaded it as often as allowed. Files uploaded but never added to a letter are deleted after 24 hours.
Recipient links and access codes A link works until it expires and is removed 30 days later. After that the recipient sees that the letter has expired.
Letter openings and notices The record of when each recipient opened a letter is deleted together with the letter. Notices in the app's bell are deleted 90 days after they are read, and unread notices after a year.
Paper letter print files We do not store print files on our servers. Our print partner keeps its copy for 30 days after confirmed delivery, or 45 days after posting for untracked letters and 90 days for tracked letters without a delivery confirmation. The copy of a letter that was cancelled or failed is deleted 30 days later.
Event albums Every photo, video and message is deleted when the album's lifetime ends: 30, 183 or 365 days, depending on the album size, counted from the last opening (the album itself, or messages set to open later). Deleting an event deletes everything in it at once.
Text message records Kept for 2 years after the text is sent, then deleted. They stay when the letter or the account is deleted, because they are needed to trace misuse. After an account is deleted, a record no longer points to the account and keeps the sender's email address and number only as non-reversible hashes, with the last digits of the number. A number that replied STOP or was blocked is kept as a non-reversible hash, so it stays blocked.
Phone numbers and codes Your confirmed number is kept until you remove it or delete your account. A recipient's number is deleted with the letter, except in the record of a text sent to it (see above). Codes that confirm a number are deleted after a day.
Deleting your account You can delete your account at any time under Your account, Your data. All your letters, If I'm Not Back plans, files, links, events, contacts and payment records in our database are deleted at once, and nothing more is sent from your account. Every signed-in session ends, and your sign-in data (password hash, Google link, passkeys and two-factor secrets) is deleted with the account. Paper letters already at the print centre cannot be stopped. Payment records required for accounting are kept by our payment provider, Stripe, under its own retention rules. Records of text messages are kept as described under Text message records.
Technical logs Error logs are deleted after 90 days. IP addresses and browser details in download logs, delivery records, likes and abuse reports are removed after 90 days, and so are the raw data of incoming support emails and the IP address of contact form messages.
Data Handling During Service Discontinuation
In the event of service discontinuation, business closure, bankruptcy, or insolvency, the following data handling procedures may apply:
Critical Notice:
Data Deletion: We reserve the right to delete all user data immediately upon service discontinuation if continuing to store or process data becomes technically, financially, or legally unfeasible. This includes scheduled messages that have not yet been delivered.
- Best-Effort Data Export: Where technically and financially feasible, we may provide a limited-time opportunity (typically 7-30 days) for users to export their data before final deletion.
- Scheduled Messages: Undelivered scheduled messages may be lost permanently if our systems are shut down before their scheduled delivery date.
- Third-Party Data: Data processed by third-party services (Stripe, Twilio, AI providers) will be subject to their respective data retention and deletion policies.
- Legal Compliance: Some data may be retained longer if required by law, court order, or for bankruptcy/insolvency proceedings.
Your Responsibility:
You are solely responsible for backing up and preserving any data important to you. You can ask us for a copy of your account data at any time under Your account, Your data, and we mail it to your account's email address. We recommend keeping your own copies of the letters you write and the files you attach. We cannot guarantee data preservation or recovery during business closure, bankruptcy, or emergency shutdown situations.
Children
FuturePostman is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children.
Service Discontinuation Notices
In case of planned service discontinuation, we will attempt to notify users through available communication channels (email, in-app notifications, website notices). However, in emergency situations, bankruptcy, or sudden business closure, immediate notification may not be possible. We recommend staying informed by checking our website and following any official communications.
Policy Updates & Business Changes
This Privacy Policy may be updated to reflect changes in our business operations, legal requirements, or in the event of business restructuring, sale, merger, or bankruptcy. Material changes will be communicated where feasible, but continued use of the service constitutes acceptance of updated terms.
Contact
Questions or requests? Email us at [email protected]. Note that our ability to respond to requests may be limited during business closure or bankruptcy proceedings.
The data controller is Kodea Solutions Egeland (org. no. 911 782 162), Eigeland 44, 4790 Lillesand, Norway.