Raazdari

• What strangers see: the first name it is for, the city, the year, the kind of place, the clue and the first line. These are public once a person has reviewed the letter.
• The rest of the letter is encrypted (AES-256-GCM) before it is stored. It is shown only to the person who answers the writer's question, to the writer through their private link, to the reviewers, and, if two letters match, to the other writer.
• A voice letter's recording is encrypted the same way and kept privately. If you chose a disguise, your voice is changed in your browser while you record: your real voice is never recorded or sent.
• The answer to the lock question is never stored, only a slow one-way hash of it.
• The writer's private link is never stored, only a hash of it. We can't recover a lost link.
• Mutual matching, if you choose it: your first name and a keyed hash of both names, the city and your shared word. The word itself is not stored. A note you leave with “Reveal me” is encrypted and shown to the other writer only if you both choose to reveal yourselves.
• Your email, if you leave one, is encrypted and used only to tell you about your letter (opened, a match, a reply). It is never shown or shared.
• The country you wrote from (a two-letter code from Cloudflare), for “written from near you”. Never your IP address.
• Letter of the day, only if you say yes in your writer's room: once opened, your letter's words, the first name, the city and the year may be shown to everyone for a day. You can change your mind at any time.
• The night map shows how many letters were written in each city, and the first name most written to there. Never anything finer than the city.

• We don't store IP addresses. Rate limits and unlock attempts use a keyed hash of your IP address and browser that changes every day.
• No tracking cookies. Your browser keeps your theme, whether you've seen the opening and your answer about ads (local storage), and a letter you are still writing (session storage, gone when you close the tab). Reviewers get a session cookie when they sign in.
• Ads may appear only on search results, name pages and the night map, and only if you allow them when we ask. Until then nothing is loaded from an ad network. If you allow them, Google may use cookies and your IP address to choose them. You can change your answer with “Ad choices” at the bottom of any page. There are never ads on letters, the writing desk or Unreachable.
• Letters in Unreachable have no lock: once reviewed, anyone can read them.
• A reply you leave with Echo is encrypted, read by a reviewer, and then shown only to the writer.

• Cloudflare: hosting, and Turnstile, which checks that you are human and sees your IP address to do so.
• Supabase: the database.
• An automated moderation service, when enabled: letter and reply text is sent to it to be checked.
• Resend, only if you leave an email: to deliver it.
• Google AdSense, only if ads are switched on and you allow them.

• A letter set to vanish: its words, voice and email are deleted for good at the time you chose.
• A letter that is not published: its words and email are deleted when it is declined.
• A letter taken down: hidden at once, and its words, voice and email are deleted when a reviewer confirms the removal.
• A reply that is not approved is deleted.
• Rate-limit records are deleted after two days.
• If you left an email, we write once more a year after you sealed your letter, if it is still sealed.

• Under every letter, “This is about me, remove it” takes it down immediately, with no questions asked. It also works for a letter you wrote yourself.
• You can also report a letter for any other reason.

If this changes, we'll update this page and its date.