Privacy

Nobody here reads your keepsakes

Your words, photographs and videos are locked on your own device before they are sent to us, and they stay locked in storage. We keep the key that unlocks each one separately, itself locked, because a message has to open on its day even years after the person who wrote it has gone. Nobody here reads what you write, and nothing in it is used to train anything.

What the delivery email contains

Nothing personal. It says who it is from, that something is waiting, and carries a link to the page where your contact reads it. The keepsake itself is never in the email, because email sits in inboxes for decades, syncs to every device somebody owns, and gets forwarded without thought.

What we do hold

Your name and email address, who your recipients are and how to reach them, when each message should go, and whether it has been opened. We need those to deliver anything at all. We also keep an ordinary record of when things happened, so a question about a delivery can be answered.

Who else sees it

We use a small number of companies to run this: a host, a database, a file store, an email sender, and a payment processor. They see what they need to do their part, which for the file store is a block of unreadable data. We do not sell anything to anybody.

Two of the things you can ask for are written by a machine: the questions the interview puts to you, and the sentence that says what is in a photograph you have chosen. Those run at OpenRouter. When you use them, OpenRouter is sent the answers you typed on that screen, or the photograph itself before it is locked, and sends back the words. It is not sent your name, your email address, or who the keepsake is for, and nothing it is sent is used to train a model. Everything you keep is locked before it is stored, and OpenRouter never sees a finished keepsake.

Three advertising companies have a small piece of code on this site: Pinterest, Google and Meta, the company behind Facebook. Each is there so that when somebody finds us through one of our ads and makes an account or pays, that company can count that the ad worked. Google and Meta are told which pages were opened and that an account was made or a payment went through. Google and Meta are not sent your name or your email address, and Meta’s code is set not to read the buttons you press. Pinterest is told the same things, and also, once you have an account, a scrambled copy of your email address that it can match against its own members. None of the three is ever told what a keepsake says, who it is for, or anything you type. None of their code is on the page where your person opens what you sent, or on any page whose address names one keepsake, so the pages Pinterest, Google and Meta are told about are the ordinary ones anybody can see.

Taking it back, or deleting it

You can export everything at any time, and you can delete any message or your whole account. Deleting is real: the files go, and what is left is the accounting record we are required to keep.

To see what we hold about you, to correct it, or to have it removed, write to us about your information. A person reads every request and answers it.

If our systems are ever broken into

No company can promise that this will never happen to it. What we can tell you is what an intruder would find here: files that were locked on your own device, and no key on our side that opens them. That is why the locking happens where it does.

Questions about this page

If anything here is unclear, or you want to know more about how your information is kept, send us a privacy question.