LetterRelay is a Kodably.com product, and Kodably.com is operated by RUSEI MS COMPANY S.R.L. Account data stays while the account is active. In-app account deletion removes account-owned operational records and authentication. Some detached journey history, legally required payment records and provider-managed backups may follow separate rules described below.
1. Retention principles
LetterRelay keeps information only while it is needed to provide the requested feature, maintain safety and integrity, resolve a dispute or meet a legal obligation. An unresolved security incident, report, payment dispute or legal hold may temporarily extend an otherwise applicable period.
2. Accounts and public signatures
The Firebase Authentication account, Firebase UID, selected pen name, sign, country, policy acceptance and delivery counters are retained while the account is active. Signing out does not delete them. In-app permanent deletion removes the authentication account and active profile records.
3. Letters, journeys and ornaments
Sent and received letter records, curated copy/design selections, delivery state, replies, reward counters and personal ornaments remain while needed for the active account and shared relay experience. Queued and delivered letter records owned by a deleting account are removed during account deletion.
Journey documents are shared by multiple relay participants. After account deletion, detached route history may remain with only the previously selected pen name and country and no deleted Firebase UID. This limited history preserves the route for other participants without keeping a link to the deleted account.
Starter-letter records are retained only as operational relay data and are marked internally as system-generated.
4. Reports and blocks
Active block relationships remain until the blocker removes them or either related account is deleted. Safety reports remain while pending review and for as long as reasonably necessary to investigate abuse, document action or prevent repeated misuse. Reports associated with a deleted reporter or reported account are removed from the active report collection unless a legal or security hold requires preservation outside the normal account dataset.
5. Organization submissions
Pending organization applications and uploaded logos remain while review is active. They are removed when the submitting account is deleted. Approved public ornaments may remain until removed by LetterRelay or the authorized organization; account deletion removes organization records and files still owned by that account.
6. Technical and duplicate-prevention records
Request identifiers and operation results are stored to prevent duplicate sends, replies, reports, blocks, ornaments and submissions. They carry a seven-day expiry marker and are removed with the account; physical cleanup may occur after the marker rather than at the exact expiry moment. Per-account rate-limit counters use bounded time windows and are removed with the account.
Authentication, API, security and error logs follow the active Google Cloud, Firebase, Cloudflare and hosting-provider retention settings. An unresolved incident, abuse pattern or legal claim may require a limited record to be isolated for longer.
7. Website, email and payment records
The website does not create an analytics or advertising profile. Standard hosting logs follow provider settings. Support email is retained while a request is active and for a reasonable follow-up period.
Stripe retains Checkout and payment records under its own obligations. LetterRelay may retain merchant-visible transaction status, amount, date, contact, refund/dispute information and identifiers for accounting, fraud prevention, support and the period required by applicable law. Full card details are not stored by LetterRelay.
8. Account deletion and backups
Using Account & settings starts permanent deletion immediately. The app removes letters owned or received by the account, ornaments, organization applications and stored logos, duplicate-prevention records, safety reports, block relationships, profile data and the Firebase Authentication user. The user is then signed out.
If app access is unavailable, follow the public deletion request. Email-based requests require proportionate identity verification and are processed after verification. We normally complete a verified request within one month and explain any legally permitted extension.
Copies may persist temporarily in provider-managed encrypted backups or logs until their normal rotation completes. Deleted data is not intentionally restored to active use. Information required for a legal obligation, fraud prevention, dispute or security hold may be isolated, access-restricted and retained only for that purpose.
9. Contact
Email support@letterrelay.com with retention or deletion questions. Company details are in the Legal Notice.