LetterCircuit Privacy Policy
Last updated: 2026-09-25
This Privacy Policy explains how H4CF2, LLC ("LetterCircuit," "we," "us") collects, uses, shares, and protects personal information when you use lettercircuit.com and our services (the "Service"). We are a California business.
1. Information We Collect
- Account information. Your name, email address, and login credentials, or your Google sign-in identity if you use Google to sign in.
- Recipient information. The names and mailing addresses of the people you choose to send cards or letters to. You provide this. It may be personal information about other people.
- Message content. The text, images, and other content you create or upload to be written and mailed.
- Handwriting samples. Handwriting sheets you upload to create a custom handwriting style.
- Billing information. Your payment is processed by Stripe. Stripe handles your card details. We never store your full card number. We keep records of transactions, wallet balances, and amounts charged.
- Usage and device information. Technical information needed to run, secure, and improve the Service, such as log data, IP address, device and browser type, pages viewed, and actions taken. See Section 8 (Analytics and Product Usage) for the analytics tools we use.
2. How We Use Information
We use information to:
- create and manage your account and workspace;
- write, print, and mail the cards and letters you order, including validating recipient addresses;
- process payments and manage your prepaid wallet;
- generate and apply your custom handwriting style, if you create one;
- provide support, send you service-related messages, and keep records of your orders;
- understand how the Service is used so we can improve it (see Section 8);
- secure the Service and prevent fraud and abuse; and
- comply with our legal and tax obligations.
We use recipient information, message content, and handwriting samples only to provide the Service to you. We do not sell your personal information or your recipients' personal information, and we do not share it for cross-context behavioral advertising.
3. How Recipient Addresses Are Validated
When you provide a recipient address, we send that address to Google and to the United States Postal Service to validate and standardize it. These providers return a corrected or confirmed address so your mail is formatted correctly and is more likely to reach the recipient. They process the address to provide that validation service to us.
4. Sub-Processors We Share Information With
We share information with the service providers below so they can perform services for us. They are permitted to use the information only to provide those services.
| Sub-processor | Role |
|---|---|
| Supabase | Authentication and application database; stores account, workspace, contact, and order data |
| Stripe | Payment processing and wallet billing; handles card data (we do not store card numbers) |
| Vercel | Hosting for our website and web application |
| Railway | Hosting for our backend services and mail-fulfillment workers |
| Cloudflare | DNS, content delivery, and network security |
| Optional "Sign in with Google" authentication; recipient address validation | |
| United States Postal Service (USPS) | Recipient address validation and standardization |
| Resend | Sending transactional and account emails to you |
| PostHog (PostHog, Inc.) | Product analytics and masked session replay (see Section 8) |
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of LetterCircuit, our users, or others. If we are involved in a merger or sale, information may be transferred as part of that transaction, subject to this Policy.
5. Retention
- Account information: kept while your account is open.
- Recipient information and message content: kept while your account is open and as needed to provide the Service and keep a record of your orders. Deleted on account closure or on your request, subject to legal and tax holds.
- Handwriting samples and custom styles: kept for as long as the style exists in your workspace. Deleted when you delete the style or close your account, and sooner on request.
- Billing and transaction records: kept as long as required by tax and accounting law.
- Analytics data: kept according to the retention settings of our analytics providers and as needed to understand and improve the Service.
6. Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to: know what personal information we collect and how we use it; request a copy of your personal information; request deletion of your personal information; correct inaccurate personal information; and not be discriminated against for exercising these rights.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California law. You can signal your privacy choice using a Global Privacy Control (GPC) signal in your browser, which we honor, or by using the "Do Not Sell or Share My Personal Information" option below.
To exercise these rights, contact us at hello@lettercircuit.com. We will verify your request before acting on it. If you are submitting recipient information about other people, you are responsible for having the right to provide it.
7. Security
We use reasonable administrative, technical, and organizational measures to protect personal information, including access controls, encryption in transit, and reputable hosting and payment providers. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
8. Analytics and Product Usage
We use PostHog (PostHog, Inc.) as a processor to understand how our website and application are used. This tool sets cookies or local storage and collects usage data such as pages viewed, actions taken, approximate location (from IP address), and device and browser type. In the signed-in application, PostHog also captures masked session recordings: form inputs, postal addresses, message contents, and API keys are masked and are not recorded.
We do not send your name, email address, postal address, or message contents to analytics providers. In the application we associate events with an internal account identifier and your email domain only. Analytics data is processed on United States based infrastructure. We do not use advertising networks and we do not use these tools to sell or share your personal information for cross-context behavioral advertising.
You may opt out of analytics using a Global Privacy Control (GPC) signal in your browser, which we honor, and through the "Do Not Sell or Share My Personal Information" option below.
9. Cookies
We use cookies and similar technologies for two purposes:
- Necessary cookies. The session and authentication cookies needed to sign you in and keep your session secure. These are always on because the Service will not work without them.
- Analytics cookies and local storage. Set by the tools described in Section 8 to understand and improve the Service. You can opt out of these as described in Sections 6 and 8.
10. Children
The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
11. Changes to This Policy
We may update this Policy. If we make a material change, we will update the "Last updated" date and take reasonable steps to notify you.
12. Do Not Sell or Share My Personal Information
We do not sell or share your personal information for cross-context behavioral advertising. However, if you want to signal your privacy preference, you can:
- Use Global Privacy Control (GPC): If your browser supports GPC, you can enable it in your browser settings. We honor GPC signals.
- Click below to opt out:
13. Contact and How to Delete Your Account
To ask a privacy question, exercise your rights, or delete your account and associated data, contact us at hello@lettercircuit.com or use the account-deletion option in your account settings. When you delete your account, we delete your workspace data as described in Section 5 (Retention), subject to legal and tax holds.