With Affection Privacy Policy

Draft: 32 items still to be filled in, highlighted below.

Effective date: [TBD: effective date]
Last updated: [TBD: date of last update]

This policy explains what information the With Affection app and its letter service (we call the service "the Night Mail") collect, why, who can see it, how long we keep it, and what you can do about it.

This policy is written in English and Simplified Chinese. If the two versions differ, the English version prevails.

In brief

• Who we are. With Affection is run by one person, [TBD: operator's full legal name], who lives in mainland China. There is no company behind it. In this policy, "we" and "us" mean that person.
• What we collect. Your Apple sign-in ID, your birth year and month, the age range Apple shares with us, your pen name, the city you choose, your drafts and letters, and the records the Night Mail needs to deliver letters (dates, stamps, pen pals, refusals, reports).
• What we don't do. No ads. No analytics or tracking tools. We never sell or share your information for advertising. We never use your location; the city is one you pick yourself.
• Who reads letters. Every letter is checked automatically when you seal it. No person reads letters, with narrow exceptions: when the person who received a letter reports it, we read that one letter; and in the rare cases described in section 6.
• Where it is stored. On a server in the United States. Nothing is stored in mainland China. But the operator manages the service and reviews reports from mainland China (section 8).
• Your control. You can change your pen name (once a year) and your city, remove letters you've received, and delete your account in Settings at any time. Letters you already sent and that were delivered stay with the people who received them.
• Age. You must be 16 or older. Users under 18 only exchange letters to strangers with other users under 18 (section 10).

1. Who is responsible for your information

With Affection is operated by [TBD: operator's full legal name], an individual living in mainland China.

• Email: [TBD: contact email — suggested [email protected]]
• Postal address: [TBD: postal contact address, if any]
• Website: withaffection.app

You can also reach us from the app: Settings → Contact us.

2. Words used in this policy

• The Night Mail is the With Affection letter service. Every letter goes to the Night Mail first, and the Night Mail passes it on to the person it is for.
• Mailbox is your address in the service. Other people never see it.
• Pen name is the name other people see. It doesn't have to be unique.
• Seal means finishing a letter and handing it to the Night Mail. After you seal a letter, you can no longer read it.
• A letter to a stranger is a letter you write without choosing who gets it. The Night Mail picks a reader.
• Pen pals are two people connected by the Night Mail: someone received a letter to a stranger, wrote back, and that letter was delivered.
• Refuse means you stop accepting letters from a particular person.
• Returned to sender means a letter came back without anyone reading it.

3. Information we collect

We collect only what the service needs to work.

3.1 Information you give us

3.2 Information the service creates as you use it

• Dates and status of your letters: when each was sealed, received by the Night Mail, delivered, or returned to sender. All dates shown in the app are to the day.
• Your stamps: how many you have and when the next one arrives.
• Who your pen pals are, the date you first received a letter from each, the date you became pen pals, and how many letters you have exchanged.
• People you have refused, and whether you have accepted their letters again.
• Which letters you have opened and which you have removed.
• When you last opened the app. The Night Mail uses this to give letters to strangers only to people who use the app.
• [TBD: whether the app sends your device's time zone and interface language to the server, to show dates and city names correctly. Recommended: yes, and keep this line.]

3.3 Information from Apple

• Age range. When you sign up, iOS asks whether With Affection may read the age range on your Apple Account. If you allow it, Apple shares an age range (for example, "18 or over"), not your exact birthday. We use it to check the birth year and month you entered. [TBD: what happens if you decline to share the age range, or if it doesn't match what you entered.]
• Payments. You buy the app from Apple. Apple handles payment completely. We never see your card or payment details. Apple gives us sales reports that do not identify you.
• Crash reports. If you have chosen in your iPhone's settings to share analytics with app developers, Apple may send us crash reports and usage statistics. Apple says these do not identify you.

3.4 Technical information

When the app connects to the Night Mail, our server and Cloudflare (section 7) receive technical information such as your IP address, the time of the request, and the app version. We use it to run the service, keep it secure, and fix problems. We keep server logs for [TBD: log retention — suggested 30 days].

3.5 What we do not collect

• No location from your device.
• No contacts, photos, microphone or camera.
• No advertising identifier. No analytics, advertising or tracking software in the app.
• No payment details.
• Letters are plain text only. There are no photos or files in letters.

4. How we use your information

We use your information only to:

1. Provide the service: sign-in, writing, sealing, delivering and returning letters, stamps, pen pals, refusals, the calendar and receipts.
2. Apply the age rules (section 10).
3. Check letters automatically for content that breaks our Terms of Use (section 6).
4. Review reports and keep the service safe, including acting against people who break the rules.
5. Answer your messages.
6. Keep the service secure and working, and fix bugs.
7. Follow the law, including reporting apparent child sexual exploitation as US law requires (section 6).

We do not use your information for advertising, profiling, or selling anything. We do not use your letters to train artificial intelligence. We do not make decisions about you based only on automated processing that have legal or similarly serious effects on you; the automated check only decides whether a letter can be sent (section 6).

5. What other users can see

Important: a letter cannot be taken back. After you seal a letter, you cannot read it, cancel it, or delete it from the other person's mailbox. The person who receives it can keep it, copy it, or take screenshots. Only write what you are comfortable with someone else keeping. Don't put things in a letter you would not want a stranger to know, such as your address, phone number, school, or passwords.

6. How letters are checked and who can read them

6.1 The automated check

When you seal a letter, it is checked automatically for content that breaks our Terms of Use.

[TBD: content-check provider. Use ONE of these two sentences once decided:
(A) "The check runs on our own server. No other company receives your letter for this."
(B) "The check is done by [provider name], a service provider that receives the letter text only to check it, may not use it for any other purpose [TBD: confirm the provider does not use it to train its models], and keeps it for [TBD: provider retention, e.g. no longer than 30 days]."]

[TBD: what happens when the check flags a letter. Recommended: "If the check finds content that clearly breaks the rules, the letter is not sealed, it stays in your drafts, no stamp is used, and the app tells you why." No person reads the letter as part of this, except as described in 6.3.]

6.2 No person reads letters

Our rule is that no person reads your letters. The exceptions are listed in 6.3.

6.3 Exceptions

1. When a letter is reported. If the person who received your letter reports it, the operator can read that one letter, the report, and the information needed to act on it (for example, both pen names and the letter's dates). The operator cannot read your other letters because of a report.
2. Child safety. If a letter appears to involve the sexual exploitation of a child, we may review it and report it, with related account information, to the National Center for Missing & Exploited Children (NCMEC), as US law (18 U.S.C. § 2258A) requires. NCMEC may share reports with law enforcement.
3. When the law requires it. We may disclose information, including a letter, if a valid legal process (such as a court order or subpoena) requires it, or if we believe in good faith it is needed to prevent someone's death or serious harm.

6.4 Encryption — what it does and does not mean

• Connections between the app and the Night Mail use HTTPS.
• Letter text is stored encrypted on our server and in our backups.
• This is not end-to-end encryption. The Night Mail's system holds the keys and can decrypt letters, because it must check them, deliver them, and show a reported letter to the operator. Cloudflare, which handles HTTPS for us, briefly processes the content of connections, including letter text, as it passes through its network.

6.5 Translation happens on your iPhone

If a letter is in a different language from your app, the app can offer a machine translation. It uses Apple's Translation framework on your device. The letter text is not sent to our server for translation. iOS may need to download a language from Apple first.

7. Who we share information with

We never sell your information and never share it for advertising.

We share information only with these service providers, and only as they need it to run the service:

We may also disclose information:

• to NCMEC or law enforcement, as described in section 6.3;
• to protect the rights, safety and property of our users, the public or us, or to enforce our Terms of Use;
• if the service is ever transferred to another person or company. If that happens, we will tell you before your information becomes subject to a different privacy policy.

8. Where your information is stored, and access from mainland China

• All service data is stored on our server in the United States. Encrypted backups are stored by Cloudflare.
• No service data is stored in mainland China.
• The operator lives in mainland China. The operator manages the server, answers your emails, and reviews reports remotely from mainland China. This means:
  • When a letter is reported, the operator reads that letter and the report from mainland China.
  • As the person who runs the server, the operator has technical access to the systems where your data is stored, even though our rule is to open only reported letters (section 6).
  • Information viewed from mainland China may become subject to Chinese law. In some circumstances, Chinese authorities could require access to it.
• Because the server is in the United States, your information is subject to US law, and US authorities may require access to it through legal process.

By using the service, you understand that your information is handled in this way. If you do not accept this, please do not use the service.

9. How long we keep information

10. Users aged 16 and 17, and their parents

With Affection is for people 16 and older. People under 16 cannot use it.

How age is checked. At sign-up you enter your birth year and month, and iOS asks whether the app may read the age range on your Apple Account. If either shows you are under 16, you cannot create an account. This is not perfect identity verification. We rely on what you tell us and what Apple shares.

Letters to strangers are separated by age.

• If you are under 18, the Night Mail only gives your letters to strangers to other users under 18, and you only receive letters to strangers from users under 18.
• Users 18 and over only exchange letters to strangers with each other.
• When you turn 18, you move to the adult group for new letters to strangers. People who are already your pen pals stay your pen pals.

What is the same for everyone. Your city, birth date and stamps are private. You can refuse anyone's letters and report any letter. There are no ads and no tracking for anyone.

If you are 16 or 17:

• Never put your address, phone number, school, social media, or other ways to find you in a letter unless you are sure. You don't have to share anything.
• If a letter makes you uncomfortable, you can refuse that person's letters and report the letter. The sender won't know.
• If you are in danger, contact local emergency services. In the US, you can call or text 988 for crisis support.
• Removing letters you sent. [TBD: removal of content posted by minors. California law (Cal. Bus. & Prof. Code § 22581) lets users under 18 ask us to remove content they posted. Recommended text, once the product supports it: "If you are under 18, you can ask us to remove a letter you sent from the reader's mailbox, or remove your pen name from it, by emailing us. We will do this for users under 18 wherever they live. This does not guarantee the letter is gone completely; the reader may already have copied it."]

Parents and guardians. If you believe your child under 16 is using With Affection, or you are the parent or guardian of a 16- or 17-year-old and have a concern, email [TBD: contact email]. We will delete an account we learn belongs to someone under 16. [TBD: whether a parent of a 16- or 17-year-old can ask us to delete the child's account, and how we confirm the request. Recommended: yes, after confirming through the app's "Contact us" with the child's account.]

Children under 13. The service is not for children under 13, and we do not knowingly collect their information. The US Children's Online Privacy Protection Act (COPPA) applies to services that collect information from children under 13; since children under 13 are not allowed, we do not collect information under COPPA. If we learn we have information from a child under 13 (or anyone under 16), we will delete it.

11. Your choices and rights

We give these rights to everyone who uses With Affection, wherever you live, including in every US state. Some of them come from laws such as the California Consumer Privacy Act; we offer them to all users whether or not a law requires it.

In the app:

• Change your pen name (once a year) and your city in Settings.
• Delete drafts, and remove letters you've received.
• Refuse letters from someone.
• Turn notifications on or off in iOS settings, when notifications are available.
• Delete your account: Settings → Delete account.

By email to [TBD: contact email], you can ask us to:

• Tell you what information we hold about you and give you a copy in a common format.
• Correct information that is wrong (for example, your birth year and month).
• Delete your information.
• Limit how we use information. (We already use it only for the purposes in section 4.)

Limits you should know about:

• Letters you have sealed. Sealed letters are meant to be unreadable by their sender. When you ask for a copy of your data, we will include your account details, drafts, and the letters you have received, but not the text of letters you have sealed, unless the law requires it.
• Letters delivered to others belong in the reader's mailbox. Deleting your account does not delete them (section 12).

How we handle requests. To protect you, we need to confirm a request comes from you. [TBD: how we confirm identity. Recommended: the request is sent through Settings → Contact us, which includes a reference to your account, or we ask you to confirm from inside the app.] You may use an authorized agent; we may ask for proof that they are authorized. We will respond within 45 days. If we need more time (up to another 45 days), we will tell you why. If we turn down a request, we will explain why, and you can appeal by replying to our answer; we will respond to an appeal within 45 days. If you are not satisfied, you may contact your state attorney general.

We do not sell or share your personal information for money or for cross-context behavioral advertising, as those terms are used in California law. We do not use or disclose sensitive personal information for any purpose other than providing the service. We will never treat you differently for using these rights.

Do Not Track and Global Privacy Control. We do not track you across apps or websites, so these signals do not change anything.

12. Deleting your account

Go to Settings → Delete account. Deletion cannot be undone.

When you delete your account:

• Deleted: your account, city, drafts, stamps, and the letters you have received. Your birth year and month and age range are deleted.
• Stays with the people who received them: letters you sent that were already delivered, together with your pen name (and your most recent former pen name, if any). You will still appear in your pen pals' lists.
• Still delivered: letters you sealed that are still on their way.
• Returned: letters people write to you afterward are returned to sender. They are told only that the letter could not be delivered and that no one read it.
• Kept for a limited time: server logs, backups, reports and safety records, as described in section 9.

[TBD: how quickly deletion takes effect on the live server. Recommended: immediately when you confirm.]

If you no longer have the app, email us and we will delete your account after confirming the request comes from you.

13. Security

We protect your information with HTTPS connections, encryption of letter text and backups, and limited access: only the operator can administer the service. No system is perfectly secure. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

14. Regions where With Affection is not offered

With Affection is not offered in mainland China, the member states of the European Union, the United Kingdom, or Australia. We do not provide the mechanisms that the laws of those places require (such as the EU and UK General Data Protection Regulation). If you are in one of those places, please do not use the service.

15. Changes to this policy

We will post any new version at withaffection.app with a new "Last updated" date. For important changes, we will tell you in the app before the change takes effect [TBD: the app needs a way to show this notice]. If a change would let us use information you already gave us in a significantly different way, we will ask for your consent first.

16. Contact

[TBD: operator's full legal name]
Email: [TBD: contact email — suggested [email protected]]
Postal address: [TBD: postal contact address, if any]
In the app: Settings → Contact us