Privacy
What we collect to mail your letter, who processes it, and how long we keep it.
Last updated: November 3, 2026
Who we are
Mail This Letter is operated by Firmary (https://firmary.app). This notice covers the Mail This Letter website and its apps for AI assistants such as ChatGPT and Claude.
Information we collect
Your sign-in identity, receipt email, the letter you supply, sender and recipient addresses, order details, and payment references.
How we use it
We use this information only to prepare and deliver your order. We never rewrite your letter or use it for marketing. We don't sell your personal information or use it for advertising. The security records and pseudonymous usage analytics described below help us prevent abuse, enforce cost limits and improve the app.
Address checks
Standalone address-check results are kept for 24 hours. We keep a count of the free checks you've used so the allowance doesn't reset. A check doesn't identify who lives at an address.
Who we share it with
Lob verifies addresses, renders proofs, and prints and mails letters. Stripe processes payments and tax; our servers never receive card numbers. In website checkout, Stripe collects payment details directly. If an approved ChatGPT payment-sheet checkout is available, ChatGPT collects your chosen payment method through that sheet and sends us a merchant-scoped Stripe payment token. AWS provides hosting, private storage and encrypted backups; Firmary sign-in processes your account identity and permissions under its sign-in privacy notice. Resend receives your receipt email and order summary to send operational receipts. The AI assistant you connect, such as ChatGPT or Claude, receives owner-authorized tool results and the proof preview when you request letter review. PostHog (US) receives the pseudonymous usage events described below.
Saved cards
If you choose to save your card at checkout, Stripe stores it. We keep only a Stripe customer reference for your account, and show the card's brand and last four digits on the review page. A saved card is charged only when you click Pay on a letter you reviewed. Remove it anytime with "Remove saved card" on the review page.
ChatGPT payment authorization
If you choose an available ChatGPT checkout, we use your receipt email and Stripe token to pay for the exact reviewed revision and price. We keep the checkout reference, a token hash and the original attempt timestamp to prevent repeat charges; we do not store the raw token or unused billing address, phone or buyer name. Authorization records follow the order-history retention below. An uncertain payment stays pending until reconciled, including after cancellation.
How long we keep it
Unpaid drafts and uploads: 24 hours. Paid letter content and proofs: 30 days. Settled order history: 12 months, longer only when an order is unresolved or the law requires it. Deleted records may remain in encrypted backups for up to 14 days. Lob and Stripe keep their own records under their policies.
Security records and controls
Preparation timestamps and hourly account counters prevent abuse and enforce cost limits. Counters are removed after 48 hours. Postal timestamps support truthful tracking, not profiling. Minimal process-error logs rotate within a 50 MB limit per container and exclude letter text and full addresses. Pages that show a note about Firmary count how often each version of the note is seen and clicked, as a daily total per page and version kept by Firmary sign-in. The count contains no cookies, network addresses or anything else that identifies you. Your browser remembers which version it last showed, so the next one differs.
Usage analytics
Our server sends pseudonymous usage events to PostHog (US): which tool or step was used, such as checking an address or preparing, paying for, mailing or canceling a letter, and its delivery progress; whether it worked and, if not, a short reason code, such as an undeliverable address or a declined card; how long it took; the page count and whether the letter was text or a PDF; and whether the AI assistant was ChatGPT, Claude or another. Server errors are reported the same way, as the kind of error and where in our code it happened, never its message. Events are keyed by a one-way code instead of your account and contain no names, email addresses, mailing addresses, letter contents, file names, prices or network addresses. We use them only to understand and improve how our apps are used, not for advertising. These pages load no analytics scripts, advertising pixels or session replay.
What you send
You may send only lawful content. By using Mail This Letter, you agree to comply with its terms and all applicable laws and regulations. You are solely responsible for what you send and how you use the service. Mail This Letter does not provide legal advice. Our logs use order IDs and never include letter contents or full addresses.
Your choices and rights
Discard an unpaid draft or remove a saved card on the review page. You can also ask us to access, correct or delete your account data and mailing records. To make a request, email support@firmary.app or use the support page, and include your order ID if it's about a letter. We delete account data and mailing records we no longer need; records we still need, such as an unresolved order, are kept as described under How long we keep it. Completed physical mail cannot be recalled.
Children
Mail This Letter isn't directed to children under 13, and Firmary doesn't knowingly collect their information.
Contact
For privacy questions and requests, email support@firmary.app or visit our support page at https://letters.firmary.app/support.