Privacy policy

Letterium (“the service”) is a website that gathers handwritten messages from many people and plays them for one recipient as a show. This policy explains what personal information the service collects and why, how long it keeps it, and who handles it on our behalf. Operator: Olhi Studio (sole proprietor: An Donghun), Seoul, Republic of Korea

What we collect, and why

People who make a card

The account identifier (sub) we receive from Google sign-in, and a cookie that keeps you signed in. What you enter for the card: the recipient’s name, the questions, the deadline, the date you met and the intro line.

People who write a message

The name you enter, your message, the strokes of the signature and doodle you draw with your finger, and the handwriting, pen and ink you choose. A random secret that lets you edit your message again on the same device (the server stores only its hash).

People who watch the show

A random number the browser makes, so we can count how often the show is opened and watched to the end. It isn’t linked to a name or an account.

People who buy a keepsake

The Paddle transaction number, the amount, the currency and the payment status.

Connection data

Your IP address is used only to limit the number of requests and prevent abuse, and isn’t stored in the service’s database. Cloudflare, which hosts the service, may process access logs while providing it.

People who visit the public pages

An identifier Google Analytics keeps in a cookie, the pages you view and the page before, your device and browser, and whether you follow the link to make a card. Used only to count visits.

We use this information only to make cards, gather messages and show them, to make and deliver keepsakes, to see whether the service is being used, and to prevent abuse.

What we don’t collect

We don’t collect email addresses, phone numbers or postal addresses. The service sends and receives no email. Google sign-in gives us only an account identifier, not your name, email address or profile photo.

Card numbers and other payment details go directly to Paddle, the merchant of record, and the service can’t see them. Any email address Paddle collects during payment is covered by Paddle’s privacy policy.

How long we keep it

• A card and its messages, handwriting and show files: until the person who made it deletes the card. Deleting removes them from the database at once, and the stored files soon after.
• Links of a deleted card: only a hash of each link is kept, so the link can say the card was deleted. A link can’t be recovered from its hash.
• Earlier versions of a show: when a card is finished again and a new version is made, the earlier one is deleted 30 days later.
• Sign-in sessions: 30 days from signing in.
• Keepsake order records: 5 years (the period Korea’s Act on Consumer Protection in Electronic Commerce sets for contract and payment records).
• Google account identifiers: until you ask us to delete your account, at the contact below.

Who handles it for us

Cloudflare, Inc. (United States)

Hosting the service, storing its database and files, handling requests

Google LLC (United States)

Google sign-in (checking the account of the person who makes a card)

Paddle.com Market Limited (United Kingdom)

Keepsake payments, tax and refunds. As the merchant of record, Paddle receives payment details directly.

Google LLC (United States, Google Analytics)

Counting visits to the public pages

We don’t sell personal information, and we don’t give it to third parties for any purpose other than those above.

International transfers

The service is run from the Republic of Korea, and the providers above are based in the United States and the United Kingdom, so your information is processed in those countries.

Cookies and browser storage

• Sign-in cookie: only for the person who makes a card, to keep them signed in.
• Language cookie: remembers the language you chose for the screens.
• Browser storage: where to resume the show, the reduced-motion setting, and the value that lets writers edit their own message, kept on that device only.
• Google Analytics cookies (names starting with _ga): tell visits to the public pages apart, to count them.

You can block cookies in your browser settings. If you block the sign-in cookie, you can’t make or edit a card.

Analytics

The public pages use Google Analytics to count visits, see which pages are read and how often the button to make a card is pressed. It isn’t used for ads, and the writing, editing and show screens don’t have it. The data is kept for 14 months from collection. You can stop it by blocking cookies or with the Google Analytics opt-out add-on.

If you are in the EEA, the UK or Switzerland, Google Analytics sets no cookies unless you agree in Google’s consent message. Until then it is sent only visit counts, without cookies or an identifier that links your visits.

Children

The service isn’t directed at children under 13, and we don’t knowingly collect personal information from them. If you believe a child under 13 has given us personal information, please contact us and we’ll delete it.

Your rights

You can ask to see, correct or delete your personal information, or ask us to stop using it. Depending on where you live, you may have further rights under your local law. Writers can edit their own message from the same device while writing is open, and the organizer can delete the card. Send any other request to the contact below and we’ll handle it without delay.

How we keep it safe

• Every connection is encrypted with HTTPS.
• The tokens of writing and viewing links, and writers’ secrets, are stored only as hashes, so even the server doesn’t know the original values.
• The writing, editing and show screens are kept out of search engines.
• Only the operator can access the systems that run the service.

Contact

Contact

olhi1470@gmail.com

Changes to this policy

We’ll announce any change to this policy on this page before it takes effect. Effective date: October 28, 2026