Privacy

Letters sent by a private link

The letter database stores a letter ID, encrypted letter contents, an encryption IV, creation and delivery times, a stored close date, a one-time flag, and a mailbox ID when the letter is linked to a mailbox. In the normal browser flow, the letter’s decryption key is placed after the # symbol in its private link and is not included in requests to the letter API. Anyone who obtains the full valid link can use that key to decrypt the letter. A person with only the letter ID can request its encrypted contents when available, but cannot read them without the key.

Each letter has a stored close date. Its encrypted contents are not returned while that date has passed. Opening or refreshing an authorized private inbox, or sending or receiving a mailbox message, extends affected mailboxes and linked letters to at least 30 days from that activity, without shortening a later close date. Creating a new private-link letter can extend the mailbox without extending older linked letters, so their close dates can differ. A later inbox read can extend an older linked letter again if its record remains stored. Opening an individual private-link letter does not renew its mailbox.

A one-time letter’s database record is removed when its encrypted contents are retrieved for opening, before the browser decrypts or displays them. Successful reading is not required for that removal; someone with the letter ID can trigger the retrieval without having the decryption key.

Cleanup is configured for expired records, but expiry is an access limit, not a guaranteed deletion deadline. Individually expired linked-letter records can remain while their mailbox is active. Manual deletion can be requested using the letter ID, as described below. No timing or erasure from backups is promised.

Temporary Dove mailboxes

For a mailbox, the server stores the mailbox ID, display name, public encryption key, a hash of the private read token, creation and expiration times, and encrypted message envelopes. Each message record includes IDs used for the mailbox and conversation, whether it is sent or received, encrypted text, an IV, a wrapped encryption key, and a creation time.

Mailbox messages are encrypted in the sender’s browser. The private mailbox link contains the decryption key and read token, and that browser can save them in local storage. The read token is sent to the server to authorize inbox access; the normal browser flow does not send the private decryption key.

New mailboxes have a close date 30 days after creation. An authorized inbox read, including Refresh, or a mailbox-message send or receipt extends affected mailboxes to at least 30 days from that activity. Repeated activity can keep a mailbox open; there is no fixed maximum lifetime. Viewing its public send-to address alone does not renew it.

Expired mailboxes and their messages are not returned by the inbox service. Cleanup is configured to remove expired mailboxes and their stored messages and linked letter records, but no deletion deadline is guaranteed. Removing one mailbox does not remove a separate copy stored in another mailbox, browser, email, download, or screenshot. No erasure from provider backups is promised.

Information stored in your browser

Local storage may hold your mailbox ID, private decryption key and read token, random statistics visitor ID, theme choice, browser statistics-exclusion flag, and a statistics-access key when supplied. The exclusion flag is available to any visitor through /exclude-stats. These entries have no programmed expiry. They are saved in that browser, not restricted to a particular physical device; a full private mailbox link can be opened elsewhere.

Session storage may hold readable letter drafts and reply context while you move between the writer and mailbox, and may include a full private share link. It also holds a timestamp used to count analytics sessions. Some successful-send and new-letter actions remove these entries. Otherwise, they normally last for the browsing session, although browser restoration may retain them. Sent by Dove’s own code does not set cookies.

Site Stats

The browser sends an event type, random visitor ID, page path, and button-text label to the site’s statistics endpoint. Query strings and fragments are omitted, but a public Dove address ID can appear in the page path. Button-text labels are dropped before statistics storage. The service stores combined event, page, daily and monthly counters and monthly visitor-ID markers without a programmed expiry. The normal tracking payload does not include letter contents. Opening /exclude-stats stops this browser’s tracking events; clearing site storage removes that exclusion.

Hosting and request logs

Sent by Dove is hosted on Cloudflare. Like other hosting providers, Cloudflare may receive IP addresses and standard request information when your browser connects to the site, and may keep standard service or security logs under its own practices. Cloudflare may use security-related cookies or similar technologies.

Contact and feedback

The contact handler attempts to forward your message and any name, email address, rating, or feedback type through Cloudflare’s email service to the owner’s Gmail inbox. These submissions are readable email, not encrypted letter contents, and the handler does not save them in the site database. Delivery and replies are not guaranteed. Email-system retention is outside the site code’s control. If you include a full private link, its recipient and the services carrying the message receive the access material in that link.

Children

Sent by Dove is intended for people 13 and older. If you believe a child under 13 has sent us personal information, use Contact to request manual deletion. No deletion deadline or removal from provider backups is promised.

Questions

For privacy questions or requests, use Contact. To request deletion of a stored letter record, provide the letter ID rather than its full private link. Deletion is handled by hand on request with the letter ID; there is no self-service deletion control or promised completion time. This does not promise removal of copies in other mailboxes, browsers, email systems, downloads, screenshots, or provider backups.