1. Who We Are & Scope
MyLetterLoft ("we," "our," or "us") provides an online platform that enables users to design, customize, lock, and deliver interactive digital surprise letters, countdown greetings, and mini-game experiences.
This Privacy Policy explains what personal data we collect when you access our website (myletterloft.com), register an account, recharge coins, or share letters with recipients, and how that information is safeguarded.
2. Information We Collect
We collect personal information directly when you provide it to us, automatically as you navigate the platform, and from trusted third-party authentication and payment processors.
3. Data Category Breakdown
| Data Category | Examples | Primary Purpose |
|---|---|---|
| Identity | Full name, display name | Account personalization & receipts |
| Account | Verified email, hashed password, role | Authentication, security alerts, session management |
| Payment | Razorpay payment ID, order ID, coin balance | Order reconciliation, double-spend prevention, wallet accounting |
| Content | Letter messages, quiz answers, custom titles | Rendering interactive surprise links for recipients |
| Referral | Referral codes, commission earnings | Attribution and creator reward payout processing |
4. How We Use Your Information
- To create, host, and deliver your digital surprise experiences.
- To authenticate your sessions securely via NextAuth credentials or Google SSO.
- To process coin bundle recharges and issue transactional payment receipts.
- To calculate referral rewards and process creator commission requests.
- To dispatch critical security notifications (e.g. password changes).
- To comply with statutory legal and tax obligations in India.
5. User Content & Uploaded Media
Creators retain full ownership of the personal text, memories, and photos they upload. You grant MyLetterLoft a limited, non-exclusive license strictly necessary to store, transmit, and render the surprise page to you and your designated recipient.
6. Authentication & Password Security
We never store passwords in plaintext. All account passwords are encrypted using one-way cryptographic bcrypt hashing with secure salting. Google OAuth authentications are verified directly via secure token exchanges.
8. Service Providers & Infrastructure
We work with trusted infrastructure providers who process data strictly under confidentiality agreements:
- Razorpay: Payment processing and UPI gateway infrastructure.
- Google OAuth: Optional single sign-on authentication.
- Vercel & Cloud Database: Hosting and secure database infrastructure.
9. Data Retention & Storage
Account records and created surprise links are retained as long as your account remains active. Inactive draft letters or closed accounts are purged according to our data management cycles.
10. User Rights & Choices
Under applicable data protection frameworks, including the Digital Personal Data Protection framework, you have rights to access your stored data, correct inaccurate details, or request account closure.
11. Account Deletion Workflow
You can request permanent account deletion at any time by contacting our support team at support@myletterloft.com. Upon verification, all associated letters, balances, and profile records are irrevocably deleted.
12. Children Privacy
MyLetterLoft is designed for general audiences and is not directed at children under the age of 18 without parental consent. We do not knowingly collect personal data from minors.
13. Security Safeguards & Incidents
We employ SSL/TLS encryption for all data in transit, strict environment secret segregation, and automated server-side verification to protect against unauthorized access.
14. Grievance Officer & Contact
If you have questions or grievances regarding personal data processing, contact our designated Grievance Support Desk at support@myletterloft.com.