Privacy Policy

About this policy

This Privacy Policy describes how Letterfy Inc. (“Letterfy,” “we,” “us,” or “our”) handles information when you visit our website, use the Letterfy iOS app, or contact us. The app is currently in pre-release development; availability and features may differ between test builds and a future public release.

This policy updates our earlier Letterfy privacy policy to describe the current website and iOS experience. If we introduce a feature that changes how your information is used, we will update this policy and provide additional notice or seek consent where required.

Information we handle

The coming-soon website

You can browse this website without creating an account. The site does not have a mailing-list signup form or advertising trackers. We use Cloudflare to serve the site. Cloudflare also inserts a website measurement script that sends website usage and performance information to Cloudflare, including page and referring addresses, browser and device information, and page-load and interaction timings. We use these reports to understand website visits and performance. See Cloudflare’s explanation of its performance beacon. Hosting and security infrastructure necessarily processes network information, such as your IP address, requested address, browser information and request time, to deliver and protect the website. We do not enable application-level request logging for this site.

When you contact us

If you email us, we receive your email address, the contents of your message and any information you choose to include. We use this information to respond, provide support and resolve issues. Please do not send passwords, access tokens or private email content unless it is necessary for your request.

When you connect an email account

Gmail connections use Google’s authorization flow; Letterfy does not ask for your Google password. Compatible builds also let you connect Yahoo Mail or another IMAP account by entering the email address, incoming server, port, username, selected mailbox and password or app password. Yahoo connections use a Yahoo-generated app password, rather than Yahoo sign-in or your regular Yahoo password. IMAP credentials are sent directly from your device to the server you select over an encrypted TLS connection, with system certificate and hostname checks. Confirm the server belongs to your provider before connecting. Letterfy does not offer an unencrypted connection or a certificate-warning bypass.

Your account information, email data, synchronization state, newsletter choices, reading preferences and saved/read status are processed on your device to provide the reading experience. Google access and refresh tokens and IMAP passwords are stored in device-only Keychain storage; they are not sent to Letterfy’s servers. The IMAP server receives the credentials needed to authenticate your connection. An IMAP password or app password may permit broader access at your provider than the reading actions Letterfy implements. The IMAP client opens the selected mailbox read-only and retrieves messages without marking them read. It does not send mail, change provider flags, or delete provider messages. Read and finished choices stay in Letterfy. One mailbox is checked for each IMAP connection, with INBOX as the default; messages in other folders are not automatically included. The separate publication matching, catalog sharing, reader-count and discussion choices in this policy also apply to mail from IMAP accounts.

A first mailbox check covers up to 100 emails per account from the past five days. Subsequent checks include read and unread mail, resume unfinished checks, and process new provider-reported arrivals even when their message dates are older. A sync repair may recheck the recent five-day window to recover missed issues. Checks run when you request them, or automatically if you enable that option. Newsletter detection and duplicate checking happen on your device.

Email & newsletter data

Letterfy retrieves email from your connected provider and identifies newsletters on your device. Detection may examine messages that are not newsletters, so it would be inaccurate to say the app never accesses other email. Classification is imperfect, and you choose which newsletters to add.

In builds with preference-aware newsletter actions, newsletter review, possible-newsletter review and Find in your email use your saved catalog-sharing choice: while sharing is on, the main action is Add & verify, and More → Add privately adds without catalog contributions. Updated builds show the contribution disclosure before the add action; tapping Add & verify or using the corresponding swipe or VoiceOver action adds the newsletter and authorizes its contributions immediately, without a second confirmation sheet. Earlier preference-aware builds show the disclosure in a separate sheet and require confirmation. While sharing is off, the main action is Add privately and verification is unavailable. Right swipe and VoiceOver actions follow the same choice. Turning sharing back on restores the verification action; it does not enroll private additions. The earlier interface introduced in build 78 labels the private action Add to library and places verification in More; still earlier builds call the private action Add privately.

Find missing newsletters lets you search a connected mailbox, including older read and unread messages outside the initial check. Gmail searches support Google’s search syntax. Compatible IMAP builds search the selected mailbox using plain sender, subject or message-text terms. Search terms go directly to your email provider. Results and email previews remain in memory until you choose emails to add. Compatible builds render previews with the same isolated reader used for saved newsletters; opening a preview does not add the email or change its read status. Remote images start blocked in each preview. If you choose to load them, that permission applies only until you close the preview; fetched preview images are held in memory. Selected emails are stored on this device, their senders are approved locally (including previously hidden senders), and their current read status is preserved. The manual inclusion choice remains until the message or account is removed. In builds with remembered manual newsletter sources, adding an email also saves a source choice on this device. Future matching issues from the same sending address in that connected mailbox are added during mail checks without requiring another manual addition, even if detection would otherwise reject them. When the added email identifies a specific mailing list, later issues must match that list too. The source choice survives deletion of the original email and detector changes; removing the connected account clears it. Hidden senders, dismissed messages and existing pending reviews still apply, and account actions, receipts, signup confirmations and unsubscribe notices remain subject to separate filtering. Earlier builds remember only the selected message. The source rule stays on your device; the publication-matching and catalog-contribution settings described in this policy also apply to later issues. In compatible builds, Add privately keeps manually selected messages out of catalog submissions, while Add & verify explicitly includes them in the contribution process below. Builds without those choices keep manual additions out of catalog submissions. They are never used for shared-model training.

Possible newsletters keeps uncertain emails on your device for review, including some short reading announcements and emails with limited editorial evidence. Unless they match a source you already added manually in a compatible build, they stay outside your reading library until you explicitly add them. Adding preserves read status and approves the sender locally; compatible builds also remember that source for future matching issues as described above. Dismissing removes the local email unless you saved it. In compatible builds, Not a newsletter also stores a local hashed repeat rule scoped to that connected mailbox, sender, mailing-list identity and recurring subject wording, allowing standalone numbers to vary. Matching pending and future emails stay out of newsletter suggestions; different topics or mailing lists from the same sender can still appear, and already approved reading mail is preserved. Generic subjects only dismiss the individual email. Explicitly adding a matching email through Find in your email clears its repeat rule. Earlier builds remember only the dismissed message. Dismissing does not revoke sender approval or catalog-contribution consent, but dismissed messages remain excluded from contributions. Hide is a separate choice, reversible through Your newsletters → Hidden senders. In compatible builds, it also remembers list-specific mailing-list identifiers locally, so the same list stays hidden when its sending address changes. This rule applies only in that connected mailbox, not to every list from the same domain. Restoring the original hidden sender clears the list rules created by that Hide; explicitly adding a matching email clears its matching list rule. These choices do not unsubscribe you or delete email at your provider. Pending review and dismissal choices survive detector changes and are cleared when the account is removed. In compatible builds, Add privately keeps these emails out of catalog submissions, while Add & verify explicitly authorizes the contribution process below. Builds without those choices keep possible-newsletter additions out of catalog submissions. Mail and review choices are never used for shared-model training.

When you choose Unsubscribe for a supported message, Letterfy sends a direct HTTPS request from your device to the publisher’s unsubscribe endpoint. The request includes the publisher-provided subscription URL, which may contain a recipient identifier or token, a fixed unsubscribe instruction, and ordinary connection information such as your IP address. It does not add mailbox credentials, cookies, email content or a separate recipient address. Other recognized unsubscribe links open the publisher’s page after you review the destination. Mail checks do not send unsubscribe requests. Action metadata stays in the local mailbox cache; an account-scoped URL hash and request status remain locally to prevent repeat sends until you remove the account. These links and receipts are not uploaded to Letterfy’s server, catalog or notifications.

Subscription confirmation review uses local rules and, starting with build 55, a separate bundled on-device intent model to identify recent newsletter signup requests before newsletter filtering. The model can recognize unfamiliar subject lines, but a request must still pass explicit-link and newsletter-intent checks. It does not choose arbitrary links or contact an AI service. Known confirmation templates continue to use local rules if the model is unavailable. The app stores sender, subject, message date, message identifier and the confirmation link in a separate on-device queue; it does not keep a full email body in this queue. Detection can miss requests or mistake other messages for confirmations. Letterfy does not authenticate the sender. Requests that do not match a subscription you started in the app require you to review the sender and destination and choose whether to open the publisher’s page. That site receives the requested URL, including any confirmation token, and ordinary connection information; opening the link may activate your subscription. Dismissing clears the local action payload. Requests older than five days are hidden and cleared during local mailbox cleanup. A local message receipt prevents repeats until the message or account is removed. Confirmation links are not sent to Letterfy’s server, the public catalog or notifications, and connected customer mail is not collected for shared-model training.

In builds with assisted subscriptions, Discover shows the selected connected email account before you choose Subscribe. Choosing Subscribe authorizes Letterfy to fill that address in a supported, unambiguous email-only newsletter signup form on the publisher’s website; you submit the publisher’s form yourself. The publisher and its website services can receive the address as soon as it is filled, together with the requested URL, website cookies and normal browser and connection information. Letterfy does not automatically submit signup forms, fill account passwords, complete payments or CAPTCHAs, or select additional consent boxes. Unsupported forms stay available for you to complete. While the subscription sheet is active, Letterfy can check the selected mailbox for a new matching confirmation and open it in the sheet when its account, exact publication identity, timing and HTTPS destination pass local checks. Other requests require your explicit review. It does not open confirmation links in the background. The local subscription request records the selected account, publication identity and progress for up to 24 hours, with expiry and removal applied during local cleanup; removing the account clears its requests. Website storage remains subject to the separate browser-profile controls described below. Signup addresses, requests, confirmation links and page text are not uploaded to Letterfy or a cloud AI service by this assistance.

In assisted-subscription builds, clear publisher success text can complete the local addition automatically; loading a page alone does not mark success. Unsupported outcomes still let you report that the publisher confirmed your subscription. Earlier builds require that report for every completion. Completing a matched email confirmation adds the newsletter to your local library and clears the confirmation action link. Direct signup without a confirmation adds a reading source only when one safe known sender is available; otherwise the app asks you to add the first edition when it arrives. If catalog sharing is enabled, its publication name and sender or list identity are queued for publisher review without the confirmation subject, message body, signup address, action URL or token. Local approved-newsletter metadata and completion receipts remain until account removal; hiding the newsletter stops pending submissions. This catalog contribution is separate from contacting the publisher. Earlier builds may show newsletter welcomes in the library. Starting with build 68, welcome emails and unsubscribe notices stay out of automatic reading selection; manually added messages remain your choice. Welcome and confirmation metadata do not create editorial issue candidates.

Starting with build 49, newsletter detection first uses a bundled Letterfy Core ML classifier on your device. Builds 49–67 may include newsletter welcomes. Starting with build 68, the trained detector selects newsletter issues; welcome emails and unsubscribe notices stay out of automatic reading selection. Subscription confirmation requests remain a separate action flow. If the bundled model cannot process an email, the app falls back to Apple’s on-device model when available or local rules. Detection can make mistakes; you can review possible newsletters, add missed mail or remove unwanted sources. Message content is not sent to Letterfy or a cloud AI service for classification. Downloaded email content and the local search index stay on your device. Letterfy’s backend does not automatically receive newsletter bodies, recipient identifiers or provider credentials. Private reading history stays on your device unless you enable the separate publication-count contribution described below. A passage you deliberately publish in a discussion is a separate public disclosure, described below.

In read-only builds, new Google connections and reconnects request gmail.readonly to find and display newsletters. Finish, Mark as read or unread, and Undo keep your choices on this device without changing Gmail. Local choices are retained across mail checks and take precedence over incoming provider read flags for those messages. Earlier builds requested gmail.modify and synchronized read/unread state with Gmail. Installing a read-only build stops those writes even if Google retains an earlier broader grant; it does not revoke that grant or undo changes already sent.

Compatible builds may offer optional Gmail read-status sync in the email account’s options. It is off by default. Letterfy explains the feature before asking Google for additional gmail.modify permission for that account. Only after you enable it and grant access will current local read/unread choices, including earlier changes in Letterfy, and future reading actions sync to Gmail. Cancelling or declining leaves the existing read-only connection available. Turning sync off stops future writes and retains local choices; it does not undo earlier writes or revoke Google’s grant. Reconnecting returns that account to read-only mode. Google’s broader permission is used only for the implemented reading actions; Letterfy never sends or deletes email. User-selected unsubscribe requests use a separate direct connection to the publisher. You can withdraw provider access through your Google Account.

Choices during setup

Starting with build 57, a fresh onboarding setup presents publication matching, catalog sharing, publication reader counts, automatic newsletter images, hourly automatic mail checks, and all three notification categories initially on. Each choice has an explanation and can be turned off before you save and continue. Opening or dismissing the choices does not apply them. Previously saved choices are preserved when setup resumes, and updating the app does not change preferences for people who already completed setup. These choices remain editable in Privacy & data, Reading preferences, Mail checks and Notifications. Notification delivery also needs separate iOS permission, which you can decline while continuing to use Letterfy.

Automatic checks and notifications

Automatic checks after initial account setup are optional. Fresh onboarding in build 57 and later initially selects them with an hourly target; saving and continuing enables the selected setting. Earlier builds start with automatic checking off, and existing choices are preserved. You can choose an hourly, six-hourly or daily target, or turn checks off in Mail checks. Checks run on your device; iOS controls background timing and does not guarantee a check at the selected interval. Swiping Letterfy away in the app switcher prevents background checks until you reopen it. Background App Refresh restrictions, Low Power Mode, device conditions and network access can also delay checks and the local notifications that depend on them. When enabled, mailbox credentials and the local mailbox remain accessible to Letterfy while your phone is locked after the first unlock following a restart. Turning automatic checks off restores access only while unlocked. Mailbox credentials remain in device-only Keychain storage and are not sent to Letterfy.

Separate switches control local notifications for new reading, items needing review, and subscription confirmations. All three are initially selected in fresh onboarding starting with build 57; earlier builds start with subscription confirmation alerts off. Existing choices are preserved. Alerts apply to eligible new discoveries after the selected category is enabled, without sending an old backlog. Saving notification choices during onboarding or choosing Enable notifications later can request separate iOS permission. Declining that permission does not prevent mail checks or reading. In builds with notification content controls, alerts include subjects and available snippets by default, including after upgrading from a count-only build. One email shows its subject and an available snippet; several show a short list of subjects and a remaining count. You can choose subjects only or counts only in Notifications. iOS Show Previews controls when content is visible, including on the Lock Screen; your device settings may also present notifications on connected devices. Subjects and snippets may contain personal information from the email. Confirmation alerts can show subjects, but confirmation links and tokens are never added as notification actions or separate payload fields; the confirmation queue retains no body or snippet. Previews are prepared locally and passed to the iOS notification system, without upload to Letterfy’s servers or use of server push delivery. Changing the content choice clears existing Letterfy alerts. Earlier builds show counts only. The app keeps notification history and pending alerts locally to prevent duplicates and removes that account’s history when you remove the account. Manual checking remains available without notification permission.

Publication matching and browsing

Starting with build 44, publication matching is initially on in onboarding, where its disclosure and switch let you turn it off before continuing. Continuing saves that choice. While matching is enabled, Letterfy automatically sends normalized sender addresses or publication-specific List-IDs and versioned hashes derived from those identities and issue titles to its authenticated catalog service in small batches. This finds existing publication and public issue identifiers without downloading the whole directory. Unknown newsletters remain readable. Matching requests do not contain raw subjects, bodies, previews, recipient addresses, mailbox account identifiers, reading state or provider credentials. Sender and list identifiers may themselves contain personal information. The hashes are derived mailbox data, not anonymization, and known titles can be compared with them.

The service processes lookup keys to answer the request; the lookup handler does not save keys, results or a lookup history in server tables or application logs. Installation authentication and ordinary hosting/security processing still apply, so a request can be associated with the installation while it is handled. On-device caches retain relevant keys and results for offline use and remove keys for mail no longer in the library on its next reload. Lookups do not add catalog suggestions or verification votes and do not train a model. Add privately and the catalog-contribution pause control prevent contributions; they do not disable publication matching. You can turn matching off separately in Privacy & data; this clears its local lookup cache and stops future matching requests. Build 43 instead asks through a separate first-use choice. Existing matching choices are preserved. Installations that already completed onboarding without making a matching choice keep matching off until it is enabled in Privacy & data.

Discover sends your search text and page cursor to the catalog service. Public issue browsing sends relevant publication IDs, search text and page cursors; artwork requests send a bounded list of catalog publication, publisher or blog IDs. These requests may reveal publications, publishers or blogs of interest to the service during processing. They do not contain newsletter bodies or mailbox credentials, and these handlers do not save a browsing history.

Publication catalog sharing

In compatible builds that offer Add & verify (including builds 39, 40 and 43), Add & verify shares the publication name, normalized sender address or publication-specific List-ID, issue title, date and, where sufficient content is available, an on-device content fingerprint with Letterfy to improve Discover. A disclosure appears immediately before that choice in newsletter review and manual recovery. This authorizes contributions for that publication’s eligible current and future issues. Add privately excludes it from contributions; optional publication matching still works as described above. In updated builds, the disclosure is visible before the add action and the tap, right swipe or VoiceOver Add & verify action authorizes contributions in one step. Earlier preference-aware builds open a separate disclosure sheet before confirmation; still earlier builds make swipe-to-add private. Existing library approvals do not authorize these new contributions. The Privacy & data sharing switch is initially enabled as a pause control. Starting with build 57, fresh onboarding also presents that choice before you save and continue. The switch does not itself enroll a publication; switching it off stops future contributions and switching it back on resumes previously confirmed choices. Builds without Add & verify, including build 41, may still send limited catalog metadata under their existing catalog-sharing setting, which is initially enabled; they do not send content fingerprints. Manually recovered and possible-newsletter additions in those builds remain excluded from catalog submissions.

The submitted catalog fields do not include your account identifier, recipient address, message body, preview, images, reading state or email credentials. A separate app-access credential accompanies the request so Letterfy can verify the installation. We do not attach the installation key or credential to catalog review records. They enter a private review queue; approved publication identities can become part of the public directory. Reviewers may see the submitted publication information. We also store versioned lookup fingerprints derived from the submitted newsletter identity and normalized issue title. Reviewed fingerprints can appear in the public catalog so your device can match an issue without uploading its body or personalized links. These hashes are lookup identifiers, not anonymization or proof of delivery. Sender addresses and issue titles can themselves contain personal information, so consider this before enabling sharing or adding a newsletter.

Community verification uses a versioned, deterministic fingerprint calculated on your iPhone from normalized newsletter text. Fixed rules discard common greetings, hidden previews, tracking links, footer blocks and formatting; email bodies and recipient addresses are not uploaded. Unknown personalization can prevent a match, and short or insufficient text is skipped. Sender addresses and issue titles may contain personal information. Fingerprints are derived mailbox data, not guaranteed anonymization: a known text can be compared with its fingerprint. No generative model or shared-model training is used for this step.

The server combines the content fingerprint with a keyed, publication-specific pseudonym derived from the verified app installation and a server observation time. The pseudonym links reports within that publication and is not anonymous. One installation counts once per distinct content fingerprint. Administrators configure the required installations, distinct fingerprints and counting window; reports expire after 90 days. Pausing sharing stops future reports; previously stored reports expire on that schedule. Legacy subject-only signatures never count toward content verification. Matching reports suggest a real newsletter, not necessarily distinct people, authenticated delivery, publisher endorsement or permission to reuse content. Publication details and public links still need validation.

Letterfy also maintains a separate research inbox subscribed to publications for product development. Confirmed subscriptions and delivered messages can supply publication names and exact sender or list identities, and editorial editions can supply issue titles and receipt dates, to the same private catalog review queue. Bodies, recipients, provider identifiers and confirmation links are not copied into this catalog intake. A research subscription does not itself approve a public catalog entry; independent publisher checks and review still apply.

When automatic catalog review is enabled, Letterfy compares these suggestions with public publisher websites, subscription pages and RSS or Atom feeds. We collect public publication names, author or publisher names, descriptions, topic categories, archive links and possible artwork links, and retain selected facts, source links, check results and review history. Supported matches can enter Discover automatically; uncertain matches remain for human review. These checks do not approve artwork rights, establish authentic email delivery, grant reader eligibility or add newsletters to your personal library.

Public-source requests come from Letterfy’s server. The publisher receives the requested public URL and ordinary server connection information; Cloudflare’s DNS resolver receives the website hostname. We do not forward your app credentials, mailbox credentials, cookies, recipient information or submitted issue titles with these requests. Standard Substack sender addresses can identify a publication subdomain. This review uses deterministic rules, does not send submissions to a cloud AI model, and does not retain fetched page or feed bodies or add them to a training dataset.

Sharing visual cards

Compatible builds let you preview and export an image card for a selected newsletter or blog passage, a newsletter or blog post title, a public discussion post and its context, or a publication. Cards are rendered on your device and may include a suitable publication avatar already available in the app. Preparing the card does not fetch additional newsletter images. Creating a preview does not upload it to Letterfy or publish it to a social network. Newsletter and blog title cards do not automatically include the email or article body or preview; quote cards include the text you select. A title or selected passage may contain personal information, so review the card and caption before sharing.

When you choose a destination in the iOS share sheet, that app or service receives the card and the caption and public source link if included. The destination controls how these items are displayed and retained, under its own terms and privacy policy. Newsletter source links come from the reviewed catalog, rather than personalized links in your email. Blog cards can include the post’s identified public HTTPS address, including for a blog you added that is not listed in Discover. The app validates accepted address forms; this does not endorse the website or establish content rights. If no suitable public link is available, you can still share the card. Copy caption writes the caption to your device clipboard. Choosing Save Image can save the card to your photo library with your permission. Letterfy does not store exported cards on its server; recipients and other services may keep copies that Letterfy cannot recall.

Public blogs & optional blog alerts

Compatible builds let you discover and subscribe to public blogs without connecting an email account. Finding a blog sends the public website or feed address you enter to Letterfy. Browsing and searching blogs sends the selected public blog or post identifiers, page cursors and search terms needed for those requests. These requests use the separate verified app-installation access described below. Do not enter private, signed or credential-bearing website addresses.

Letterfy’s servers fetch public feeds and supported public article pages to identify posts and prepare reading content. We retain public source addresses, writer and publication details, post titles, excerpts, original links, dates and source-health information in the shared catalog. A newly added source is not automatically approved for public Discover listing. Blog fetching and public-source retention are separate from optional mailbox catalog contributions. No connected mailbox, email address or provider credential is needed or sent for blog subscriptions.

Where the source’s content policy permits, Letterfy caches supplied feed content or extracted public article content and searchable text on Cloudflare to provide Reading mode and downloads. Metadata-only sources retain no article body. An excerpt, unavailable page or unsupported source may require opening the original website; Letterfy does not bypass sign-in or payment controls. Public-source records and cached content have no general automatic expiry and may be corrected, replaced or removed when the source changes, permission changes or an operator removes it. Public availability alone does not establish ownership or unrestricted reuse rights. Writers can contact us about correction or removal.

Your selected blog subscriptions, read or unread choices, saved status, reading position and downloaded content are kept on this device. Fetching a particular public post necessarily tells Letterfy which content was requested; the app does not upload those local reading-state records for blog synchronization or publish a list of your subscriptions. There is no cross-device blog subscription or reading-state synchronization. Unfollowing stops future local delivery, removes the blog’s posts from Read and Library and clears unsaved downloaded blog content. Saved posts remain in Saved; local post metadata and read history are retained. This does not unsubscribe you from an email list, cancel paid access or delete the shared catalog source.

Blog alerts are a separate choice, initially off, and are not required for subscribing or reading. When you enable them and the service supports push delivery, Letterfy receives this app installation’s Apple push token, push environment and selected followed-blog identifiers. We store that private routing information to send new-post alerts through Apple Push Notification service. Apple processes the token and notification payload for delivery; a blog alert can include the public blog name and post title, which may be visible on your Lock Screen under your iOS settings. This feature does not send mailbox data, saved status, reading position or read history. Public feed checks run on Letterfy’s servers independently of local email checks.

Turning blog alerts off requests removal of the private push registration, its followed-blog routing and queued deliveries. Unfollowing requests removal of that blog from the routing. Offline or failed requests take effect on the server after a successful retry; iPhone notification settings can stop alerts immediately on your device. Inactive push registrations expire after 90 days without registration, invalid tokens are removed when identified, and sent delivery records are eligible for cleanup after seven days. Scheduled cleanup is not a promise of deletion at an exact time. Deleting the app cannot send a removal request. Local subscriptions and saved posts remain when alerts are turned off. Notification timing and delivery depend on the publisher, Letterfy checks, your settings, Apple and network availability.

Blog article images follow the app’s image-loading choice. Loading remote images or opening the original website can contact the destination from your device, which may disclose your IP address and the requested address. The original website’s terms, cookies and privacy policy apply when opened. In builds with unified reading, blog links use the same Open/Cancel notice, Open links preference and persistent website profile as newsletter links, as described in Images & external links. Blog reading and following do not establish receipt of a newsletter, unlock paid content or grant newsletter discussion permissions.

Public discussions & identity

Compatible Letterfy builds offer optional public discussions using an existing AT Protocol account, including supported Bluesky accounts. This connection is separate from email sign-in. Your provider handles account authorization, and community access credentials are kept in a separate device-only Keychain entry. Letterfy’s API receives short-lived signed identity proofs, not your provider’s OAuth access or refresh token. Connecting does not create posts or alter your provider’s records. Letterfy indexes your existing public profile so other readers can recognize you.

Letterfy requests public names, handles, biographies and profile-photo URLs from Bluesky’s public profile service using public account identifiers, and stores this information in its discussion service. These shared profiles are visible to all Letterfy readers, including people who have not connected a community account, subject to Letterfy’s moderation and block rules. A saved Letterfy display name comes from your public personal data server record and takes precedence over your Bluesky display name. These are user-chosen public details, not verification of a legal identity. Photos can be changed through your Bluesky profile.

Profile metadata requests come from Letterfy’s server and do not include the viewer’s credentials. Public profile photos load on your device from Bluesky’s image service, which receives the image path and ordinary connection information such as your IP address. Neither request includes mailbox credentials, private emails or community access tokens. Public profile snapshots are also cached on your device by account identifier and may be included in device backups; photo bytes are cached in memory. Disconnecting clears local sign-in and drafts but keeps public snapshots for display and reconnecting. Removing the app removes its local snapshots but does not remove the shared public profile.

When you choose to save a public profile or publish a post, reply, follow, like or repost, the app writes public Letterfy records to your account’s personal data server. These records include your public account identifier, the chosen content or interaction, timestamps and relevant public newsletter references. They are Letterfy records, not automatic Bluesky feed posts. Letterfy fetches accepted records from that server to index and display them. Your account provider and other services may make public records available to others.

Any newsletter passage you choose to quote and publish becomes public. The app shows this disclosure before publishing. Sharing is your choice; connecting email, reading a newsletter or connecting a community account does not itself publish a quote. Consider confidentiality and the publisher’s rights before sharing. Other people and services may copy public records, and deletion cannot recall every copy.

To start a discussion, the app checks locally for the selected newsletter and sends a publication identifier, your public account identifier, a one-time challenge and an App Attest assertion to Letterfy. We retain publication-scoped reader eligibility and device-key references to enforce this rule. This does not send the email or mailbox identity and does not prove a paid subscription or authentic delivery. Signed-in replies do not require the same reader grant.

When you choose to publish, Letterfy checks the comment, selected quote and public profile text against community rules before allowing publication and indexing. These deterministic checks run in Letterfy’s service; no AI or external moderation provider receives this text. Rejected unpublished drafts are not stored or logged by the service. Already indexed public records are checked before the server returns them for display, and Letterfy retains a copy of the indexed public record and its moderation verdict so edits cannot reuse an earlier check. These checks do not scan your private newsletter bodies. Reports and blocks are private Letterfy policy records associated with your public account identifier. Reports contain the public record reference, selected reason and a snapshot of that public record for authorized reviewers. Report snapshots can remain after a post is removed to support abuse review. The Letterfy team can dismiss reports, remove discussions, restrict an author’s participation or restore future access. Decisions retain the operator’s public identifier, record reference, reason and time for accountability. Removing your Letterfy account clears indexed content-check copies and report snapshots about your public records; minimal moderation decisions and restrictions may remain where needed to protect the service. Removing a post alone cannot recall other services’ copies. A block filters discussions in Letterfy; it does not make public repository records private or block them across every service.

Unpublished discussion drafts, selected quotes and pending retry records are stored locally in app preferences and may be included in device backups. They are not sent to the discussion service until you choose to publish. Disconnecting your community account clears its local credentials and drafts. Public records already published are separate.

Images & external links

Starting with build 57, fresh onboarding initially selects automatic newsletter image loading; it takes effect after you save and continue with that choice enabled. Earlier builds start with images blocked, and previously saved choices are preserved. Each email preview still starts with images blocked and needs its own temporary permission. While automatic image loading is enabled, or when you load images for an email preview, your device contacts the image host. This includes candidate header images on newsletter cards, which can load before you open a message. That host can receive your IP address and the requested image URL; a personalized image URL may reveal that a message was opened. Blocking small tracking pixels does not prevent every form of image-based tracking.

Header image selection analyzes image dimensions, layout and visual features on your device using a bundled model and local text recognition. The app does not upload images or extracted text to Letterfy or a cloud AI service for this selection, and does not collect your mailbox content for ongoing model training.

You can block newsletter and blog images in Reading preferences. The same saved choice applies to both types of article in builds with blog reading. Images already permitted and downloaded may be stored locally for offline reading. Letterfy’s separate artwork catalogs provide reviewed publication, publisher and blog icons or creator profile images for requested catalog IDs, as described above. Blog icons can be site favicons or an author image linked from the public site. These cached catalog images are served by Letterfy; browsing them does not contact the publisher or image host. They are separate from article-image preferences. Artwork never establishes sender authenticity or reader eligibility.

Newsletter web links open in Letterfy by default while the newsletter remains available in a draggable sheet. In builds with unified reading, blog article links and Open original use the same browser, with the post available in a draggable sheet. Reading options → Open links lets you save a preference to open future newsletter and blog links in your default browser. Updated builds first show a brief notice about third-party privacy and tracking, with a choice to open the website or cancel. The destination is not contacted until you confirm. Earlier in-app-browser builds open newsletter web links directly. Earlier blog builds open the original website in a system browser view instead of Letterfy’s shared browser. Links followed within an open website continue normally. Your device sends the requested URL, IP address and normal browser information directly to the destination; personalized links may identify you. Website scripts, images and cookies can operate independently of the article image-loading preference.

In builds with the Open links preference, Letterfy’s in-app browser uses a persistent website profile on this device, separate from the protected article reader and Safari. Cookies, website sign-ins, caches and other website storage can remain across browser closure and app restarts, subject to website expiry and system storage management. In builds with unified reading, this profile is shared across newsletters, blogs and connected mailboxes; unfollowing a blog, removing a mailbox or switching to your default browser does not clear it. Builds with centralized storage put Clear website data in Profile → Storage; Manage storage in Reading options or Browser options opens the same controls. This closes Letterfy’s web pages and resets its website profile. Earlier builds offer Clear website data directly in Reading options or Browser options. Letterfy asks WebKit to remove the old profile’s data and retries profile-container removal on a later app launch if it is still in use or removal fails. Earlier newsletter in-app-browser builds use temporary website storage that is not retained for later browser sessions. Clearing Letterfy website data does not clear Safari or revoke accounts held by independent websites.

Letterfy does not attach mailbox credentials or newsletter or blog article bodies to website requests, or upload your browsing history to its server. Opening a page in your default browser uses that browser’s own storage and settings; existing Safari sessions and website sign-ins are not transferred into Letterfy. Some passkeys and single sign-on providers require an external browser. Email links still ask before opening an email app.

When you open a publisher link or use a connected email provider, that provider’s own privacy policy applies. We do not control third-party websites or their data practices.

Letterfy’s bundled newsletter classifier is developed from messages delivered to an operator-controlled research inbox subscribed to free publications. The operator retains those messages and review records privately for classification development and testing; they have no automatic expiry. The app contains the trained classifier, not a copy of the research email corpus. This workflow does not collect connected customer mailbox content or personal review choices for shared training, and it does not use linked articles to expand received emails. Research-inbox email is hosted by Nylas separately from the app’s connected mailbox providers.

Improving newsletter detection

Our catalog review tools can store independently sourced publisher text with an explicit editorial or non-editorial label, source URL, training-rights evidence and reviewer record. Only examples specifically approved for training are exported to our offline training tools. Mailbox submissions, their derived metadata and manually selected emails are not copied into this shared training dataset. Public availability alone is not treated as training permission. These curated examples and review records have no automatic expiry; permission withdrawal excludes an example from future exports and requires review of existing datasets and models.

Google data & limited use

Letterfy’s handling of information received through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We use Google data only for the reading features, explicitly chosen Discover contributions and public excerpt sharing described here. We do not sell it, use it for advertising, or use it to train generalized AI models. Disclosures are restricted to authorized feature delivery, security, legal obligations, or a business transfer with the consent Google requires. Human access is limited to the exceptions Google permits, such as your specific permission, necessary security or legal work, or qualifying aggregated internal operations. Catalog reviewers can see the limited metadata described above; they do not have access to your mailbox.

Service providers & disclosures

We use service providers to host and operate Letterfy, handle email and deliver requested functionality. These providers may process the information needed for their role. When we share personal information with a provider acting on our behalf, we require it to use the information only for the authorized service and to provide protection consistent with this policy. The restrictions attached to Google user data continue to apply when a provider processes it. Cloudflare hosts this website, the app’s authenticated catalog and discussion services, public blog sources and permitted cached blog content, optional private blog-alert routing, and private reader-eligibility and moderation records. Your AT Protocol provider hosts public repository records and processes community authorization and repository requests. Your email provider processes requests when you connect or refresh your mailbox. Apple processes optional blog-alert delivery through Apple Push Notification service and app-integrity checks through App Attest, as well as information connected with app distribution and TestFlight under its own policies.

We do not sell your personal information or use private email data for targeted advertising. The current website does not include Google Analytics, Firebase Analytics or Firebase Crashlytics. The app does not send private opens or time spent reading to our publication ranking service. Optional completion contributions are described below.

We may disclose information where necessary to meet legal obligations, protect users and our services, or complete a business transfer, subject to applicable law and any additional restrictions on provider data. We will not use a change in ownership to bypass the commitments in this policy.

Relevant provider policies include Cloudflare’s Privacy Policy, Google’s Privacy Policy and Apple’s Privacy Policy. Infrastructure providers may process information in countries other than the one where you live.

Your choices & retention

• Manage blogs and blog alerts: unfollow a blog in Your blogs or its toolbar menu; Saved posts remain. Turn blog alerts off in the app to request deletion of the private push registration. Local read history and subscriptions are separate from shared public source records. The Public blogs section above explains offline requests, retention and removal.
• Remove a newsletter from Letterfy: compatible builds offer Remove from Letterfy in newsletter and reader menus. This hides the selected newsletter’s sender or senders in the relevant connected mailboxes, stops adding their new issues to the reading library, and clears their local catalog-contribution consent. It does not unsubscribe you or delete email at your provider. Saved issues stay available, and downloaded content remains subject to the local retention rules below. You can restore a sender in Your newsletters → Hidden senders. Removal does not retract catalog metadata already submitted.
• Disconnect and delete local account data: go to Profile → Email accounts, open the connected account’s menu, and choose Remove account. Removing an account from the app deletes its local credentials, downloaded letters, search data and synchronization state. This does not delete your email-provider account, your messages at the email provider, or your newsletter subscriptions. Removing an IMAP connection deletes its password from this device; it does not revoke an app password at your provider. Email reading connects an existing email-provider account; optional community participation uses an existing AT Protocol identity rather than a new Letterfy password.
• Revoke provider access: use your provider’s connected-app settings. For Google, visit your Google Account connections. For Yahoo or another IMAP provider, delete the specific app password or revoke access using that provider’s security settings. Yahoo app passwords remain active after a change to your main account password until the app password itself is deleted. Revocation stops future authorized provider access; remove the account in Letterfy as well to erase its existing local data.
• Control mail checks and alerts: disable automatic checking or change its frequency in Mail checks, and change notification categories in Notifications. You can also disable notifications in iPhone Settings.
• Control publication sharing: turn off catalog sharing in Settings. This stops future submissions; it does not automatically remove publication metadata already submitted. Contact us about information already held.
• Manage community access and posts: use Profile → AT Protocol account to disconnect locally, and your AT Protocol provider’s connected-app controls to revoke its grant. Use a post’s menu to delete your own record from your personal data server and request removal from Letterfy’s index. Disconnecting or removing the app does not delete already published records. Contact us about private reader or moderation information held by Letterfy.
• Control image requests: change the image-loading preference in the app.
• Request assistance: contact us to ask about access, correction or deletion of personal information held by Letterfy. We may need to verify a request, and applicable legal obligations may limit what can be deleted.

Local downloads remain until you remove them or the account, or storage cleanup removes eligible downloads. Builds with centralized storage put newsletter and blog download amounts and their eligible read-download cleanup in Profile → Storage. This cleanup preserves Saved reading, unfinished articles, progress, subscriptions and Library history. Its reading-download amounts exclude website storage, catalog icons and other app files. Ordinary cleanup targets read, unsaved downloads after 30 days or when its storage budget is reached; saved letters and active reading downloads are protected from that cleanup. Searchable text and metadata can remain until account removal. Catalog submissions, automatic review results and approved directory records do not currently expire automatically: we keep them to review publications and operate the directory. Contact us to request correction or deletion of personal information in these records. Support correspondence is retained while needed to resolve your request and meet applicable legal obligations. Where a legal obligation prevents deletion, we retain only the information needed for that obligation.

Public discussion records remain in Letterfy’s index until they are deleted, removed through moderation, or become ineligible under its rules. Shared public profile snapshots are refreshed periodically and have no automatic expiry. A moderation removal hides a profile from Letterfy readers; an account deletion processed by Letterfy also removes its shared profile snapshot. Contact us to request correction or deletion. Changes made outside Letterfy are checked periodically, so deletion may not appear immediately. Reader eligibility expires after seven days unless renewed or revoked; expiry does not automatically erase the underlying policy record or an unchanged accepted discussion. Reader-grant, report, block and moderation records have no general automatic deletion deadline; contact us about access, correction or deletion. Independent copies of public records are governed by the services that hold them.

Optional publication reader counts

Starting with build 57, fresh onboarding initially selects “Include my reads in publication counts,” with its disclosure before you save and continue. You can turn it off before saving or later in Privacy & data. Earlier builds start with this choice off; existing saved choices are preserved. While enabled, deliberately using Finish or Mark as read for a newsletter with a matched public catalog identity sends that publication’s catalog ID and the completion time to Letterfy. The request uses verified app access and the contribution is stored with the installation key identifier. It contains no email body, issue title, sender or recipient address, mailbox account identifier, provider message ID or email credentials. Read flags imported from your provider and reading before you enabled sharing do not contribute.

Letterfy uses these contributions to show publication reader totals and up to three most-read publications over the rolling past seven days. Each participating app installation counts once per publication regardless of repeated reads, issues or connected mailboxes. These are not publisher subscriber totals or a verified count of distinct people: multiple devices or reinstalls may count separately, and readers who do not share are excluded. Other users see totals and rankings, not a list of readers. Letterfy can associate stored contributions with the installation; the data is not anonymous to Letterfy.

Turning sharing off clears local contribution records and queues a replacement that removes that installation’s server contributions. Undo or Mark as unread retracts the corresponding completion; other completions for the same publication may still count. Removing an email account removes its local contributions and queues an updated server snapshot. If offline or a request fails, pending changes retry when the app runs with a connection; contributions may remain visible until that update succeeds or they expire. Re-enabling starts fresh. No more than the 250 most recently completed publications per installation are included in a snapshot.

Contributions stop counting seven days after completion. Expired contribution rows and revoked-installation contributions are removed by scheduled cleanup and during contribution requests. This is not a promise that cleanup completes at an exact deadline. Installation keys and the latest snapshot revision remain as separate security and replay-prevention records until removed for security or support purposes. Uninstalling without first withdrawing cannot send a removal request; existing contributions still expire from counts. No readership data is used for advertising, sold or used to train AI models.

Security & children

Verified app access

Letterfy uses Apple App Attest to verify app installations before allowing catalog requests. We process an installation-specific key identifier, public key, verification proof and replay counter, and issue short-lived access credentials. The private key is managed on the device; your email login and mailbox content are not part of this verification. Requests can be associated with the installation during authentication. Raw installation identifiers are not saved alongside catalog submissions; optional community-verification receipts use the separate newsletter-specific pseudonyms described above.

We retain installation public keys, counters and revocation state until removed for security or support purposes. Removing an email account does not remove these separate installation records. Challenges and access credentials expire after five minutes; expired server records are cleaned during authentication requests and scheduled cleanup. Bootstrap abuse protection uses a temporary IP-address digest that expires after two ten-minute window boundaries. Catalog intake separately uses a daily IP digest that expires after two UTC day boundaries. We do not retain the full attestation certificate chain or Apple receipt.

We use safeguards intended to protect information, including device Keychain storage for credentials and iOS file protection for local mailbox data. No method of electronic storage or transmission is completely secure. Keep your device and account credentials secure and install relevant security updates.

Letterfy is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate steps to delete it.

Policy updates

We may update this policy as the service develops. We will post the revised policy here and change the date above. Where required, we will provide a more prominent notice or request consent before a new use of your information.