Privacy Policy

Who is responsible

André Valentin, Denmark, is the data controller for LetterTrip (lettertrip.app and the mobile game). Use our contact form for questions about your information or to exercise your privacy rights. You do not need a LetterTrip account to contact us.

Game and account information

Guest play creates a random player identity. We store your username, chosen language, puzzle discoveries, hints, stars, completion and replay records, and saved-journey history. The device keeps local progress and preferences; when online, it syncs game data with our server. A guest identity is pseudonymous, not necessarily anonymous.

If you create an email account, we also store your email address and a one-way password hash. Optional security features can store two-factor authentication information, recovery codes and passkey records. Authentication tokens let a signed-in device access your account; the iOS app stores credentials in secure device storage.

If you choose Apple or Google sign-in, we receive a provider identifier and the profile information the provider supplies, such as your name and email address. Apple may supply a private relay email address. We retain the identity link and tokens needed for the integration, including encrypted Apple tokens used for revocation. We do not receive your provider password or request access to your contacts, photos or email inbox.

Contact messages and technical data

The contact form stores the name you choose to give, your reply email, topic, message, language and submission time in our database. A submission is not public and is not a mailing-list subscription. Please do not send passwords, authentication codes or unnecessary sensitive information.

Requests to the website and API produce technical records, such as IP address, browser or app information, timestamps and error or security events. These help operate and protect the service. The game does not request camera, microphone or location access.

We record whether a player successfully syncs gameplay on each UTC date, to understand daily and returning activity. We store one player-and-date record per day, not a detailed click history, and remove it after 90 days. This uses our legitimate interest in understanding and improving the game. These gameplay-activity records stay on our own systems. Purchase and advertising providers process the data described below.

Authorized administrators can review player progress and contact requests. Changes to administrator access and contact-request status are recorded for security and accountability, using the administrator identity, action, record identifier and time. These audit records are kept for twelve months and do not copy message bodies or authentication credentials.

For guest and registered players, we save a random app/browser installation identifier, device model and manufacturer when available, platform and operating-system version, browser, app version/build and development/production channel, device language and region preferences, time zone, and first and most recent successful connection times. We estimate the connection country from the IP address using a country database on our own server; this feature stores the country, not the IP address, and sends no player information to the database provider. Country is approximate and may reflect a VPN, relay or travel; the region preference is not a location. Authorized administrators can view and search these details to troubleshoot problems and understand use of the game, based on our legitimate interests in maintaining and improving the service. We keep separate records for different installations, carry guest records into an account when linked, and delete device records after twelve months without use or when the account is deleted. Account-level first/last connection times remain with the account. This does not collect GPS coordinates, advertising IDs or hardware identifiers.

Purchases and advertising

RevenueCat helps verify purchases and restore access. We send a random purchase-customer identifier, rather than your LetterTrip email or username. RevenueCat and the app store process transaction identifiers, products, purchase and refund status, price/currency, storefront country and technical app/device information. LetterTrip stores verified access rights linked to your account. We use this information to provide purchases, prevent fraud and comply with applicable obligations. We do not receive payment-card details. When you delete your LetterTrip account, we request deletion of its RevenueCat customer records; the store may retain its own transaction records under its policies and legal obligations.

When enabled, mobile ad breaks use Google AdMob. The SDK may process IP address, device/app information and ad interactions to deliver ads, measure performance and prevent fraud. Before the first eligible ad break, you can choose non-personalized ads without giving your age. Personalized ads require confirmation that you are at least 18, your applicable Google consent choices and, on iPhone, Apple tracking permission. With permission, Google may use the advertising identifier for personalized advertising and measurement. If you decline or skip, we use restricted, non-personalized ad treatment. We store your choice and adult confirmation locally on your device, not your birthday. You can change your choice and manage applicable Google consent in Settings or Shop and purchases. Apple tracking permission can be changed in device Settings. Ad content remains limited to a general audience. Ad requests wait until the privacy flow permits them; unavailable ads never block play. Ad-free access disables ad requests. Development and beta builds use test ads.

Purchase and ad providers may process data outside Denmark or the EEA. Their applicable data-processing terms and transfer safeguards govern those transfers. RevenueCat privacy information is available at https://www.revenuecat.com/privacy and Google’s at https://policies.google.com/privacy.

We also record SDK-reported ad impressions linked to the player: a random event identifier, test/live mode, language and viewing time. Administrators can view these alongside purchase status and complimentary ad-free access. Detailed impression records are deleted after 90 days; lifetime counts and the latest viewing time remain until account deletion. These operational statistics help us understand ad frequency and troubleshoot the game. They are not a record of browsing activity outside LetterTrip.

Why we use this information

We use account, sign-in and game data to provide the service you request: playing, saving, restoring and syncing your journey. For registered users, the legal basis is performance of our agreement (GDPR Article 6(1)(b)). For guest functionality and service reliability, we rely on our legitimate interests in providing a working game (Article 6(1)(f)).

We rely on legitimate interests to prevent abuse, diagnose failures and answer general support messages. We use information necessary to answer privacy requests and meet other legal duties under Article 6(1)(c). We balance these interests against your rights. We do not make automated decisions producing legal or similarly significant effects about you.

Storage on your device

The website uses essential session and security cookies, and local storage or offline caches for preferences, artwork and progress. The app uses local storage for the journey and secure storage for authentication. These are used to deliver the features you request, rather than to profile you for advertising. Browser settings let you clear or block storage, but doing so can sign you out or remove unsynced guest progress.

Who receives information

Access is limited to the operator, authorized administrators and service providers needed to run LetterTrip, including Laravel Cloud for hosting and its infrastructure and security providers. The application is hosted in Frankfurt, Germany. We do not sell your personal information. Information may also be disclosed where necessary to comply with law or protect legal rights.

Apple and Google process information when you choose their sign-in services, under their own privacy policies. They and infrastructure providers may process some information outside the EEA. Applicable international transfers must use a GDPR transfer mechanism, such as an adequacy decision or standard contractual clauses. Contact us for information about the relevant providers and safeguards.

When you choose to share a postcard image, it can include your username and game statistics. You choose the recipient and sharing service. Saving a postcard to Photos uses the device’s permission to add an image; LetterTrip does not read your photo library.

If you choose to send a postcard with a written greeting, we store your message, player identifier, displayed sender name, destination, language, creation time and a randomly generated link on our server to provide the sharing feature. Anyone with that link can read the postcard and message without an account, so do not include sensitive information. We do not collect the recipient’s address or contact details through this feature. Your chosen sharing service processes the link under its own terms. We do not create a public postcard feed.

How long information is kept

Account and journey records are kept while your account or guest journey remains on the service. We do not currently automatically expire inactive guest journeys. Starting a journey over can retain a registered player’s recovery backup and completed-run history; it is not account deletion.

Postcard messages remain on our server so their shared links keep working; they do not currently expire automatically. Deleting the linked account also deletes its postcard messages. You can contact us to request removal of a shared postcard, including one sent as a guest. Copies already saved or forwarded by recipients or sharing services are outside our control.

Deleting a registered account removes its active account and linked game records and authentication tokens. Limited technical records and infrastructure backups can remain until their retention window expires, or longer where needed for a specific legal obligation or dispute. Hosting logs expire according to the provider’s plan retention period or storage limit. Uninstalling or clearing local storage does not itself delete server records.

Contact-form messages are automatically removed from our active database after 12 months. Backup copies age out separately. A reservation of a generated Guest username can remain without an account link to prevent reissuing the same name.

Your choices and rights

Depending on the circumstances, you may request access to your information, correction, deletion, restriction or portability, and object to processing based on legitimate interests. If we ever rely on consent for an optional purpose, you may withdraw that consent. Use the contact form and choose Privacy or Account deletion. We may need proportionate information to verify account ownership; do not send a password. We normally respond to privacy-rights requests within one month, subject to the extensions permitted by law.

You may complain to the Danish Data Protection Agency (Datatilsynet) or the supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us before using that right. Some account information is needed to provide sign-in and cloud saves; if you do not provide it, those features cannot work.

Children and policy updates

Accounts are intended for people aged 13 or older. We do not knowingly offer accounts to children under 13. A parent or guardian who believes a child has supplied account information can contact us to request its removal. Additional local age and parental-permission requirements may apply.

We will update this page when our practices change and provide appropriate notice of material changes. The date above identifies the current version.