Laiškelis — Privacy Policy

Last updated: 18 August 2026

This is an English translation of the Lithuanian privatumo politika, provided for readers outside Lithuania. In case of any discrepancy, the Lithuanian version prevails.

This privacy policy sets out what data the Laiškelis app (the App) collects, why, where it is stored, and what rights you have over it. The App is built to collect as little as possible: there are no ads, no analytics and no tracking tools, and your data will never be sold, rented or passed to third parties for marketing.

1. Data controller

The data controller is a private individual, Aleksandras Abrutis. Email for all privacy matters: aleksandrasabrutis18@gmail.com

The App is a non-commercial project: there are no paid services, subscriptions or advertising, and none are planned.

2. What data we collect

We collect only what the App cannot work without:

Data	Purpose
Email address and password	Creating an account, signing in, and recovering it. The password is stored encrypted only — neither we nor anyone else can read it. Your email is never shown to other users.
Nickname	The only name other users see. You do not need to give a real name.
Adulthood confirmation	Confirmation that you are 18 or older (see section 8).
The letters you write	Delivering letters to random recipients — the App's core function.
Conversation messages	Writing to another user once you have both agreed to a conversation. Conversations can also be deleted at any time.
Reactions (likes, "graveyard" votes) and records of letters you received	The letter-travel logic: so the same letter is never shown to you twice, and so you never receive your own letter.
Reports of inappropriate content	Safety and content moderation.
Push notification token	Only if you allow notifications — so we can tell you what became of your letter, or that one has arrived (see section 5).

What we do not collect: real names, phone numbers, your contacts, social media accounts, advertising identifiers, or usage statistics (analytics). The App contains no third-party tracking technology of any kind.

3. Legal bases for processing (GDPR)

• Performance of a contract (GDPR Art. 6(1)(b)) — accounts, letters, conversations and the other core features.
• Legitimate interest (GDPR Art. 6(1)(f)) — content moderation, handling reports, and keeping users safe.
• Consent (GDPR Art. 6(1)(a)) — push notifications. You can withdraw consent at any time in your device settings or in the App's settings.

4. Who can see your content

• Other users see only your nickname and the content of your letters. Letters are delivered to random recipients with nothing that could identify you beyond the text itself.
• The public "Obituary" section: once a letter expires (after 7 days) it may be published in a public section of the App, but only after a moderator review. Only the letter's text and the author's nickname are shown.
• The moderator (the App's developer) deliberately reviews: letters and conversation messages that have been reported; and expired letters being considered for the "Obituary". Conversations that have not been reported are not normally reviewed or monitored.
• Technical access: the App's data is held in a database administered by the data controller, who therefore technically has access to everything stored in it, including private conversation messages that were never reported. That access is not used for routine reading or monitoring of conversations — it exists because of how a database works, not so that conversations can be watched. It is used only for a specific reason: a report, a legal requirement, or suspicion of a serious security breach.
• An automatic keyword filter checks a letter as it is sent and may reject it. This is the only automated decision in the App — it has no legal consequences, and a rejected letter can always be reworded and sent again.

5. Notifications

With your consent, notifications are sent only when: your letter is collecting a lot of likes; your letter has expired; your letter has made it into the "Obituary"; or as a reminder to check for new letters (which can be turned off separately). We never send promotional notifications.

6. Where data is stored, and who processes it on our behalf

We use the following service providers (data processors):

• Supabase — database and authentication. All data is stored in the European Union (data centre in Ireland).
• Expo (Expo, Inc., USA) and the Apple / Google push services — for sending notifications only. Only the notification token and the notification text are passed to them. Transfers to the USA rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

The App uses no other third-party services.

7. How long we keep data

• Account data — for as long as you have an account.
• Letters — a letter is distributed to other users for 7 days; after that it is no longer distributed, but remains stored in your account and, if it passed moderation, may be shown in the "Obituary".
• Conversation messages — for as long as the conversation exists.
• Report records — until the report is resolved, and for a reasonable period after, so that repeat offences can be spotted.
• After you delete your account — account data (email, nickname) is deleted, and your letters and messages are either deleted or irreversibly detached from your identity.

8. Age limit

The App is for adults (18 and over) only. Anyone creating an account must confirm this. If it turns out that a user is under 18, the account is deleted.

9. Your rights

Under the GDPR you have the right to: access your data; have it corrected or erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interest; and withdraw consent at any time. It's worth noting that you can see all of your own data and letters in the App itself at any time.

You can delete your account in the App (in settings) or by writing to aleksandrasabrutis18@gmail.com. We answer all requests within 30 days at the latest.

If you believe your data is being handled improperly, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).

10. Changes to this policy

Material changes to this policy will be announced in the App. The current version, with its update date, is always published on this page.