This is an English translation of the Lithuanian
privatumo politika, provided for readers outside Lithuania.
In case of any discrepancy, the Lithuanian version prevails.
This privacy policy sets out what data the Laiškelis app (the App) collects,
why, where it is stored, and what rights you have over it. The App is built to collect as
little as possible: there are no ads, no analytics and no tracking tools, and your data
will never be sold, rented or passed to third parties for marketing.
1. Data controller
The data controller is a private individual, Aleksandras Abrutis.
Email for all privacy matters:
aleksandrasabrutis18@gmail.com
The App is a non-commercial project: there are no paid services, subscriptions or
advertising, and none are planned.
2. What data we collect
We collect only what the App cannot work without:
Data
Purpose
Email address and password
Creating an account, signing in, and recovering it. The password is stored encrypted only — neither we nor anyone else can read it. Your email is never shown to other users.
Nickname
The only name other users see. You do not need to give a real name.
Adulthood confirmation
Confirmation that you are 18 or older (see section 8).
The letters you write
Delivering letters to random recipients — the App's core function.
Conversation messages
Writing to another user once you have both agreed to a conversation. Conversations can also be deleted at any time.
Reactions (likes, "graveyard" votes) and records of letters you received
The letter-travel logic: so the same letter is never shown to you twice, and so you never receive your own letter.
Reports of inappropriate content
Safety and content moderation.
Push notification token
Only if you allow notifications — so we can tell you what became of your letter, or that one has arrived (see section 5).
What we do not collect: real names, phone numbers, your contacts, social
media accounts, advertising identifiers, or usage statistics (analytics). The App contains
no third-party tracking technology of any kind.
3. Legal bases for processing (GDPR)
Performance of a contract (GDPR Art. 6(1)(b)) — accounts, letters, conversations and the other core features.
Consent (GDPR Art. 6(1)(a)) — push notifications. You can withdraw consent at any time in your device settings or in the App's settings.
4. Who can see your content
Other users see only your nickname and the content of your letters. Letters are delivered to random recipients with nothing that could identify you beyond the text itself.
The public "Obituary" section: once a letter expires (after 7 days) it may be published in a public section of the App, but only after a moderator review. Only the letter's text and the author's nickname are shown.
The moderator (the App's developer) deliberately reviews: letters and conversation messages that have been reported; and expired letters being considered for the "Obituary". Conversations that have not been reported are not normally reviewed or monitored.
The letter curator — a person authorised by the Operator to pick letters for Laiškelis's social media accounts (see section 3 of the Terms) — can read letters and see their authors' nicknames. They cannot see messages, conversations or any other data of yours, nor letters you marked "Let it disappear for good".
Technical access: the App's data is held in a database administered by the data controller, who therefore technically has access to everything stored in it, including private conversation messages that were never reported. That access is not used for routine reading or monitoring of conversations — it exists because of how a database works, not so that conversations can be watched. It is used only for a specific reason: a report, a legal requirement, or suspicion of a serious security breach.
An automatic keyword filter checks a letter as it is sent and may reject it. This is the only automated decision in the App — it has no legal consequences, and a rejected letter can always be reworded and sent again.
5. Notifications
With your consent, notifications are sent only when: your letter is collecting a lot of
likes; your letter has expired; your letter has made it into the "Obituary"; or as a
reminder to check for new letters (which can be turned off separately). We never send
promotional notifications.
6. Where data is stored, and who processes it on our behalf
We use the following service providers (data processors):
Supabase — database and authentication. All data is stored in the European Union (data centre in Ireland).
Expo (Expo, Inc., USA) and the Apple / Google push services — for sending notifications only. Only the notification token and the notification text are passed to them. Transfers to the USA rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.
The App uses no other third-party services.
7. How long we keep data
Account data — for as long as you have an account.
Letters — a letter is distributed to other users for 7 days; after that it is no longer distributed, but remains stored in your account and, if it passed moderation, may be shown in the "Obituary".
Conversation messages — for as long as the conversation exists.
Report records — until the report is resolved, and for a reasonable period after, so that repeat offences can be spotted.
After you delete your account — account data (email, nickname) is deleted, and your letters and messages are either deleted or irreversibly detached from your identity.
8. Age limit
The App is for adults (18 and over) only. Anyone creating an account must
confirm this. If it turns out that a user is under 18, the account is deleted.
9. Your rights
Under the GDPR you have the right to: access your data; have it corrected or erased;
restrict its processing; receive it in a portable format; object to processing based on
legitimate interest; and withdraw consent at any time. It's worth noting that you can see
all of your own data and letters in the App itself at any time.
You can delete your account in the App (in settings) or by writing to
aleksandrasabrutis18@gmail.com. We answer
all requests within 30 days at the latest.
If you believe your data is being handled improperly, you have the right to lodge a
complaint with the State Data Protection Inspectorate of Lithuania
(L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).
10. Changes to this policy
Material changes to this policy will be announced in the App. The current version,
with its update date, is always published on this page.