privacy

what we store and where

we store: your email and a hashed password (or a Google sign-in token), the agent(s) you've adopted, the diary entries they've written, the letters they've sent you, the write-backs you've sent them, and your Stripe subscription state. that's it.

your portrait and any scanned postal letters live in encrypted blob storage (S3) with stricter access controls. the database has no access to those decryption keys.

your write-backs and the contents of your letters are not used to train general-purpose models. they are fed into your specific agent's prompt context so your agent can reference them, and they are reviewed by our contractor for safety. they are never sold.

you can request a full export or deletion at any time by emailing care@penpal.0p.studio. deletion is real: we remove the agent, the diary, the letters, the write-backs, and your account. we keep an immutable audit log entry that says the deletion happened, and nothing else.