Privacy Policy

Effective date: October 18, 2026
Version: 2026-10-18.2

Controller and contact

The controller is the legal operator shown at the bottom of this page. For privacy, support, or abuse-prevention requests, contact hello@someonesentthis.com. For technical support, contact support@someonesentthis.com.

Privacy-first analytics

Ordinary analytics are designed for product and safety insight without us storing raw IP addresses. If analytics is allowed, we use first-party lightweight analytics, Google Analytics 4, and Google Ads conversion measurement to measure page views, referrers, approximate country, device type, feature performance, and purchase events such as order number, value, currency, and product type. We do not send message content, recipient email, purchaser email, or precise GPS location to Google Analytics or Google Ads.

Security, moderation and review records

For account and upload protection, payment integrity, abuse prevention and review, we process limited security events and case records. These can include an encrypted IP address or IP hash, approximate country, user agent, time, relevant request path, reported content references, the factual reason for an action, its scope, notices, your explanation and the review outcome. We use a valid legal basis, including a necessary and balanced legitimate interest where appropriate, not an unrestricted right to monitor or keep everything indefinitely. Access is limited to authorised people and service providers who need it.

What we collect

Depending on use, we may collect recipient details entered by the sender, sender or purchaser email if entered, message content, selected experience, add-ons, custom slug, unlock and expiration dates, order and payment references, invoice records, device type, approximate country, timestamps, support requests, and abuse reports.

Accounts and guest checkout

Guest checkout collects only what is needed for a specific send. Accounts and subscriptions require additional data such as name, email, password hash, MFA status, plan, credits, usage, invoices, billing references, cancellation status, and support records.

Payments and legally required records

Payments are processed by SumUp or the provider shown at checkout. We do not store full card numbers, CVC codes or bank authentication credentials. We retain necessary order, payment, invoice, tax and accounting records for the periods required by the applicable law. Account closure does not erase a legally required record. A required financial record is kept for that limited purpose, with restricted access, and is not retained as an unrestricted active customer profile.

Do-not-contact and abuse prevention

If a recipient asks not to receive messages through the platform, we may store that email address on a do-not-contact list to prevent future sends and protect deliverability and safety.

Promotional messages

If you opt in, we may send occasional product updates, tips, and offers. You can unsubscribe from promotional messages at any time. Unsubscribing does not stop transactional, security, invoice, payment, account, or service emails that are needed for the service.

Your rights and privacy contact

Where applicable, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent where consent is the basis. Contact support@someonesentthis.com; account suspension does not prevent a privacy request. We verify identity proportionately and respond within the applicable statutory period. You may complain to a competent data-protection or supervisory authority under the law that applies to you. Erasure has legal exceptions, including necessary compliance records and the establishment, exercise or defence of legal claims; any exception is limited to the data and period that are actually needed.

Age restriction

The service is intended for adults aged 18 and older. Do not submit personal data about minors unless you have the legal right to do so and the content is appropriate, safe, and lawful.

Closure, retention and deletion

Blocking access, closing an account and deleting personal data are separate steps. We first review outstanding paid obligations, necessary notices and any open appeal or dispute. We then delete or anonymise data no longer needed, subject to applicable law. Necessary security evidence or legal-claim records may be retained for a justified, limited period; a vague possibility of future misuse does not justify indefinite retention of the whole account. Retained records remain protected and are used only for their stated purpose. Backups follow a controlled replacement cycle and are not a means to reactivate a deleted profile.

App features and notifications

Notifications are optional and require a separate action and browser permission. We store an encrypted push endpoint and device subscription keys, the account link, language, permission time and authentication version to deliver account activity and personal reminders through your browser’s push provider, such as Apple, Google or Mozilla. Notifications use generic text, never private message content. This permission does not subscribe you to marketing. Disable notifications in your account or device settings.

Drafts are saved only when you choose Save draft. The name, text and choices are encrypted on our server and linked to your account and selected template. Files, access passwords and payment details are excluded. Drafts are not available offline. Delete drafts from your dashboard; our scheduled cleanup also removes optional app data after account closure.

Personal reminders store an encrypted label, chosen time, time zone, language and notification status. They create a generic optional notification, never an automatic email or message to another person. Delete a reminder before dispatch to cancel it. Drafts and reminders remain until you delete them or close your account; completed reminders can also be deleted. Push delivery records are retained for up to 30 days.