Privacy

What we store

• your email address and a hash of your password (never the password itself)
• your login sessions, with the IP address and browser each one came from
• your letters: the subject and body (both encrypted), the delivery date, your timezone and delivery status
• IP addresses, to limit repeated attempts

Encryption, honestly

Letters are encrypted in our database. Because we have to deliver them, we hold the key, so this isn't end-to-end encryption. We never read letters, and we'd only access one if the law compels us.

Who helps us run Kesho

• Vercel: hosting, and cookieless Web Analytics
• Neon: the database
• Resend: sending email (it keeps a copy of sent emails for a short time)
• Cloudflare: DNS, email forwarding, and database backups (R2)

Cookies

Only the essential login session cookie. No tracking cookies, so no banner. Your unsent draft is kept in your own browser, not on our servers.

How long we keep things

• Unverified accounts and their pending letters are deleted after 7 days.
• Cancelled letters are deleted immediately.
• Delivered letters stay in your archive until you delete them.
• Backups keep the last 8 weekly copies.

Your rights

You can delete any letter, or your whole account, at any time from your letters page. Deleting your account deletes it and all its letters immediately; backups age out within 8 weeks. For anything else, email hello@kesho.et.

Changes

We'll announce material changes to this policy by email.