LEGAL DOCUMENT
Cookie Policy
Version 1.0 · effective 2026-07-29
The Old Letters does not use analytics cookies, advertising, remarketing, session recording or social pixels. Without storing an identifier on the device, we count only predefined events in daily anonymous aggregates. Other technologies are necessary to operate the Service or remember settings expressly selected by the User.
1. Device technologies
Device technologies include cookies, localStorage, sessionStorage, IndexedDB, the PWA cache, authentication tokens, security identifiers and similar solutions that store or access information on a device.
2. Responsible entity
Joanna Szamota, carrying on a sole-trader business under the registered name “Joanna Szamota Blackgrain Workshop” ul. Zachodnia 24 05-822 Milanówek, Poland NIP 5291840195 REGON 521704456 Email: support@theoldletters.com
3. Why we do not display a consent banner
The Service does not run optional analytics or marketing technologies that store or read an identifier on the device. The technologies in use are necessary for transmission, authentication, security, encryption, a function selected by the User, or remembering the User's settings. The Service therefore does not request consent through a cookie banner.
If we introduce an optional technology that requires consent, it will remain disabled until the User gives freely chosen consent. We will update this Policy before that technology is enabled.
4. Technologies in use
| Technology | Storage / supplier | Purpose | Duration |
| Supabase Auth session | localStorage; Supabase, Inc. | authentication, session refresh and Account protection | until sign-out or session expiry |
| The Old Letters settings | localStorage; TOL | language, theme, currency, reading mode, stationery and other interface choices | until changed, browser data are cleared or the Account is deleted |
| Unlocked encryption key | sessionStorage; TOL | local decryption of correspondence in the current tab | until the tab is closed, the Application is locked or the User signs out |
| Encrypted drafts and local indexes | IndexedDB; TOL | encrypted draft autosave, local notes, archive index and fast device unlock | until removed, browser data are cleared or the Account is deleted |
| PWA application cache | Cache Storage / IndexedDB; TOL | installation, updates and access to the static interface | until the Application is updated or site data are cleared |
| Cloudflare Turnstile | connection to challenges.cloudflare.com; Cloudflare, Inc. | protection of sign-in, registration and forms against bots and abuse | a short verification session under the Cloudflare configuration |
| Web Push subscription | browser or operating-system provider | optional notice of a new Letter without its sender, title or content excerpt | until notifications are disabled, sign-out or subscription expiry |
| Aggregated product events | network request to TOL; no device storage | daily counts of predefined product stages without identifiers, Letter content or free-form fields | aggregates for up to 400 days |
Cloudflare and a push-notification provider may receive technical data such as an IP address, device and traffic signals, a push endpoint or subscription keys. The Privacy Policy explains recipients, transfers and legal bases.
5. Technologies we do not use
The Service has disabled:
- identifier-, cookie- or person-journey-based analytics;
- session recording;
- advertising, marketing and remarketing pixels;
- advertising profiling; and
- tracking social-media integrations.
Private Letter content is not used for advertising or analytics.
6. Browser controls
Users can remove site data in browser settings. This may sign the User out and remove local preferences, encrypted drafts or data needed for fast unlock. Blocking browser storage may prevent authentication or correct Application operation.
7. Changes and contact
This Policy may be updated following changes to functions, suppliers or law. Material changes will be identified in the Service. Questions may be sent to:
support@theoldletters.com