Privacy Policy

Dispatch is a letter-writing app for the people you love. Your letters are private. We don't read them, sell them, or use them for advertising. We collect only what we need to deliver your letters and keep the service running. You can delete everything at any time.

• Account information: Your name, email address, and profile photo (if provided). We need this to identify you and deliver your letters.
• Letter content: The text, photos, audio recordings, and media you include in your letters. Stored securely and only accessible to you and your intended recipients.
• Contact hashes: When you add recipients, we store cryptographic hashes of their email addresses to match them with existing accounts. We do not store your full contacts list.
• Device tokens: Push notification tokens so we can let you know when a letter arrives.
• Song attachments: When you attach a song from Apple Music, we store the song identifier and metadata (title, artist, artwork URL) — not the audio itself.

This list is short and absolute:

• We don't track you across apps or websites.
• We don't show you ads.
• We don't sell or rent your data to anyone.
• We don't share your information with data brokers or marketing partners.
• We don't use your content to train AI models.
• We don't read your letters.

Your data is stored on Supabase, a hosted infrastructure platform backed by PostgreSQL and AWS. Data is encrypted at rest and in transit. Photos and media are stored in Supabase Storage with row-level security policies that ensure only you and your recipients can access them. Database backups are encrypted and retained for 30 days.

We use a small number of third-party services to make Dispatch work. Here's exactly who they are and why:

• Apple Sign in with Apple:If you sign in with Apple, Apple provides us with your name and email (or a private relay address). Apple's privacy policy governs their handling of your credentials.
• Google OAuth:If you sign in with Google, Google provides us with your name, email, and profile photo. Google's privacy policy governs their handling of your credentials.
• AI text processing: When you use the polish or translate features, the text of your letter is sent to a third-party AI API for processing. Only the text is sent — not your name, email, photos, or any account information. The AI provider does not store your content and does not use it for model training.
• Apple Music (MusicKit):If you attach a song, we use Apple's MusicKit API to search and retrieve song metadata. We do not access your personal Apple Music library data.

AI features in Dispatch — writing polish, tone adjustment, and translation — are entirely optional. When you choose to use them, here's what happens:

• Your letter text is sent to our AI provider for processing.
• Only the text content is transmitted — no photos, no metadata, no personal identifiers.
• The AI provider processes your request and returns the result. They do not store your content.
• Your original text is always preserved. You choose whether to accept the AI's suggestion.

You can write and send letters without ever touching AI features. They're there if you want them, invisible if you don't.

You have full control over your data:

• Access: All your letters and profile data are visible in the app at any time.
• Export: You can request a full export of your data by contacting us.
• Deletion:You can delete your account from Settings in the app. This permanently removes your profile, letters, photos, and all associated data. Account deletion requires re-authentication and typing "DELETE" to confirm. This action cannot be undone.
• Correction: You can update your name, email, and profile information at any time in the app.

If you're in the EU or EEA, here's how we comply with the General Data Protection Regulation:

• Legal basis for core features: Contract performance. We process your data to provide the service you signed up for — creating, storing, and delivering your letters.
• Legal basis for AI features: Consent. AI polish and translation are optional features that you explicitly choose to use each time.
• Data controller: Dispatch (operated by Pookie B Co.), Los Angeles, California, USA.
• Data transfers: Your data is stored on servers in the United States. We rely on standard contractual clauses for cross-border transfers.
• Right to object: You may object to data processing by deleting your account or contacting us.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

If you're in South Korea, here's how we comply with the Personal Information Protection Act:

• Data controller: Dispatch (operated by Pookie B Co.), Los Angeles, California, USA. Contact: [email protected]
• Purpose of collection: Account management, letter creation and delivery, notification delivery, and optional AI text processing.
• Retention period: Account data is retained while your account is active. Upon account deletion, all personal information is destroyed within 30 days. Backup copies are purged within 90 days.
• Third-party provision: We provide data to Supabase (hosting and storage) and our AI provider (text content only, for optional polish/translate features). No data is provided to third parties for marketing.
• Overseas transfer: Data is processed and stored in the United States by Supabase (AWS infrastructure).

Dispatch is not intended for anyone under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly.

We may update this privacy policy from time to time. When we make significant changes, we'll notify you via email or an in-app notification. The "Last updated" date at the top will always reflect the most recent version.

Questions, concerns, or requests about your privacy? Reach us at [email protected]. We respond to all privacy inquiries within 5 business days.